CVE-2026-85999: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...

CVE-2026-86000: Uncontrolled Resource Consumption

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src/soupsieve/cssparser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. When an...

RockyLinux 8 : python-lxml (RLSA-2026:67943)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-3793)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

Ubuntu 18.04 LTS / 26.04 LTS : python-cryptography vulnerabilities (USN-8776-1)

The remote Ubuntu 18.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8776-1 advisory. It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. Thi...

EulerOS 2.0 SP15 : python-pip (EulerOS-SA-2026-3818)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

Fedora 45 : python-django5 (2026-950089270f)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-950089270f advisory. Update python-django5 to the latest 5.x release 5.2.17 - Fixes CVE-2026-15307 high: Server-side file-write and request forgery via spatial lookups -...

AlmaLinux 8 : python-lxml (ALSA-2026:67943)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:67943 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

EulerOS 2.0 SP15 : python-idna (EulerOS-SA-2026-3791)

According to the versions of the python-idna package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and...

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the userconfig request parameter. An attacker can make the server initiate requests to arbitrary internal or external hosts by supplyin...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

DEBIAN-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

UBUNTU-CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

USN-8776-1: python-cryptography vulnerabilities

It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. CVE-2023-23931 It was discovered that...

USN-8776-1 python-cryptography vulnerabilities

It was discovered that python-cryptography incorrectly accepted objects with immutable buffers when performing certain cipher operations. This would result in corrupted output, contrary to expectations. This issue only affected Ubuntu 18.04 LTS. CVE-2023-23931 It was discovered that...

CVE-2026-62949

CVE-2026-62949 affects AsyncSSH , a Python asynchronous SSHv2 implementation. The flaw resides in _process_channel_open and _process_channel_open_confirmation in asyncssh/connection.py, which accept a peer-supplied send_pktsize value of zero . When channel data reaches SSHChannel._flush_send_buf,...

CVE-2026-62949

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.0, processchannelopen and processchannelopenconfirmation in asyncssh/connection.py accept a peer-supplied sendpktsize value of...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in idna

Summary IBM Watson Discovery Cartridge affected by vulnerability in idna Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in python_dotenv

Summary IBM Watson Discovery Cartridge affected by vulnerability in pythondotenv Vulnerability Details CVEID:CVE-2026-28684 DESCRIPTION: python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, setkey and unsetkey in python-dotenv...