CVE-2026-48987

pyLoad , a free and open-source Python download manager, is affected by unbounded memory growth in its EventManager module (src/pyload/core/managers/event_manager.py). Each unique UUID submitted to the authenticated getEvents API endpoint appends a Client object to an internal list, but the avail...

CVE-2026-48737

pyLoad (pyload-ng), a Python-based open-source download manager, has an SSRF guard bypass (CWE-918) in its is_global_address function. The guard relies on Python's ipaddress.IPv6Address.is_global, which classifies 6to4 (2002::/16) and NAT64 (64:ff9b::/96) transition prefixes as globally routable ...

USN-8765-1 python-sql vulnerability

Cédric Krier discovered that python-sql incorrectly escaped values passed to unary operators. An attacker could possibly use this issue to perform SQL injection attacks...

USN-8765-1: python-sql vulnerability

Cédric Krier discovered that python-sql incorrectly escaped values passed to unary operators. An attacker could possibly use this issue to perform SQL injection attacks...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python/Expat: Denial of Service via crafted XML document

A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...

python: Python: Denial of Service via out-of-bounds write in BZ2 decompression

A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...

python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

python: Python tarfile module: Security filter bypass allows arbitrary file write

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

python: Python: FTP connection redirection via ftpcp() function bypass

A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...

python: Python unicodedata: Denial of Service due to excessive CPU consumption

A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...

Security update for python-GitPython

This update for python-GitPython fixes the following issues: CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...

SUSE-SU-2026:4191-1 Security update for python-GitPython

This update for python-GitPython fixes the following issues: - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...

RLSA-2026:67147 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-82049

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python: Improper Input Validation CVE-2025-13462, CVE-2026-3644, Denial of Service CVE-2026-15308, CVE-2026-7210, CVE-2026-66046, Use-After-Free / Memory Corruption CVE-2026-76957, Out-of-Bounds Read / Infinite Loop CVE-2026-72522, CVE-2026-76641, Insufficient Entropy...

ROOT-APP-PYPI-CVE-2026-35523 CVE-2026-35523 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35523 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

Exploit for Improper Access Control in Widgetfactorylimited Jce

E.L.V CVE Research & Assessment Framework E.L.V — Exploit...

giskard-oss giskard-checks/v1.0.4

Evals, Red Teaming and Test Generation for Agentic Systems Modular, Lightweight, Dynamic and Async-first Docs • Website • Community !IMPORTANT Giskard v3 is a fresh rewrite designed for dynamic, multi-turn testing of AI agents. This release drops heavy dependencies for better efficiency while...