CVE-2026-37008: Improper Protection of Alternate Path

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-requests (UTSA-2023-002301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002301 advisory. Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint...

Python Import As an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps

Python import does more than resolve dependencies: it executes code during module and package initialization. This behavior can trigger failures, load dynamic or native code, access resources, or change security-sensitive state before an application calls a package API. Prior work studies package...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

shodan-CVE-2018-15473

これはShodanによって参照される100のIPアドレスに対してCVE-2018-15473のエクスプロイトをテストする簡単なスクリプトです。テストされるユーザー名はusers.txtに含まれています。 実行する必要があるファイルはmain.pyです。Linuxで動作し、www.shodan.ioから自身のAPIキーを取得する必要があります。 結果は標準出力にのみ表示されます。ips.txtに保存されるIPリストを期待してください。 CVE攻撃はhttps://github.com/Sait-Nuri/CVE-2018-15473からフォークされました。...

PYSEC-2026-3985

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-16142 Malicious code in python-fork (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

CVE-2026-84380 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2, lmcache-cuda-13.0...

GHSA-3HPW-4MFR-9F85 vulnerabilities

Vulnerabilities for packages: eco-python-curl, curl...

CVE-2026-82209 vulnerabilities

Vulnerabilities for packages: eco-python-curl, curl...

GHSA-PF96-P4FJ-6566 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

CVE-2026-84379 vulnerabilities

Vulnerabilities for packages: py3-httpx2...

GHSA-8XX6-HGC6-GC2M vulnerabilities

Vulnerabilities for packages: py3-httpx2...

Linux Distros Unpatched Vulnerability : CVE-2026-87910

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is...

openSUSE 16 Security Update : python-jwcrypto (openSUSE-SU-2026:21827-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21827-1 advisory. - CVE-2026-80179: denial of service via malformed JWE tokens bsc1277639. - CVE-2026-84185: general JSON JWS kid binding bypass during JWKSet...