CVE-2026-13346 affecting package python-virtualenv for versions less than 20.36.1-6

CVE-2026-13346 affecting package python-virtualenv for versions less than 20.36.1-6. A patched version of the package is available...

CVE-2026-13346 affecting package python-pip for versions less than 24.2-10

CVE-2026-13346 affecting package python-pip for versions less than 24.2-10. A patched version of the package is available...

Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

MAL-2026-16134 Malicious code in ollamaa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11eb7019f9ead481b3c5f203703df3b8b63abab2e03502a02ba30360da9948d9 The ollamaa package on PyPI is a one-character typosquat of ollama. Its init.py re-exports everything from the real ollama package so imports appear ...

MAL-2026-16135 Malicious code in openaii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d982f068d7525c41b811b82cede3710e7b614363abae75c356e6c280412baf The package name 'openaii' is a one-character edit of 'openai' and its PyPI summary copies the official openai project description verbatim 'The...

Security Bulletin: IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities

Summary There are vulnerabilities identified in Cognos Analytics application and its open source components. These vulnerabilties has been resolved and the remediation versions is provided below. Vulnerability Details CVEID:CVE-2024-56344 DESCRIPTION: IBM Cognos Analytics could allow a remote...

[SECURITY] Fedora 45 Update: python-asteval-1.0.10-1.fc45

ASTEVAL is a safeish evaluator of Python expressions and statements, using Python's ast module. The idea is to provide a simple, safe, and robust miniature mathematical language that can handle user-input. The emphasis here is on mathematical expressions, and so many functions from numpy are...

[SECURITY] Fedora 45 Update: python-pip-26.1.2-5.fc45

pip is a package management system used to install and manage software packag es written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

CVE-2026-87910

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

DEBIAN-CVE-2026-87910

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

UBUNTU-CVE-2026-87910

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

EUVD-2026-76162

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-87910

CVE-2026-87910 affects Python's tarfile module. When extracting a hardlink on a system without link support, tarfile falls back to extracting the referenced member from the archive. During this fallback, the extraction filter function is invoked twice—once for the extracted member and once with t...

PSF-2026-40

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-87910

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to buffer overflow due to cryptography ( CVE-2026-39892 )

Summary Potential vulnerabilities in cryptography package CVE-2026-39892 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From...

SUSE CVE-2026-88029

Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...

python-lxml security update

An update is available for python-lxml. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...