Astra Linux – Vulnerability in Python-Django

A issue was discovered in Django 5.0, prior to versions 5.0.7 and 4.2, prior to version 4.2.14. The derived classes of the django.core.files.storage.Storage base class, when they override generatefilename without replicating the file-path validations from the parent class, may allow directory...

Astra Linux – Vulnerability in Python 3.11

When using TarFile.errorlevel = 0 and extracting with a filter, the documented behavior is that any filtered members would be skipped and not extracted. However, the actual behavior of TarFile.errorlevel = 0 in affected versions is that the member will still be extracted and not skipped...

Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Pypy

The mitigation of CVE-2026-4519 was incomplete. If the URL contained “%action”, the mitigation could be bypassed by certain browser types. In this case, the “webbrowser.open” API could allow commands to be injected into the underlying shell. See CVE-2026-4519 for details...

Astra Linux – Vulnerability in python-pip

When extracting a tar archive, pip may not check symbolic links pointing into the extraction directory if the tarfile module does not implement PEP 706. Note that upgrading pip to a “fixed” version does not fix all vulnerabilities that are mitigated by using a Python version that implements PEP...

Astra Linux – Vulnerability in Python 3.11

It allows the extraction filter to be ignored, enabling symlink targets to point outside the destination directory, and modifying some file metadata. This vulnerability affects users who use the TarFile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract, with the...

ROOT-APP-PYPI-GHSA-93GM-QMQ6-W238 GHSA-93gm-qmq6-w238 in starlette - Patched by Root

Root has patched GHSA-93gm-qmq6-w238 in the starlette package for Root:PyPI. Multiple fixed versions available...

CVE-2026-87910

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

ROOT-APP-PYPI-CVE-2024-53981 CVE-2024-53981 in python-multipart - Patched by Root

Root has patched CVE-2024-53981 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-24762 CVE-2024-24762 in python-multipart - Patched by Root

Root has patched CVE-2024-24762 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-42561 CVE-2026-42561 in python-multipart - Patched by Root

Root has patched CVE-2026-42561 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-24486 CVE-2026-24486 in python-multipart - Patched by Root

Root has patched CVE-2026-24486 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-53539 CVE-2026-53539 in python-multipart - Patched by Root

Root has patched CVE-2026-53539 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

cra-watch

cra-watch Does anything you ship have a known-exploited vul...

Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2026:4145-1 Security update for python-sqlparse

This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU consumption bsc1278097...

CLSA-2026-1789365078 TuxCare security update for cryptography (2 CVEs)

TuxCare rebuilt cryptography to address 2 CVEs. Fixed in 44.0.3.post4+tuxcare...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

AndroidPhantom

👻 ANDROID PHANTOM 🏴‍☠️ The Next-Gen Android Pentesting Fr...

CVE-2026-90618

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.executecommand of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be...

CVE-2026-90621 ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection

A vulnerability was identified in ipa-lab HackingBuddyGPT up to 0.5.0. This affects the function sshruncommand of the file src/hackingBuddyGPT/extensions/sshruncommand.py. Such manipulation leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...