libxml2: double-free/UAF in libxml2 Python bindings

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

darts v0.47.0

Time Series Made Easy in Python Darts is a Python library for user-friendly forecasting and anomaly detection on time series. It contains a variety of models, from classics such as ARIMA to deep neural networks. The forecasting models can all be used in the same way, using fit and predict...

messari-crack

Messari MSR Crack 2026 Messari プレミアムをアンロック | リサーチハブ & インテルデータフィードへのアクセス 説明 Messari MSR Crack は、Messari のプレミアムリサーチハブとインテルデータフィードへのアクセスをアンロックするために設計されたプロフェッショナルなクラッキングユーティリティです。機関投資家向けの暗号通貨リサーチ、市場インテリジェンスレポート、リアルタイムデータフィードへの無制限アクセスを提供します。 主な利点 ✅ リサーチハブのアンロック — Messari のプレミアムリサーチライブラリへの完全アクセス ✅...

python310-3.10.20-10.1 on GA media (moderate)

python310-3.10.20-10.1 on GA media Announcement ID: openSUSE-SU-2026:11690-1 Rating: moderate Cross-References: CVE-2026-13346 CVE-2026-1703 CVE-2026-3219 CVSS scores: CVE-2026-13346 SUSE : 4.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N CVE-2026-13346 SUSE : 5.6...

PYSEC-2026-3721

creationtimestamp| type| source ---|---|--- 2026-09-05 17:06:04+00:00| seen| https://gist.github.com/konard/19347b7afef1e0d007ef83355a1dc3e5 2026-09-21 10:13:29+00:00| seen| https://gist.github.com/konard/ed0a4a3ae649badd8b7c3792537c0cda 2026-10-05 15:09:48+00:00| seen|...

OESA-2026-3659 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

OESA-2026-3658 python-gunicorn security update

GunicornGreen Unicorn is a Python WSGI HTTP Server for UNIX. It's a pre-fork worker model ported from Ruby's Unicorn project. The Gunicorn server is broadly compatible with various web frameworks, simply implemented, light on server resource usage, and fairly speedy. Security Fixes: Gunicorn fail...

OESA-2026-3636 python-jwcrypto security update

Implements JWK, JWS, JWE specifications with python-cryptography Security Fixes: JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing...

OESA-2026-3619 python-soupsieve security update

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. It aims to provide selecting, matching, and filtering using modern CSS selectors. Soup Sieve currently provides selectors from the CSS level 1 specifications up through the latest CSS level 4 drafts and beyond though...

OESA-2026-3607 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

quark-engine v26.9.1

Malware Family Analysis Report Showcase | | ---|---|--- | !https://assets.ki...

monty v0.0.22

Monty A minimal, secure Python interpreter written in Rust for use by AI. Experimental - This project is still in development, and not ready for prime time. A minimal, secure Python interpreter written in Rust for use by AI. Monty avoids the cost, latency, complexity and general faff of using a...

CVE-2026-86169

Axolotl (through 0.18.0 ), a Python-based LLM fine-tuning framework, contains a remote code execution vulnerability in its multipack patch code path. The root cause is that the trust_remote_code parameter defaults to None instead of False, effectively bypassing the security guard. An attacker who...

CVE-2026-86169 Axolotl before 0.19.0 Remote Code Execution via Multipack Patching

Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trustremotecode defaults to None instead of False, causing the security guard to be bypassed. Attackers can execute arbitrary Python code by crafting a malicious Hugging Face model repository...

MAL-2026-15935 Malicious code in proxycer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764 The package's top-level init.py imports starts.py, which is a single-line loader that reverses a 100KB string literal, base64-decodes it, marshal.loa...

MGASA-2026-0377 Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

Updated python-linkify-it-py package fixes security vulnerabilities

LinkifyIt.match was quadratic on untrusted input when linkify is enabled GHSA-8m2q-wq3r-6hq8. Fix quadratic complexity in LinkifyIt.match, port of linkify-it 5.0.1 and 5.0.2 upstream CVE-2026-48801, CVE-2026-59887 82 Match validators at a position instead of slicing the tail, needed because Pytho...

SUSE CVE-2026-84379

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.renderheaders in src/httpx2/httpx2/multipart.py directly interpolates attacker-controlled contenttype values and custom headers from the files= three-element filename, content, contenttype tuple and the files=...

SUSE CVE-2026-84382

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

SUSE CVE-2026-85394

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...