cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-82398 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-82398 Source advisory: OSV:GHSA-FC8X-2RWW-XW9M...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via the Downloader.download and Downloader.incrdownload file-write path in nltk/downloader.py. An attacke...

Uncontrolled Recursion

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Uncontrolled Recursion via the RecursiveDescentParser in nltk/parse/recursivedescent.py. An attacker can pin a CPU core indefinitely or exhaust...

GHSA-FF5C-CP5C-9WJF NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

OPENSUSE-SU-2026:21741-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

SUSE-SU-2026:23607-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

SUSE CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

Exploit for CVE-2022-25765

CVE-2022-...

GHSA-5CC2-282F-JJQ2 vulnerabilities

Vulnerabilities for packages: airflow, keep-fips, mlrun-fips, keep, datadog-agent, datadog-agent-fips, mlrun...

[SECURITY] Fedora 44 Update: python-linkify-it-py-2.1.1-1.fc44

This is a Python port of linkify-it 1, a link recognition library with FULL unicode support. It is focused on high quality link pattern detection in plain text. See a JavaScript demo 2. References: 1 https://github.com/markdown-it/linkify-it 2 https://markdown-it.github.io/linkify-it/...

[SECURITY] Fedora 44 Update: python-llm-0.33-2.fc44

A CLI tool and Python library for interacting with Large Language Models, both via remote APIs and with models that can be installed and run on your own machine...

CVE-2020-11881

creationtimestamp| type| source ---|---|--- 2026-09-02 01:00:13+00:00| seen| Telegram/V5hKn0oJ2nGQvFUOA8vMmIzpE0-LTzLZfzF3v7e7Ud5xOzo 2026-09-03 00:00:53+00:00| published-proof-of-concept| Telegram/V5hKn0oJ2nGQvFUOA8vMmIzpE0-LTzLZfzF3v7e7Ud5xOzo...

SUSE CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

PT-2026-84846

Name of the Vulnerable Software and Affected Versions HTTPX2 versions prior to 2.11.0 Description The Request. prepare function in src/httpx2/httpx2/ models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. This occurs...

CVE-2026-84382: Improper Handling of Highly Compressed Data (Data Amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84378: Inefficient Algorithmic Complexity

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...

CVE-2026-84809: Protection Mechanism Failure

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

ROS-20260902-73-0011

The vulnerability of the HTTPConnection.urlopen method in the Python HTTP library, Urllib3, is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

ROS-20260902-73-0019

The vulnerability in python-pyasn1 is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-84655: Improper Encoding or Escaping of Output

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...