CVE-2026-83551: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

ROS-20260901-73-0022

The vulnerability in python-pyasn1 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21687-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21687-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate...

TencentOS Server 2: python-pyasn1 (TSSA-2026:0941)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0941 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

openSUSE 16 Security Update : python-h2 (openSUSE-SU-2026:21693-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21693-1 advisory. This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, whic...

ROS-20260901-73-0023

The vulnerability in python-pyasn1 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-84305: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

PT-2026-84375

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

ROS-20260901-73-0016

The vulnerability of the checkunsafeoptions mechanism in the Python library for interacting with Git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

CVE-2026-51974: Improper Control of Generation of Code

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

PT-2026-84361

An eval injection vulnerability in the get list function in modules/meta parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

ROS-20260901-73-0017

The vulnerability of the option-name validation component in the Python library for interacting with Git repositories, GitPython, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands...

openSUSE 16 Security Update : python-sqlparse (openSUSE-SU-2026:21690-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21690-1 advisory. - CVE-2026-54284: high algorithm complexity when parsing SQL payloads with hundreds of nesting levels can lead to denial of service via excessiv...

Linux Distros Unpatched Vulnerability : CVE-2026-82398

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function...

CVE-2026-82397

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82398

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...

GHSA-VF76-F5CP-9846 Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...

Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...

CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...

CVE-2026-82397

Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...