CVE-2026-55520

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CVE-2026-55485

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

baotool (1.0.1), clutch-co-scraper (1.0.0) +11 more potentially affected by CVE-2026-55520 via protego (>=0.1.16, <=0.6.0)

protego PYPI version =0.1.16, =0.1.5, =0.3.0a0, =1.0.0, =0.7.2, =0.1.0, =0.1.0, =0.0.1, =0.1.0 - scrapy-plus 1.0.5 - scrapydartx 1.3.2 - shuirouyan-package-test 0.0.3 Source cves: CVE-2026-55520 Source advisory: OSV:GHSA-WJMF-P669-5M5P...

CVE-2026-55520 Protego: Exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego is a pure-Python robots.txt parser with support for modern conventions. Prior to 0.6.2, protego.urlpattern.URLPattern.preparepatternforregex translates every asterisk in an Allow or Disallow directive into a lazy regular-expression wildcard, so a directive containing many asterisks create...

CLSA-2026-1787934757 Fix CVE(s): CVE-2024-7254, CVE-2026-0994

SECURITY UPDATE: Unbounded recursion when parsing nested groups in protobuf-java - debian/patches/CVE-2024-7254.patch: bound the depth of the skipMessage/skipField recursion in CodedInputStream and of the nested-group recursion in UnknownFieldSetLite with the existing recursion limit, so a stream...

CVE-2026-82278

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

EUVD-2026-67809

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

CVE-2026-82278 BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec...

[SECURITY] Fedora 44 Update: python-pynitrokey-0.12.3-4.fc44

A command line interface for the Nitrokey FIDO2, Nitrokey Start, Nitrokey 3 and NetHSM. Includes commands for managing enrolled keys, opening encrypted storage, and generating OTPs...

[SECURITY] Fedora 44 Update: python-cryptography-50.0.0-1.fc44

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

Security update for python

This update for python fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...

SUSE-SU-2026:3862-1 Security update for python

This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

CLSA-2026-1787913334 TuxCare security update for gitpython (6 CVEs)

TuxCare rebuilt gitpython to address 6 CVEs. Fixed in 3.1.31.post11+tuxcare...

CLSA-2026-1787903381 TuxCare security update for pillow (1 CVE)

TuxCare rebuilt pillow to address 1 CVE. Fixed in 9.5.0.post4+tuxcare...

CLSA-2026-1787902504 TuxCare security update for mlflow (2 CVEs)

TuxCare rebuilt mlflow to address 2 CVEs. Fixed in 2.9.1.post7+tuxcare...

maltrail v3.2

Maltrail Maltrail is a network traffic detection system that identifies communication with known malicious infrastructure and reports selected traffic anomalies. It matches domains, URLs, IP addresses, IP:port pairs, and User-Agent values observed on the network against a set of indicators called...

SUSE CVE-2026-15310

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

SUSE CVE-2026-75509

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...