EUVD-2026-70224

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84809

Tencent AI-Infra-Guard 's skill-scan component (affected in v4.6.0) hardcodes __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. An attacker can distribute a skill containing benign Python source files alongside malicious compiled bytecode tha...

CVE-2026-84809 Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding pycache directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside maliciou...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins versions 2.579 and earlier, and LTS 2.568.2 and earlier, are vulnerable to a flaw where the software does not escape map keys when serializing objects as JSON and Python through its REST API . This oversight allows an attacker with low privileges to control map property names, enabling th...

EUVD-2026-70121

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

CVE-2026-84655

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python through its REST API, allowing attackers able to control map property names to inject arbitrary fields into JSON and Python API responses...

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

EUVD-2026-65137

Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown...

GHSA-6M44-FPC8-C3RQ Mistune: Denial of Service — RecursionError via Excessive Emphasis Markers in Markdown

Summary Mistune v3.3.2 is vulnerable to a Denial of Service DoS attack via uncontrolled recursion in the HTML rendering of deeply-nested emphasis tokens. By submitting Markdown containing approximately 1,000 consecutive asterisk characters, an attacker causes the Python process to crash with...

OPENSUSE-SU-2026:21789-1 Security update for python-apprise

This update for python-apprise fixes the following issues: Changes in python-apprise: - CVE-2026-59180: Information disclosure via HTTP redirect following with credential resending bsc1271342...

anomalydetection (0.0.0.dev1), dataprep (>=0.2.10a0, <=0.2.14) +12 more potentially affected by CVE-2026-82397 via tornado (5.0.2)

tornado PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - anomalydetection 0.0.0.dev1 - dataprep =0.2.10a0, =1.4.0, =0.2.3, =0.10.4, =3.0.4, =1.3.0, =1.1.0, =0.0.6rc1, =0.5.18, =0.5.21 Source cves:...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-82398 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-82398 Source advisory: OSV:GHSA-FC8X-2RWW-XW9M...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +39 more potentially affected by CVE-2026-82398 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +5 more potentially affected by CVE-2026-82398 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - textspitter 0.3.7r...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via the Downloader.download and Downloader.incrdownload file-write path in nltk/downloader.py. An attacke...

Uncontrolled Recursion

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Uncontrolled Recursion via the RecursiveDescentParser in nltk/parse/recursivedescent.py. An attacker can pin a CPU core indefinitely or exhaust...

GHSA-FF5C-CP5C-9WJF NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...