OPENSUSE-SU-2026:11585-1 python313-mistune-3.3.4-1.1 on GA media

These are all security issues fixed in the python313-mistune-3.3.4-1.1 package on the GA media of openSUSE Tumbleweed...

python-urwid security update

2.1.2-4.1 - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module - Resolves: RHEL-212564...

CVE-2026-75509: Authentication Bypass by Spoofing

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing an array-valued iss that contains the expected issuer to pass...

PT-2026-81115

Name of the Vulnerable Software and Affected Versions MCP Context Forge versions prior to 1.0.2 Description The python sandbox server sub-project in MCP Context Forge contains a sandbox bypass in its RestrictedPython implementation. The issue occurs because raw getattr is exposed through safe...

GitPython Arbitrary Command Execution

The vulnerability of the checkunsafeoptions mechanism in the Python library for interacting with Git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Important: python3.14 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

ALSA-2026:58561 Important: python-urwid security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 9 : python-urwid (RHSA-2026:58952)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:58952 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Fedora 46 : python-aiohttp (2026-84f7af8f97)

The remote Fedora 46 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-84f7af8f97 advisory. Automatic update for python-aiohttp-3.14.3-3.fc46. Changelog Mon Aug 24 2026 Benjamin A. Beasley - 3.14.3-3 - Preemptively patch for Cython 3.3...

Oracle Linux 10 : python-urwid (ELSA-2026-58561)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58561 advisory. 2.5.3-5 - Use secure random session identifiers Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

GHSA-892M-GCQ8-2468 Duplicate Advisory: Uncontrolled recursion DoS in JustHTML() via deeply nested HTML

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7cf-c9rm-wm3j. This link is maintained to preserve external references. Original Description justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During...

CVE-2026-78145: URL Redirection to Untrusted Site

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

MiracleLinux 9 : python-idna-2.10-8.el9_8 (AXSA:2026-1620:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1620:02 advisory. python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-45409 Tenable has extracted the preceding description block directly from the...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via symlink handling in FramenetCorpusReader. An attacker can read arbitrary XML files outside the configured corpus root b...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via the FileSystemPathPointer.open function. An attacker can access arbitrary files accessible to the process user by...

PYSEC-2026-3729

NLTK before 3.9.3 fails to verify file integrity after downloading packages and before extraction in the downloader module. Attackers can perform man-in-the-middle attacks or DNS poisoning to inject malicious package contents that are extracted without validation...

PYSEC-2026-3730

NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open directly instead of pathsec.open. Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting,...

PYSEC-2026-3722

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...

PYSEC-2026-3722

NLTK versions before 3.10.0 default to ENFORCE=False in pathsec.py, causing all security validation functions to emit warnings instead of raising exceptions. Attackers can bypass path traversal and pickle deserialization protections by exploiting the disabled security controls that are only activ...