K000162939: Python vulnerability CVE-2025-13836

Security Advisory Description When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially causing OOM or other DoS...

CVE-2026-54284: Inefficient Algorithmic Complexity

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

ROS-20260817-73-0211

The vulnerability in python-setuptools is related to incorrect data processing based on the Unicode encoding standard. Exploiting this vulnerability can allow a remote attacker to cause service failures...

PT-2026-76633

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0 Description A sandbox escape exists in the IsolatedPluginExecutor component that exposes Python type objects within restricted exec builtins. This allows attackers to traverse the Python class hierarchy...

PT-2026-76720

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description The sqlparse/filters/output.py module fails to escape existing backslashes before quotes when using output format='python' or output format='php' in the sqlparse.format function and the correspondin...

PT-2026-76749

Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description sqlparse contains an issue where the construction of TokenList and subsequent string conversion repeatedly flatten nested token subtrees. This occurs when processing SQL with deep nesting, such as...

Medium: python-jwt

Issue Overview: PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, PyJWKClient passes its uri argument directly to urllib.request.urlopen which uses Python stdlib's default OpenerDirector registering HTTPHandler, HTTPSHandler, FTPHandler, FileHandler, and DataHandler. There is...

ROS-20260817-73-0206

The vulnerability in python-PyPDF2 is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

uproot 5.7.4 TStreamerInfo Code Injection

uproot version 5.7.4 and prior contain a code injection vulnerability in the handling of ROOT TStreamerInfo metadata where attacker-controlled streamer fields are incorporated into dynamically generated Python source without sufficient quoting. A malicious ROOT file can therefore cause arbitrary...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099501)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099501 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.utils.cache.hasvaryheader in Django does not strip leading or trailing whitespace fr...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099457 advisory. An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. ASGI requests with a missing or understated Content-Length header can bypass the...

Fedora 46 : python-tablib (2026-d69d02ea41)

The remote Fedora 46 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d69d02ea41 advisory. Automatic update for python-tablib-3.10.0-1.fc46. Changelog Mon Aug 17 2026 Steve Traylen - 3.10.0-1 - Update to v3.10.0 CVE-2026-9318 - Resolves: rhbz251447...

PT-2026-76781

Name of the Vulnerable Software and Affected Versions FreeCAD versions prior to 1.1.2 Description An issue exists in the PropertyPythonObject::Restore function within src/App/PropertyPythonObject.cpp where the software passes an attacker-controlled module attribute from serialized...

ROS-20260817-73-0208

The vulnerability in python-pillow is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

ROS-20260817-73-0209

The vulnerability in python-pillow is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

ROS-20260817-73-0210

The vulnerability in python-pillow is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099481)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099481 advisory. An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. django.contrib.gis.gdal.GDALRaster over-reads its in-memory buffer when constructed from a...

Unity Linux 20.1070e Security Update: python-filelock (UTSA-2026-099470)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099470 advisory. filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition allows local attackers to...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099506)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099506 advisory. An issue was discovered in Django 5.2 before 5.2.15 and 6.0 before 6.0.6. django.middleware.cache.UpdateCacheMiddleware in Django does not add Authorization to the...

Medium: python-idna

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...