74601 matches found
Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099473)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099473 advisory. An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.core.mail.backends.smtp.EmailBackend in Django fails to prevent reuse of a...
ROS-20260817-73-0207
The vulnerability in python-pillow is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
PT-2026-76779
Name of the Vulnerable Software and Affected Versions FreeCAD versions 0.19 through 1.1.0 Description In the BIM Project Manager Load Template flow within src/Mod/BIM/bimcommands/BimProjectManager.py, the software passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and...
Python StateMachine 3.1.2 Remote Code Execution
Python StateMachine 3.1.2 contains a code injection vulnerability in its SCXML processing functionality. The included proof of concept demonstrates code execution by writing a harmless marker file when the malicious SCXML datamodel expression is evaluated...
MindsDB Minds Platform Cowork Unauthenticated Remote Code Execution
MindsDB Minds Platform Cowork contains an unauthenticated remote code execution vulnerability in the Cowork server API where unauthenticated settings modification can be combined with the Anton agent scratchpad functionality to execute arbitrary Python code without sandboxing. This proof of conce...
CVE-2026-34398: Improper Neutralization of Directives in Dynamically Evaluated Code
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-59894: Improper Control of Generation of Code
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format outputformat='python' and outputformat='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the...
CVE-2026-74899: Improper Neutralization of Directives in Dynamically Evaluated Code
opensslencrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec builtins. Attackers can traverse the Python class hierarchy via class.mro.subclasses to access system functions and execute arbitrary OS comman...
CVE-2026-74887: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...
Important: python-urwid
Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...
Important: python-urwid
Issue Overview: The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of...
Fedora 45 : python-tablib (2026-a0344d94aa)
The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-a0344d94aa advisory. Automatic update for python-tablib-3.10.0-1.fc45. Changelog Mon Aug 17 2026 Steve Traylen - 3.10.0-1 - Update to v3.10.0 CVE-2026-9318 - Resolves: rhbz251447...
Exploit for Code Injection in Fgmacedo Python_Statemachine
CVE-2026-47103: Python StateMachine Remote Code Execution via...
CVE-2026-18503 vulnerabilities
Vulnerabilities for packages: python...
GHSA-2345-WR3R-CXF2 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-18503 vulnerabilities
Vulnerabilities for packages: python...
GHSA-2345-WR3R-CXF2 vulnerabilities
Vulnerabilities for packages: python...
Super-linear CPU usage for unbounded input to csv.Sniffer.sniff()
...
CVE-2026-48804
A flaw was found in python-socketio, a Python implementation of the Socket.IO realtime client and server. The server stores binary messages in memory while awaiting their attachments. A remote attacker can exploit this by sending a binary message and deliberately withholding some attachments. Thi...
