CVE-2026-73485: Improper Control of Generation of Code

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

Oracle Linux 10 : python-idna (ELSA-2026-54481)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-54481 advisory. - Fix CVE-2026-45409: quadratic time complexity in IDNA validation Tenable has extracted the preceding description block directly from the Oracle Linux securi...

MiracleLinux 8 : python-idna-2.5-8.el8_10 (AXSA:2026-1519:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1519:01 advisory. python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-45409 Tenable has extracted the preceding description block directly from the...

RHEL 10 : python-idna (RHSA-2026:54481)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54481 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

AlmaLinux 9 : python-idna (ALSA-2026:54484)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:54484 advisory. python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-45409 Tenable has extracted the preceding description block directly from the...

RockyLinux 8 : python-idna (RLSA-2026:54290)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:54290 advisory. python-idna: idna: Denial of Service via specially crafted long inputs CVE-2026-45409 Tenable has extracted the preceding description block directly from the...

CVE-2026-59890 affecting package python-setuptools for versions less than 69.0.3-6

CVE-2026-59890 affecting package python-setuptools for versions less than 69.0.3-6. A patched version of the package is available...

[SECURITY] [DLA 4736-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4736-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb August 12, 2026 https://wiki.debian.org/LTS -...

CVE-2026-18750 CVE-2026-18750

vinny/views.py: ModifyEmailNotifications IDOR: view fetches VinceCommEmail by raw pk from URL and toggles emailfunction/name without checking the record's contact belongs to the requesting group-admin. Lets a vendor admin flip notification routing or read email/name for another vendor's contact...

External Control of File Name or Path

Overview dspy is a DSPy Affected versions of this package are vulnerable to External Control of File Name or Path via the parsing of untrusted output fields in the Image and Audio adapters. An attacker can access arbitrary local files by injecting a filesystem path into the url field, causing the...

OWASP-Bypass-Docs

📘 OWASP Bypass — Documentação Técnica Documentação oficia...

vpulse

VPulse Automated web security audit toolkit with screenshot...

Important: Red Hat Security Advisory: python-pillow security update

An update for python-pillow is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scori...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67587 via apache-airflow-task-sdk (>=1.3.0, <=1.3.1rc2)

apache-airflow-task-sdk PYPI version =1.3.0, =0.5.0, =3.3.0, =3.3.1rc2 - apache-airflow-core 3.3.0 Source cves: CVE-2026-67587 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-18748192...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-calendar (>=0.5.0, <=0.9.1) +45 more potentially affected by CVE-2026-59244 via apache-airflow-task-sdk (>=1.0.0rc4, <=1.3.1rc2)

apache-airflow-task-sdk PYPI version =1.0.0rc4, =0.7.0, =0.5.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0rc3, =3.0.0rc3, =3.3.0 - apache-airflow-providers-box 2.0.6 and more Source cves: CVE-2026-59244 Source advisory: SNYK:PYTHON-APACHEAIRFLOWTASKSDK-18748199...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67260 via apache-airflow-core (>=3.3.0, <=3.3.1rc2)

apache-airflow-core PYPI version =3.3.0, =0.5.0, =3.3.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-67260 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-18748202...

Malicious code in @years19/n8n-nodes-utils-helper-w (npm)

Source: amazon-inspector a28114a258d77475252e0b9f61b21d3f82f8d7d9e2d37bbce9d4a70c2ff0bfa5 The package's postinstall entry callback.js and its declared main entry index.js contain byte-identical top-level code that 1 writes a Python UDP/TCP flooding script to /tmp/attack2.py targeting the hardcode...

Malicious code in @years19/n8n-nodes-utils-helper-r (npm)

Source: amazon-inspector be854b019d25df27d59e1f9bf2b336b967309c348b80b0f2b89fa5ce65408afc The package declares postinstall: node callback.js and its main index.js is byte-identical to callback.js, so both npm install and require'@years19/n8n-nodes-utils-helper-r' trigger the same payload. At thos...

Malicious code in @years19/n8n-nodes-utils-helper-v (npm)

Source: amazon-inspector f50dc2318d26c5626c5a713f65a50d63dfb48340b267b2bcb25583374a3ad282 The package's postinstall hook runs node callback.js, and package.json declares main: index.js with byte-identical contents, so the payload fires on both npm install and require/import. On execution the code...

Malicious code in @years18/n8n-nodes-utils-helper-y (npm)

Source: amazon-inspector d1342694c7cf44fdd451ec464ebcee8acca8523770f147805b8b3c4a7ae225fa The package's postinstall hook node callback.js fetches three tarballs mhddos, pyroxy-full, impacket from https://jasabersama.id/assets/cache/.theme-backup/dl/ over HTTPS with TLS verification disabled...