74603 matches found
CVE-2026-48802
python-engineio is a Python implementation of the Engine.IO realtime client and server. Prior to version 4.13.2, an attacker can cause the creation of unnecessary background threads in the python-engineio server by exploiting the heartbeat mechanism, which launches a thread when a new connection ...
aibro (>=0.5.5, <=1.1.5), aioambient (>=0.1.1, <=1.2.2) +231 more potentially affected by CVE-2026-48809 via python-engineio (>=3.2.2, <=4.13.1)
python-engineio PYPI version =3.2.2, =0.5.5, =0.1.1, =0.1.1, =4.0.6, =0.16.0, =2.3.0, =1.0.5, =0.9.0, =0.0.3, =4.0.2, =4.0.0.8, =0.1.0, =0.1.5 - baseweb 0.0.5 and more Source cves: CVE-2026-48809 Source advisory: MEND:CVE-2026-48809...
CVE-2026-48809
CVE-2026-48809 – python-engineio : The issue affects the python-engineio server prior to version 4.13.2, where the size of incoming messages could be loaded into memory before validation, enabling potential DoS through excessive memory allocation. Two configurations are affected: POST requests wi...
EUVD-2026-56854
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809 python-engineio has possible denial of service due to maximum payload size sometimes not being enforced
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-48809
python-engineio is a Python implementation of the Engine.IO realtime client and server. Versions prior to 4.13.2 have two specific configurations of the python-engineio server in which the size of incoming messages is not checked before the messages are loaded into memory. An attacker can take...
CVE-2026-73217
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...
CVE-2026-73217
The CVE describes a sandbox-escape flaw in Cursor IDE for macOS prior to 3.1.2. An agent in Auto-Run Sandbox mode can replace a virtual environment’s Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, enabling arbitrary host commands with t...
CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...
CVE-2026-73217 Cursor: Sandbox escape via tampered Python virtual environments
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...
EUVD-2026-56838
Cursor is a code editor built for programming with AI. Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing...
CLSA-2026-1786470220 TuxCare security update for aiohttp (1 CVE)
TuxCare rebuilt aiohttp to address 1 CVE. Fixed in 3.8.6.post8+tuxcare...
CVE-2026-54981
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally...
CLSA-2026-1786468462 python-setuptools: Fix of CVE-2026-59890
CVE-2026-59890: normalize Unicode form NFC on both the MANIFEST.in pattern and the candidate path before matching, so an exclude directive cannot be bypassed by a decomposed NFD file name...
CVE-2026-54981
Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature locally...
CVE-2026-54981
The CVE-2026-54981 entry concerns the Visual Studio Code Python extension, where inclusion of functionality from an untrusted control sphere leads to a local security feature bypass. Affected component: VS Code Python extension; root cause described as untrusted control sphere function inclusion....