PT-2026-67859

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description Authenticated non-admin users with read-only access can obtain the full Python source code of server-side tools shared with them. This occurs because the response models permitted extra fields,...

Amazon Linux 2023 : python3.13-tornado (ALAS2023-2026-2015)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2015 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving...

Amazon Linux 2 : python-tornado, --advisory ALAS2-2026-3847 (ALAS-2026-3847)

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3847 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

SUSE SLED15 / SLES15 Security Update : python3-dulwich (SUSE-SU-2026:3459-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3459-1 advisory. This update for python3-dulwich fixes the following issue - CVE-2026-38974: Dulwich through 1.1.0 was found to be missi...

Amazon Linux 2 : python3-tornado, --advisory ALAS2-2026-3846 (ALAS-2026-3846)

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3846 advisory. Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient...

RHEL 8 : python3 (RHSA-2026:50064)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50064 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 8 : python3 (RHSA-2026:50065)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50065 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Amazon Linux 2 : python, --advisory ALAS2-2026-3845 (ALAS-2026-3845)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3845 advisory. CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser...

CVE-2026-18770: Improper Control of Generation of Code

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This produc...

Important: python3-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

Important: python-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-1999)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1999 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

CVE-2026-70470: Incomplete List of Disallowed Inputs

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise validatePythonCodeForDataFrame in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide...

Security update for python-ujson (important)

openSUSE security update: security update for python-ujson ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21518-1 Rating: important References: bsc1270301 Cross-References: CVE-2026-44660 CVSS scores: CVE-2026-44660 SUSE : 7.5...

Security update for python-sh (important)

openSUSE security update: security update for python-sh ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21516-1 Rating: important References: bsc1272424 Cross-References: CVE-2026-54552 CVSS scores: CVE-2026-54552 SUSE : 8.2...

PT-2026-73553

TuxCare rebuilt python-jose to address 1 CVE. Fixed in 3.3.0.post1+tuxcare...

PT-2026-67908

Summary The validatePythonCodeForDataFrame blacklist in packages/components/src/pythonCodeValidator.ts can be bypassed with Unicode homoglyph identifiers, allowing arbitrary Python execution inside Pyodide and full OS command execution on the Flowise host via Pyodide's js module interop. This...

OPENSUSE-SU-2026:11451-1 python311-pip-26.2-1.1 on GA media

These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-47781: Inclusion of Functionality from Untrusted Control Sphere

PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins directory during initialization, allowing an attacker-controlled file in an untrusted repository checkout to execute arbitrary Python code befo...

Linux Distros Unpatched Vulnerability : CVE-2026-69249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving...