datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2026-13346 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

chalice (1.12.0), commandfrog (>=0.2.1, <=0.3.1) +12 more potentially affected by CVE-2026-13346 via pip (19.3.1)

pip PYPI version 19.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice 1.12.0 - commandfrog =0.2.1, =0.1.0, =0.8.1, =0.4.11, =0.0.3, =2.4.0.19073113, =0.0.1, =2019.10.25, =0.0.1a0, =0.1.1, =0.1.2 - smartleia 1.0.1...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-13346 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

diacamma-asso (>=2.3.0.18070322, <=2.3.11.19062511), diacamma-financial (>=2.3.0.18072813, <=2.3.11.19062210) +8 more potentially affected by CVE-2026-13346 via pip (19.1.1)

pip PYPI version 19.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - diacamma-asso =2.3.0.18070322, =2.3.0.18072813, =2.3.0.18073020, =2.3.10.19052414, =2.3.4.19022609, =2.3.2.19022615, =2.3.0.18070322, =1.4.5, =2019.5.6,...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: python-pillow security update

An update for python-pillow is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

async-media-agents (>=0.1.0, <=0.1.2), catweazle (1.2.0) +18 more potentially affected by CVE-2026-62995 via joserfc (>=1.0.0, <=1.7.1)

joserfc PYPI version =1.0.0, =0.1.0, =3.12.7, =1.0.0, =1.0.5, =2.6.0, =2.80.2a1, =2.1.1, =26.1.0, =3.0.2, =4.5.0, =1.6.5, =1.2.57, =0.21.2, =0.26.0 and more Source cves: CVE-2026-62995 Source advisory: SNYK:PYTHON-JOSERFC-18426506...

EUVD-2026-50554

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish- plugins built request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links, allowing a malicious or...

CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...

python-dev-tools (>=2019.8.14, <=2019.8.24) potentially affected by CVE-2026-13346 via pip (19.2.2)

pip PYPI version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.8.14, =2019.8.24 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2026-13346 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

cryptobot-python (0.1.5), ops-py-azure-key-vault-alert (>=7.0.0, <=7.0.1) +2 more potentially affected by CVE-2026-13346 via pip (24.1.0)

pip PYPI version 24.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cryptobot-python 0.1.5 - ops-py-azure-key-vault-alert =7.0.0, =1.3.1, =2.0.1 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

AZL-94335 CVE-2026-13346 affecting package python-pip for versions less than 24.2-10

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

python-dev-tools (>=2019.7.25, <=2019.8.8) potentially affected by CVE-2026-13346 via pip (19.2.1)

pip PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.7.25, =2019.8.8 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-13346 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

auto-dl (0.1.1), chalice (>=1.0.1, <=1.2.2) +14 more potentially affected by CVE-2026-13346 via pip (9.0.3)

pip PYPI version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - auto-dl 0.1.1 - chalice =1.0.1, =1.5.119, =1.0.0, =2.1.1.16070820, =2.1.1.16072018, =2.1.1.16070812, =1.5.6, =0.2.0, =2.1.6.16123016, =2.1.1.16070814,...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-13346 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

codecraft-chat (>=0.82.4.dev64, <=0.82.4.dev69), cryptobot-python (0.1.9) +2 more potentially affected by CVE-2026-13346 via pip (25.1.0)

pip PYPI version 25.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - codecraft-chat =0.82.4.dev64, =0.0.21, =0.2.8 Source cves: CVE-2026-13346 Source advisory: OSV:PYSEC-2026-3721...

UBUNTU-CVE-2026-62995

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding == which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when...