CVE-2026-41608 Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-41608

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

ROOT-OS-DEBIAN-13-CVE-2025-12781 CVE-2025-12781 in rootio-python3.13 - Patched by Root

Root has patched CVE-2025-12781 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-3479 CVE-2026-3479 in rootio-python3.13 - Patched by Root

Root has patched CVE-2026-3479 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-15367 CVE-2025-15367 in rootio-python3.13 - Patched by Root

Root has patched CVE-2025-15367 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11972 CVE-2026-11972 in rootio-python3.13 - Patched by Root

Root has patched CVE-2026-11972 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-7210 CVE-2026-7210 in rootio-python3.13 - Patched by Root

Root has patched CVE-2026-7210 in the rootio-python3.13 package for Root:Debian:13. Multiple fixed versions available...

Langflow AI - Unauthenticated Remote Code Execution

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint.A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. id: CVE-2025-3248 info: name: Langflow AI - Unauthenticated Remote Code Execution author: nvn172...

Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

PT-2026-64882

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data leads to a data amplification issue in the C++, Java, Python, Go, D, and C/GLib bindings. This occurs within the TZlibTransport decompression proces...

PT-2026-64877

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Improper handling of highly compressed data, known as data amplification, exists in the Apache Thrift Python bindings. This issue occurs during unbounded Zlib decompression within the...

PT-2026-64878

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description An infinite loop issue exists in the Python, Go, PHP, and Java bindings of Apache Thrift. This occurs due to a loop with an unreachable exit condition within the TCompactProtocol varint...

PT-2026-64893

Name of the Vulnerable Software and Affected Versions Apache Thrift versions prior to 0.24.0 Description Apache Thrift Python bindings contain an issue where certificates with host mismatches are not properly validated. Recommendations Upgrade to version 0.24.0...

CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

EUVD-2026-49056

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

CVE-2026-17497

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

CVE-2026-17497 NoteGen arbitrary OS command execution via Tauri shell:allow-execute for bash/python

NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operati...

CVE-2026-17497

NoteGen before 0.32.0 allows arbitrary OS command execution via the Tauri shell plugin shell:allow-execute for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript in the app’s webview can invoke plugin:shell|execute to run attacker-controlled command...

CVE-2026-63720

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...

EUVD-2026-49050

datamodel-code-generator prior to version 0.70.0 contains a code injection vulnerability that allows attackers who control input schemas to achieve remote code execution by supplying a malicious customBasePath value containing embedded newlines and a dot-free Python expression. The crafted value ...