PT-2026-109174

Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

AlmaLinux 10 : python3.14 (ALSA-2026:77018)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:77018 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

RockyLinux 9 : python3.12 (RLSA-2026:77017)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77017 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

PT-2026-109203

Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

RockyLinux 9 : python3.14 (RLSA-2026:77021)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77021 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

PT-2026-109169

ssl.SSLContext.wrap bio didn't require the server hostname argument to not be None if ssl.SSLContext.check hostname was set. Due to a missing parameter check in SSLObject, if the server hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead t...

AZL-107856 CVE-2026-78669 affecting package python-tensorboard 2.16.2-6

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107853 CVE-2026-56866 affecting package python-tensorboard 2.16.2-6

When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle...

DEBIAN-CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

AZL-107129 CVE-2026-106435 affecting package python-pymongo 4.2.0-9

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

Arbitrary Code Execution (ACE)

hydraoptunasweeper is vulnerable to arbitrary code execution. The vulnerability is due to improper validation of configuration-controlled dotted paths in hydra-optuna-sweeper, which allows an attacker to execute arbitrary importable Python code with the application's privileges by manipulating...

libtalloc

libtalloc libtalloc è uno script python per l'uso con GDB che può essere utilizzato per analizzare l'"allocatore banale" talloc. Un'introduzione su talloc si può trovare qui: https://talloc.samba.org/talloc/doc/html/index.html libtalloc è stato ispirato da altri script python per GDB per l'analis...

K000163608: Python vulnerability CVE-2026-0994

Security Advisory Description A denial-of-service DoS vulnerability exists in google.protobuf.jsonformat.ParseDict in Python, where the maxrecursiondepth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the internal...

bip

Bip Bip è un progetto che mira a semplificare l'uso di Python per interagire con IDA. I suoi obiettivi principali sono facilitare l'uso di Python nella console interattiva di IDA e la scrittura di plugin. In modo più generale l'obiettivo è automatizzare i compiti ricorrenti svolti tramite l'API...

EUVD-2026-95254

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

CVE-2026-106435 Application denial of service via out-of-bounds read in BSON Regex decoding in MongoDB Python Driver

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...