Netsweeper <=6.4.3 - Python Code Injection

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters. id: CVE-2020-13167 info: name: Netsweeper =6.4.4 to mitiga...

PT-2026-108708

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description The plugin manager loads and executes arbitrary .py files from the .praisonai/plugins/ directories located at both the project level and the user home. This occurs through the use of...

EulerOS 2.0 SP15 : python-jwt (EulerOS-SA-2026-3942)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

PT-2026-108711

Name of the Vulnerable Software and Affected Versions praisonai versions 4.5.128 through 4.6.63 Description The API deployment generator in PraisonAI improperly embeds configuration values from agents.yaml directly into generated Python source code without safe encoding. This allows a malicious...

CVE-2026-106435: Out-of-bounds Read

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

python3.14 security update

3.14.8-1 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128...

python3.14 security update

3.14.8-1 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274141...

openSUSE 16 Security Update : python-fsspec (openSUSE-SU-2026:22028-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22028-1 advisory. Changes in python-fsspec: - CVE-2026-104851: python-fsspec: remote code execution via server-side template injection in ReferenceFileSystem bsc1284173...

CVE-2026-107287: Uncontrolled Resource Consumption

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-3943)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1...

PT-2026-108198

Name of the Vulnerable Software and Affected Versions MongoDB Python Driver affected versions not specified Description The binary accelerator in the driver can perform an out-of-bounds read when decoding malformed BSON that contains a truncated regular-expression element missing a trailing NUL...

CVE-2026-107288: Server-Side Request Forgery (SSRF)

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, the local webfetchtool and the WebFetch local fallback compare blockeddomains entries with a URL hostname before both values are normalized to the form used by...

EulerOS 2.0 SP15 : python-jwt (EulerOS-SA-2026-4008)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

Debian dla-4827 : idle-python3.11 - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4827 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4827-1 [email protected]...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-3944)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

RHEL 9 : python3.12 (RHSA-2026:77017)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77017 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

EulerOS 2.0 SP15 : python-pillow (EulerOS-SA-2026-4009)

According to the versions of the python-pillow packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

RockyLinux 8 : python3.12 (RLSA-2026:77028)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:77028 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of a...

MiracleLinux 8 : python3.12-3.12.15-2.el8_10 (AXSA:2026-1997:24)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1997:24 advisory. python: python: Certificate verification bypass via missing serverhostname validation in SSLContext.wrapbio CVE-2026-19553 python: Use-after-free of...