RHEL 9 : python3.12 (RHSA-2026:77017)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77017 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

EulerOS 2.0 SP15 : python-jwt (EulerOS-SA-2026-3942)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

CVE-2026-20032

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

echelon-client-agent (>=0.0.3, <=0.0.5), echelon-client-echelon (0.0.3) +1 more potentially affected by CVE-2026-106454 via twisted (18.4.0)

twisted PYPI version 18.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - echelon-client-agent =0.0.3, =0.7.2, =0.7.3 Source cves: CVE-2026-106454 Source advisory: OSV:GHSA-8PQF-F4M5-798G...

golemrpc (>=0.3.4, <=0.3.6), neo-python (>=0.5.7, <=0.7.1) +5 more potentially affected by CVE-2026-106454 via twisted (17.9.0)

twisted PYPI version 17.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - golemrpc =0.3.4, =0.5.7, =0.1.0, =0.2.0, =0.2.1 - txwerewolves 0.6.1 - yy-spider 1.0.0 Source cves: CVE-2026-106454 Source advisory:...

CVE-2026-107204

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass

NPM: Flowise Prompt Injection to RCE and SSRF via CSV/Airtable Agent Python Validator Bypass vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

CVE-2026-20032 Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

EUVD-2026-94447

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2026-20032 Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2026-20032

A vulnerability in the Python interpreter of Cisco NX-OS Software allows an authenticated, local attacker with low privileges to escape the Python sandbox . The root cause is insufficient validation of user-supplied input , which can be exploited by manipulating specific functions within the inte...

Cisco NX-OS Software Python Sandbox Escape Vulnerability

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, local attacker with low privileges to escape the Python sandbox and gain unauthorized access to the underlying operating system of an affected device. This vulnerability is due to insufficient validati...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

EUVD-2026-94383

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204

LMCache versions through 0.5.5 are vulnerable to an unauthenticated remote code execution (RCE) vulnerability via the /run_script endpoint. The root cause is that attackers can post scripts to this endpoint and recover real builtins through the injected FastAPI app object , which allows them to b...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

EUVD-2026-94371

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 enthält bedeutende Modernisierungsänderungen: Python 3.9+ erforderlich - Unterstützung für Python 3.6, 3.7 und 3.8 wurde eingestellt attrs-Bibliothek entfernt - Datenklassen verwenden jetzt das in Python integrierte dataclasses-Modul Wenn Ihr...

CVE-2026-105801

A flaw was found in openapi-python-client. The generator fails to properly sanitize input from OpenAPI specification documents before rendering code strings and docstrings into generated Python files. An attacker could supply a specially crafted specification to inject arbitrary Python code,...