[SECURITY] Fedora 43 Update: python-pillow-11.3.0-10.fc43

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

Oracle Linux 10 : python3.12 (ELSA-2026-39183)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39183 advisory. 3.12.13-2.0.1.el102.1 - Remove upstream URL reference 3.12.13-2.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 Tenable has extracted the preceding...

EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2026-2801)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...

EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

Security update for python-aiohttp (important)

openSUSE security update: security update for python-aiohttp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21372-1 Rating: important References: bsc1268398 bsc1268543 bsc1268544 bsc1268549 bsc1268556 bsc1268559 bsc1268560 bsc1268561...

EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-2798)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable...

AlmaLinux 9 : python3.14 (ALSA-2026:41949)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

OPENSUSE-SU-2026:11323-1 python313-bleach-6.4.0-1.1 on GA media

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11322-1 python313-Js2Py-0.74-6.1 on GA media

These are all security issues fixed in the python313-Js2Py-0.74-6.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3132-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3132-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers ...

EUVD-2026-42334

Mistune: XSS via unescaped class option in Admonition directive...

EUVD-2026-42339

Mistune directives/include: mutual .. include:: recursion crashes the renderer with RecursionError, denial of service via two attacker-controlled markdown files...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...

Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...

Important: Red Hat Security Advisory: Satellite 6.18.7.1 Async Update

A new release is now available for Red Hat Satellite 6.18 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2026-63766 GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path...

MGASA-2026-0281 Updated python-nltk packages fix security vulnerabiliy

URL-Encoded Path Traversal in nltk.data.load Allows Arbitrary Local File Read. CVE-2026-54293...

Updated python-nltk packages fix security vulnerabiliy

URL-Encoded Path Traversal in nltk.data.load Allows Arbitrary Local File Read. CVE-2026-54293...

Tornado: Quadratic DoS via Repeated Header Coalescing

Summary The HTTPHeaders.add method in Tornado accumulates values using string concatenation when the same header name is repeated. Due to Python string immutability, each concatenation copies the entire string, resulting in On² time complexity. Given Tornado's single event loop architecture, a...