72625 matches found
CVE-2026-57175 social-auth-core has an Improper Authentication issue
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...
pulp-ansible (>=0.22.0, <=0.23.1), pulp-container (>=2.21.0, <=2.22.13) +6 more potentially affected by CVE-2026-90959 via pulpcore (3.69.2)
pulpcore PYPI version 3.69.2 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.22.0, =2.21.0, =3.3.0, =0.6.0, =0.8.1, =2.4.0, =3.12.0, =3.25.6, =3.27.14 Source cves: CVE-2026-90959 Source advisory:...
AZL-105254 CVE-2026-97058 affecting package python-tensorboard 2.16.2-6
sprintf-js through 1.1.3 passes unbounded precision specifiers to toFixed, toExponential, and toPrecision methods without validation, causing uncaught RangeError exceptions. Attackers who control format strings can inject precision values exceeding ECMAScript limits to abort calling operations wi...
libxml2: double-free/UAF in libxml2 Python bindings
A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...
CVE-2021-41773
Usage usage: main.py -h -f FILE -s N --timeout SECONDS optional arguments: -h, --help show this help message and exit -f FILE, --file FILE File containing target URLs one per line -s N, --semaphore N Concurrent requests default: 10 --timeout SECONDS Request timeout in seconds default: 10...
debloat
Debloat Debloat is a GUI and CLI tool to remove excess garbage from bloated executables. By excess garbage, I mean 100 - 800 MB of junk bytes added to a binary to keep it from going into a sandbox. This method of adding junk is called "inflating" or "pumping" a binary. Debloat currently handles t...
CLEANSTART-2026-CX71098 Tornado is a Python web framework and asynchronous networking library
CVE-2026-82397 affects multiple packages. Tornado is a Python web framework and asynchronous networking library. See references for individual vulnerability details...
CLEANSTART-2026-PH27311 sqlparse is a non-validating SQL parser module for Python
Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...
CLEANSTART-2026-JF73384 sqlparse is a non-validating SQL parser module for Python
Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...
CLEANSTART-2026-JQ90440 joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
Security vulnerability affects the airflow-3 package. joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards...
CLEANSTART-2026-JT70619 sqlparse is a non-validating SQL parser module for Python
Security vulnerability affects the airflow-3 package. sqlparse is a non-validating SQL parser module for Python...
CVE-2026-96747
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...
PT-2026-105030
The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in ".sock" as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an...
PT-2026-105029
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...
CVE-2026-57178
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...
CVE-2026-96749: Integer Overflow or Wraparound
An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch...
CVE-2026-57178: Improper Authentication
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the vk-app backend accepted VK application callback data without verifying the callback signature when the authkey parameter was omitted. Applications using this backend could treat unsigned...
CVE-2026-57175: Improper Authentication
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could...
CVE-2026-57177: Cross-Site Request Forgery (CSRF)
Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF. An attacker could cause a victim's browser session to...
...[ More ]
Apache BuildStream's tar source plugin extracts archives without safely resolving symbolic links link following. A malicious source tarball can include a symlink entry that points outside the staging directory and then a file entry that writes through it, so a crafted upstream source can create o...