60069 matches found
UBUNTU-CVE-2026-47183
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...
UBUNTU-CVE-2026-48487
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...
CVE-2026-8476
Langflow OSS versions 1.0.0–1.10.0 are impacted by a remote code execution vulnerability in the disk-based cache. The AsyncDiskCache deserializes cached items with unsafe pickle.loads() without validation, allowing arbitrary code execution when an attacker can influence cached data (e.g., through...
CVE-2026-8481 Remote Code Execution via Code Validation Endpoint
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...
CVE-2026-8481 Remote Code Execution via Code Validation Endpoint
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...
EUVD-2026-45275
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...
CVE-2026-8481
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec function without sandboxing, input...
CVE-2026-8481
Langflow OSS versions 1.0.0–1.10.0 are affected by a remote code execution vulnerability in the code validation endpoint. The POST /api/v1/validate/code endpoint executes user-supplied Python code via Python’s built-in exec() without sandboxing or input validation, allowing any authenticated user...
EUVD-2026-45257
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 commit 94981c443d4918517b9e8163d70fc598dc33a32d contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allowcustomcomponents=false security control. The vulnerability exists...
CVE-2026-9135
CVE-2026-9135 affects IBM Langflow OSS versions 1.0.0–1.10.0. The vulnerability lies in the Policies component’s ToolGuard integration: validation only checks the main component code field (node_template["code"]["value"]) and does not validate dynamic CodeInput fields that store generated ToolGua...
UBUNTU-CVE-2026-44722
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfileaes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1...
SUSE-SU-2026:3117-1 Security update for python-dulwich
This update for python-dulwich fixes the following issue - CVE-2026-47734: Unbounded memory allocation in receive-pack from crafted thin packs bsc1268138...
SUSE-SU-2026:3113-1 Security update for python-msgpack
This update for python-msgpack fixes the following issue - CVE-2026-57585: Unpacker reuse after a caught error can lead to an out-of-bounds read and a crash bsc1269947...
MAL-2026-10770 Malicious code in govpkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc7609ef2380436c805298b1d10362d361ea93b448db92433e3e69cc2de8ed8 Every public API function in govpkg get, package, module invokes a helper named normalizeHelper that downloads an unpinned, unverified binary from th...
Security update for python-idna
This update for python-idna fixes the following issue CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:3101-1 Security update for python-idna
This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413...
Security update for python-idna
This update for python-idna fixes the following issue CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2026:3100-1 Security update for python-idna
This update for python-idna fixes the following issue - CVE-2026-45409: specially crafted inputs to idna.encode can bypass earlier security fix bsc1265413...
Malicious code in trongridev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2db83ccb7d07bdacd1bdf7c32fbaa2a7fb40d7bd599e315f25265ca4bb9d3c03 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...