EUVD-2026-81577

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controll...

CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

EUVD-2026-81626

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

CVE-2026-85077 Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejecting carriage-return or line-feed characters. Applications that place...

AZL-103491 CVE-2026-89418 affecting package python-tensorboard 2.16.2-6

google-protobuf contains an unbounded recursion when parsing unknown protobuf group fields. An attacker can send a small crafted payload of deeply nested STARTGROUP wire bytes to any Node.js service that calls the generated deserializeBinary API, causing a RangeError: Maximum call stack size...

MGASA-2026-0413 Updated python-starlette package fixes security vulnerabilities

Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr. CVE-2026-48817 Unvalidated request path concatenated into authority poisons request.url.hostname. CVE-2026-54282...

Updated python-starlette package fixes security vulnerabilities

Arbitrary HTTP method dispatched to HTTPEndpoint attributes via getattr. CVE-2026-48817 Unvalidated request path concatenated into authority poisons request.url.hostname. CVE-2026-54282...

Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities (CVE-2026-45409)

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM SOAR QRadar Plugin App has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-45409 DESCRIPTION: Internationalized Domain Nam...

RLSA-2026:67943 Important: python-lxml security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

python-lxml security update

An update is available for python-lxml. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

BIT-PYTHON-MIN-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

BIT-PYTHON-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root

Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...

K000163155: Python vulnerability CVE-2026-4224

Security Advisory Description When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. CVE-2026-4224 Impact There is no impact; F5 products are not affected by this vulnerability. Securi...

certgraveyard_yara v2026.09.16

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

attack-surface

ASP — Public Network Attack Surface Automation Mapping and Vul...

poc-ghas-vulnerability-report-generator

GHAS Vulnerability Report Generator !WARNING This proof...

[SECURITY] Fedora 44 Update: python-django6-6.1.1-2.fc44

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

[SECURITY] Fedora 44 Update: python-jwcrypto-1.6.0-1.fc44

Implements JWK, JWS, JWE specifications using python-cryptography...

[SECURITY] Fedora 45 Update: python-django6-6.1.1-2.fc45

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...