72753 matches found
python: Python: Denial of Service via out-of-bounds write in BZ2 decompression
A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
python: Python/Expat: Denial of Service via crafted XML document
A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers
A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...
python: Python tarfile module: File modification and content disclosure via crafted archives
A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...
CVE-2026-77401 Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...
CVE-2026-77401
Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untrusted users to create and execute AccessControl-controlled Python code do not safely guard str.format and str.formatmap when those methods are reached through a str subclass. In bot...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
python: Python/Expat: Denial of Service via crafted XML document
A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...
python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers
A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...
python: Python: Denial of Service via out-of-bounds write in BZ2 decompression
A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...
CVE-2026-76825
RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to 8.4, RestrictedPython could allow a sandbox escape when a custom import policy or globals exposed the standard library string module, the string.Formatter...
CVE-2026-76825
RestrictedPython is a Python sandboxing tool from the Zope Foundation that allows defining a restricted subset of Python for untrusted input. Prior to version 8.4, a sandbox escape was possible when a custom import policy or globals exposed the standard library string.Formatter class, an instance...
python: Python: Denial of Service via out-of-bounds write in BZ2 decompression
A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
MAL-2026-16237 Malicious code in strapi-plugin-persh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...
MAL-2026-16231 Malicious code in strapi-plugin-honey-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP...