OPENSUSE-SU-2026:21912-1 Security update for python-PyMuPDF

This update for python-PyMuPDF fixes the following issues: Changes in python-PyMuPDF: - CVE-2026-82035: a path traversal vulnerability in the font branch of extractobjects in src/main.py bsc1280486...

CVE-2026-48802

A flaw was found in python-engineio, a Python implementation of the Engine.IO realtime client and server. A remote attacker can exploit a vulnerability in the heartbeat mechanism by sending specific packets, leading to the creation of excessive background threads. This can result in a Denial of...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0303...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0302...

ROOT-APP-PYPI-GHSA-WVPP-8HX9-P66J GHSA-wvpp-8hx9-p66j in GitPython - Patched by Root

Root has patched GHSA-wvpp-8hx9-p66j in the GitPython package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-956X-8GVW-WG5V GHSA-956x-8gvw-wg5v in GitPython - Patched by Root

Root has patched GHSA-956x-8gvw-wg5v in the GitPython package for Root:PyPI. Multiple fixed versions available...

[SECURITY] Fedora 45 Update: python-audioread-3.0.1-15.fc45

Decode audio files using whichever backend is available. Among currently supports backends are o Gstreamer via PyGObject o MAD via the pymad bindings o FFmpeg or Libav via its command-line interface o The standard library wave, aifc, and sunau modules...

[SECURITY] Fedora 45 Update: python-torchaudio-2.11.0-4.fc45

The aim of torchaudio is to apply PyTorch to the audio domain. By supporting PyTorch, torchaudio follows the same philosophy of providing strong GPU acceleration, having a focus on trainable features through the autograd system, and having consistent style tensor names and dimension names...

CVE-2026-19202: Use of Cache Containing Sensitive Information

A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across different audiences. If an application uses the SDK to authenticate to two or more different audiences within the same process, the module-level token cache...

CVE-2026-77271: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-59991: Memory Allocation with Excessive Size Value

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-95831: Embedded Malicious Code

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

ROS-20260922-73-0134

The vulnerability in Python-Django is related to incorrect external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20260922-73-0133

The vulnerability in Python-Django is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260922-73-0132

The vulnerability in Python-Django is related to an uncontrolled recursion. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-96963

Name of the Vulnerable Software and Affected Versions Crypt::SelfCertificate versions 1.01 through 1.05 Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate function runs a Python script disguised as a certificate file,...

PT-2026-97091

Name of the Vulnerable Software and Affected Versions mcp-toolbox-sdk-python affected versions not specified Description A caching flaw in the toolbox-core package allows a Google ID token to be cached and reused across different audiences within the same process. The module-level token cache fai...

PT-2026-96823

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description The LightRAG API server returns raw Python exception text in HTTP error responses across multiple routers, including document routes.py, graph routes.py, query routes.py, ollama api.py, and lightrag...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-090118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090118 advisory. In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state-shuffle is instructed to read beyond state-buffe...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090675 advisory. A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from...