OESA-2026-3720 python-ujson security update

UltraJSON Security Fixes: UltraJSON aka ujson through 5.1.0 has a stack-based buffer overflow in BufferAppendIndentUnchecked called from encode. Exploitation can, for example, use a large amount of indentation.CVE-2021-45958 UltraJSON is a fast JSON encoder and decoder written in pure C with...

CVE-2026-90790

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Important: Red Hat Security Advisory: python-lxml security update

An update for python-lxml is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-12003

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90790

A server-side request forgery (SSRF) vulnerability exists in a2aproject a2a-python (versions up to 1.1.3 ). The flaw is in the function _dispatch_notification within the Push Notification Sender component (src/a2a/server/tasks/base_push_notification_sender.py), where an attacker can manipulate th...

CVE-2026-90790

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

CVE-2026-90790 a2aproject a2a-python Push Notification Sender base_push_notification_sender.py _dispatch_notification server-side request forgery

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

EUVD-2026-77535

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

Framework

🔒 Pentest Framework !Pythonhttps://img.shields.io/badge/Py...

Astra Linux – Vulnerability in Pypy

Python versions prior to 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1, and 3.7.0 are vulnerable to catastrophic backtracking in Pop3lib’s apop method. An attacker could exploit this flaw to cause a denial of service...

Astra Linux – Vulnerability in Python 2.7, Pypy

In Python versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an HTTP server can perform Regular Expression Denial of Service ReDoS attacks against clients due to the use of urllib.request.AbstractBasicAuthHandler, which allows catastrophi...

Astra Linux – Vulnerability in Pypy

Python versions prior to 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1, and 3.7.0 are vulnerable to catastrophic backtracking in the difflib.IS-LineJUNK method. An attacker could exploit this flaw to cause a denial of service. source-iocs-preserved const=ISLINEJUNK...

Astra Linux – Vulnerability in python-cryptography

Python-Cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, due to timed processing of valid PKCS1 v1.5 ciphertext...

Astra Linux – Vulnerability found in Python 3.11, Python 3.7, and Python 2.7

The ‘zipfile’ module does not check the validity of the offset value specified in the ZIP64 End of Central Directory EOCD Locator record. Instead, the ZIP64 EOCD record is assumed to be the previous record in the ZIP archive. This behavior could be exploited to create ZIP archives that are...

Astra Linux – Vulnerability in python-tornado

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limitation on the number of parts in multipart/form-data was the maxbodysize setting default: 100MB. Since parsing occurs synchronously on the main thread, this created a potenti...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine 2.9.18, where sensitive information is not masked by default, and the nolog feature is not protected when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The greatest threat posed by this...