EUVD-2026-32634

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile endpoint writes user-supplied numeric config values e.g., SMTPPORT directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec every 3–5 minutes...

cashd (>=0.1.0, <=0.3.4.post1), taipy-utils (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48544 via taipy (>=3.1.0, <=4.1.1)

taipy PYPI version =3.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-48544 Source advisory: SNYK:PYTHON-TAIPY-17178796...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-44971 GuardDog: Blind GitHub URL rewrite in remote project scanning causes SSRF and `GH_TOKEN` exfiltration

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libsolv: libsolv-0.7.38-2.hum1 aarch64, x8664 libsolv-demo-0.7.38-2.hum1 aarch64, x8664 libsolv-devel-0.7.38-2.hum1 aarch64, x8664 libsolv-tools-0.7.38-2.hum1 aarch64, x8664...

GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure

CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control C2 channels associated with GlassWorm, a persistent software chain campaign targeting software developers through malicious packages and extensions. "Since...

RHSA-2026:20810 Red Hat Security Advisory: python-tornado security update

Bulletin has no description...

vulnhunt-agent

Vulnerability Hunting Agent An LLM agent that reads code,...

Malicious code in quatres (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d720315dd49970cfc00c39f4e377485b2746a4fc24f42dec7e79d0749ab9a7d During import, the hidden code downloads and executes the second-stage code. After performing anti-analysis checks, it downloads a malicious executable and...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 — WHM/cPanel Exploit Tool Linux ⚠️ DISCL...

angr 9.2.219

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

The vulnerability of the _has_sneaky_javascript() function in the lxml_html_clean library for the Python programming language allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the hassneakyjavascript function in the lxmlhtmlclean library, written in the Python programming language, is related to incorrect encoding or escaping of output data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3317 (ALAS-2026-3317)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3317 advisory. pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred ...

python311-pytest-html-4.2.0-2.1 on GA media (moderate)

python311-pytest-html-4.2.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:10861-1 Rating: moderate Cross-References: CVE-2026-9277 CVSS scores: CVE-2026-9277 SUSE : 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-9277 SUSE : 9.2...

Amazon Linux 2023 : python3-pillow, python3-pillow-devel, python3-pillow-tk (ALAS2023-2026-1712)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1712 advisory. Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an...

PT-2026-44076

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile endpoint writes user-supplied numeric config values e.g., SMTP PORT directly into pialert.conf without validation. Since pialert.conf is loaded via Python's exec every 3–5 minute...

The vulnerability of the Python library for working with PDF files, PyPDF, related to unlimited resource distribution, allows a hacker to cause a service failure.

The vulnerability of the Python library for working with PDF files, PyPDF, is related to the unlimited distribution of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

Amazon Linux 2 : python-pillow, --advisory ALAS2-2026-3312 (ALAS-2026-3312)

The version of python-pillow installed on the remote host is prior to 2.0.0-23.gitd1c6db8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3312 advisory. Pillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an...

RHEL 9 : python-markdown (RHSA-2026:20674)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:20674 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Amazon Linux 2023 : python3.13-pip, python3.13-pip-wheel (ALAS2023-2026-1719)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1719 advisory. pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as...