OPENSUSE-SU-2026:21789-1 Security update for python-apprise

This update for python-apprise fixes the following issues: Changes in python-apprise: - CVE-2026-59180: Information disclosure via HTTP redirect following with credential resending bsc1271342...

EUVD-2026-68892

Tornado: Urlencoded body parsing omits maxnumfields, so one request can stall the event loop...

anomalydetection (0.0.0.dev1), dataprep (>=0.2.10a0, <=0.2.14) +12 more potentially affected by CVE-2026-82397 via tornado (5.0.2)

tornado PYPI version 5.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - anomalydetection 0.0.0.dev1 - dataprep =0.2.10a0, =1.4.0, =0.2.3, =0.10.4, =3.0.4, =1.3.0, =1.1.0, =0.0.6rc1, =0.5.18, =0.5.21 Source cves:...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +39 more potentially affected by CVE-2026-82398 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-82398 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-82398 Source advisory: OSV:GHSA-FC8X-2RWW-XW9M...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +5 more potentially affected by CVE-2026-82398 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - textspitter 0.3.7r...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via the Downloader.download and Downloader.incrdownload file-write path in nltk/downloader.py. An attacke...

Uncontrolled Recursion

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Uncontrolled Recursion via the RecursiveDescentParser in nltk/parse/recursivedescent.py. An attacker can pin a CPU core indefinitely or exhaust...

GHSA-FF5C-CP5C-9WJF NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

nltk.parse.RecursiveDescentParser and SteppingRecursiveDescentParser enumerate parses top-down with no bound on the number of recursive steps. A small, crafted context-free grammar makes a short input consume unbounded CPU and/or exhaust the Python recursion stack, pinning a process indefinitely ...

OPENSUSE-SU-2026:21741-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

SUSE-SU-2026:23607-1 Security update for python-ruff

This update for python-ruff fixes the following issue: - CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged bsc1249011...

SUSE CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...

Exploit for CVE-2022-25765

CVE-2022-...

GHSA-5CC2-282F-JJQ2 vulnerabilities

Vulnerabilities for packages: keep-fips, keep, datadog-agent, mlrun-fips, datadog-agent-fips, mlrun, airflow...

[SECURITY] Fedora 44 Update: python-linkify-it-py-2.1.1-1.fc44

This is a Python port of linkify-it 1, a link recognition library with FULL unicode support. It is focused on high quality link pattern detection in plain text. See a JavaScript demo 2. References: 1 https://github.com/markdown-it/linkify-it 2 https://markdown-it.github.io/linkify-it/...

[SECURITY] Fedora 44 Update: python-llm-0.33-2.fc44

A CLI tool and Python library for interacting with Large Language Models, both via remote APIs and with models that can be installed and run on your own machine...

CVE-2020-11881

creationtimestamp| type| source ---|---|--- 2026-09-02 01:00:13+00:00| seen| Telegram/V5hKn0oJ2nGQvFUOA8vMmIzpE0-LTzLZfzF3v7e7Ud5xOzo 2026-09-03 00:00:53+00:00| published-proof-of-concept| Telegram/V5hKn0oJ2nGQvFUOA8vMmIzpE0-LTzLZfzF3v7e7Ud5xOzo...

SUSE CVE-2026-84202

ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object construction tags. Attackers can craft malicious model repositories with poisoned configuration files that execute code when loaded by users...

CVE-2026-84382: Improper Handling of Highly Compressed Data (Data Amplification)

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iterbytes or aiterbytes yields bounded pieces to the application. A 64 KiB compressed chunk can expa...

CVE-2026-84378: Inefficient Algorithmic Complexity

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/sse.py repeatedly copies and rescans buffered text in SSELineDecoder.decode when an attacker-controlled or compromised SSE endpoint splits one unterminated line...