74589 matches found
TencentOS Server 2: python-pyasn1 (TSSA-2026:0941)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0941 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
Amazon Linux 2023 : python3.14, python3.14-devel, python3.14-freethreading (ALAS2023-2026-2122)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2122 advisory. Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...
openSUSE 16 Security Update : python-aiohttp (openSUSE-SU-2026:21687-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21687-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated permessage-deflate...
Linux Distros Unpatched Vulnerability : CVE-2026-82398
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function...
CVE-2026-51974
An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...
ROS-20260901-73-0016
The vulnerability of the checkunsafeoptions mechanism in the Python library for interacting with Git repositories, GitPython, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...
PT-2026-84375
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...
CVE-2026-84366: Cleartext Transmission of Sensitive Information
Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to the corresponding S3 endpoint unless request.meta"issecure" is...
CVE-2026-84305: Inefficient Algorithmic Complexity
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...
CVE-2026-51974: Improper Control of Generation of Code
An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...
openSUSE 16 Security Update : python-h2 (openSUSE-SU-2026:21693-1)
The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21693-1 advisory. This update for python-h2 fixes the following issue: - CVE-2026-71554: duplicate Host headers are accepted and forwarded to consuming applications, whic...
TencentOS Server 3: python-urwid (TSSA-2026:0932)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0932 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
Malicious code in allied-lime-python (npm)
Source: amazon-inspector 46f5367f8dbf65e345182207060c2655dbc0ae20fe32e1929f6648d4bac6d834 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in adjacent-magenta-python (npm)
Source: amazon-inspector 359afc346aae1c37cbbb589d084f5919491ad657babbff3571d6c8315eb83b73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-82397
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82398
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/utils.py function readuntilwhitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes...
GHSA-VF76-F5CP-9846 Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...
Duplicate Advisory: ReDoS in nltk.tgrep via unvalidated user-supplied regular expressions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w3v8-gmh9-3wv7. This link is maintained to preserve external references. Original Description NLTK before 3.10.3 contains a regular expression denial of service ReDoS vulnerability in the tgrep module. The...
CVE-2026-82397 Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parseqs in tornado/escape.py without passing maxnumfields. RequestHandler.execute in tornado/web.py parses the body before handl...
CVE-2026-82397
Tornado (Python web framework / async networking library), prior to 6.5.8 , parses application/x-www-form-urlencoded request bodies via urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Because RequestHandler._execute parses the body before handler dispatch, an unauthenti...