PYSEC-2026-3797

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81690

openssl-encrypt pip package before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob, which in CPython does not descend into symlinked directories and treats the symlink as an ordinary directory, while ONOFOLLOW on the...

CLSA-2026-1787649986 python: Fix of CVE-2026-0864

CVE-2026-0864: normalize CR and CRLF line endings when writing multi-line values in ConfigParser - RawConfigParser.write escaped only '\n' to '\n\t', so an attacker-controlled value containing a bare carriage return was written out verbatim and injected unexpected keys and values into the...

CVE-2026-69248

A flaw was found in python-cryptography versions 46.0.6 through 48.x. The X.509 verifier incorrectly handles wildcard DNS Subject Alternative Names when evaluating permitted name constraints: a leaf SAN such as .example.com may be accepted under a more specific permitted subtree for example...

CVE-2026-69249

A flaw was found in python-cryptography. When processing invalid certificate chains that include duplicate self-signed certificates, the system recursively invokes the same certificate, leading to an exponential increase in processing time. A remote attacker could exploit this by providing a...

Exploit for CVE-2026-19295

Description Proof o...

CVE-2026-81726 NLTK through 3.10.3 Path Traversal via Model-Artifact APIs

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagge...

Unchecked Input for Loop Condition

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the FeatStructReader in nltk/featstruct.py. An attacker can trigger an unhandled RecursionError and cras...

CVE-2026-81717 openssl_encrypt before 1.4.9 Integrity Bypass via Added Files

opensslencrypt pip package openssl-encrypt before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted attacker with physical write access. USBDriveCreator.verifyintegrityfile only validates files listed in the manifest, so...

CVE-2026-81697 openssl_encrypt before 1.4.9 KDF Downgrade via CWD-relative Configuration

opensslencrypt pip package openssl-encrypt versions = 1.4.8 contain a CWD-relative configuration file resolution flaw in cryptsettings.py, where CONFIGFILE originally the absolute per-user path /.cryptsettings.json is reassigned at line 84 to the bare relative name 'cryptsettings.json'. As a...

EUVD-2026-67024

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...

CVE-2026-81096 ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape

ToolUniverse ran caller-supplied Python inside a sandbox that could be escaped, on a server that required no authentication. The executor behind the pythoncodeexecutor tool, in pythonexecutortool.py, inspected the submitted source for a denied list of attribute names and calls but left the...

Malicious Package

Overview discordnv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-80205

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service ReDoS vulnerability in the Text.findall and TokenSearcher.findall methods. These methods accept user-supplied regular expressions without validation, allowing an attacker to provide crafted patterns tha...

CVE-2026-76098

A flaw was found in Mistune, a Python Markdown parser. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by submitting specially crafted Markdown input. The excessive use of emphasis markers, such as consecutive asterisks, creates deeply nested tokens during HTML...

CLSA-2026-1784071323 python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...

CLSA-2026-1784072295 python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...

python: Fix of 3 CVEs

CVE-2026-15308: fix quadratic complexity CPU DoS in the incremental HTMLParser when unterminated markup declarations span many feed calls, by accumulating new data and only rescanning once enough has piled up...

CVE-2026-81662

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/configmodule.py. The vulnerabl...

python: Python base64: Incomplete data decoding due to premature stop at padding

A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode, the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial...