MAL-2026-7457 Malicious code in piirgg (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7456 Malicious code in notrandompacketname (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7455 Malicious code in myproject234 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7454 Malicious code in cyberday26szymon-payments (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7453 Malicious code in cyberday26szymon-logging (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7452 Malicious code in cyberday26szymon-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1826 PyMongo Out-of-bounds Read in the bson module

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

PYSEC-2026-1292 dbt allows Binding to an Unrestricted IP Address via socketsocket

Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...

PYSEC-2026-1887 sagemaker-python-sdk Command Injection vulnerability

Impact The capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module before version 2.214.3 allows for potentially unsafe Operating System OS Command Injection if inappropriate command is passed as the “requirementspath” parameter. This consequently may allow an...

PYSEC-2026-1850 python-multipart vulnerable to Content-Type Header ReDoS

Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...

PYSEC-2026-1283 Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...

PYSEC-2026-1405 glance-store logs s3 access keys

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...

PYSEC-2026-1969 TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

Summary The torbot.modules.validators.validatelink function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument.. Details...

TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link

SummaryThe torbot.modules.validators.validatelink function uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows an attacker to cause an application crash using a well-crafted argument...

PYSEC-2026-1695 NI MeasurementLink Python Services Improper Access Restriction vulnerability

Impact An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python usin...

Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

PYSEC-2026-1428 Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

PYSEC-2026-2050 Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Impact The proxy mode of WireMock, can be protected by the network restrictions configuration, as documented in Preventing proxying to and recording from specific target addresses. These restrictions can be configured using the domain names, and in such a case the configuration is vulnerable to t...

Pyramid static view path traversal up one directory

ImpactThis impacts users of Python 3.11 that are using a Pyramid static view with a full filesystem path and have a index.html file that is located exactly one directory above the location of the static view's file system path. No further path traversal exists, and the only file that could be...

PYSEC-2026-2075 Information disclosure in AccessControl

Impact Python's "format" functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...