Important: python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

UBUNTU-CVE-2026-114614

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...

RHEL 9 : python3.9 (RHSA-2026:89742)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89742 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

PT-2026-123433

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 6.2.0 Description In the OpenIdConnectAuth component within social core/backends/open id connect.py, the get and store nonce function stores the OpenID Connect nonce in a shared OpenIdConnectAssociation...

PT-2026-123149

A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func set nnabla version decorate of the file python/src/nnabla/utils/converter/utils.py of the component NNP Converter. Performing a manipulation of the argument function.type results in...

ROS-20261026-73-0211

The vulnerability in python-multipart is related to the lack of input validation for cyclic operations. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20261026-73-0213

The vulnerability of the UPLOADDIR configuration and the UPLOADKEEPFILENAME=True setting in the Python-multipart streaming parser is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a remote attacker to write arbitrary files...

PT-2026-125385

Name of the Vulnerable Software and Affected Versions Autobahn Python versions 26.7.1 through 26.10.0 Description An unauthenticated WebSocket client can trigger a memory-exhaustion denial of service on servers that enable the opt-in permessage-brotli feature. This occurs because the decompress...

UBUNTU-CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

RHEL 7 : python-lxml (RHSA-2026:90327)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:90327 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CentOS Linux 7 [TuxCare] Security Update: python-lxml / python-lxml-docs (CENTOS7:CLSA-2026:1792861994)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1792861994 advisory. - lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in lxml.html.defs.linkattrs were missing...

Fedora 44 : mingw-python-lxml (2026-99cd0bee1c)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-99cd0bee1c advisory. Update to python-lxml-6.1.1. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

PT-2026-125469

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

UBUNTU-CVE-2026-114619

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validateauthorizationrequest checks the client-controlled raw request.payload.scope for openid after the parent grant has filtered allowed scopes into request.scope. A registered client...

CentOS Linux 6 [TuxCare] Security Update: python / python-devel / python-libs / python-test / python-tools / etc (CENTOS6:CLSA-2026:1792810266)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1792810266 advisory. - Use-after-free UAF was possible in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails with a...

RHEL 8 : python-lxml (RHSA-2026:90326)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:90326 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

UBUNTU-CVE-2026-115557

Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configuration...

PT-2026-125123

Name of the Vulnerable Software and Affected Versions Mem0 Python SDK versions prior to 2.0.18 Mem0 TypeScript SDK versions prior to 3.1.6 Description Improper handling of delimiters in the build session scope function in mem0/memory/main.py and the Memory.buildSessionScope function in the...

ALSA-2026:89742 Important: python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

UBUNTU-CVE-2026-114618

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, the default RFC 7523 JWTBearerGrant.getaudiences returns an empty list, causing JWTBearerGrant.verifyclaims to require only that an aud claim exists without matching the current authorization server. An...