CVE-2026-114613

The msgpack-python C extension (msgpack._cmsgpack) contains an unbounded memory leak in versions prior to 1.2.3 . When deserializing data with strict_map_key=True (the default), the extension fails to release decoded map values upon key validation failure. This vulnerability affects both unpackb(...

DEBIAN-CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114610

fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.buildxref passes nested SVG references to GraphicsContext.additem, whose default clone=True deep-copy behavior copies the complete referenced graphics tree during FPDF.image processing. Repeating references at...

CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

The fpdf2 PDF creation library for Python (prior to version 2.8.8 ) contains a vulnerability where the shared image loader automatically dereferences attacker-controlled HTTP(S) URLs and raw local paths. This occurs when processing inputs from FPDF.image() , FPDF.write_html() (HTML values), SVG ...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609 fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

CVE-2026-114609

fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTPS URLs and raw local paths supplied through FPDF.image, FPDF.writehtml HTML values, SVG or xlink:href values, and template image fields. This can cause outbou...

DEBIAN-CVE-2026-75507

GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.0.0 until 3.2.12 and 3.3.0rc1, the OverlappingFieldsCanBeMerged rule in specifiedrules repeatedly compares fields that share response names and recursively re-compares flattened inline fragments during the validation...

AZL-111002 CVE-2026-114605 affecting package python-dns 2.1.0-1

dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.fromwireparser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application...

hlvox (0.3.10), python-whiteprint (0.7.0) +2 more potentially affected by CVE-2026-113721 via virtualenv (20.16.5)

virtualenv PYPI version 20.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hlvox 0.3.10 - python-whiteprint 0.7.0 - traffic-guardian =1.0.1, =0.1.9, =0.3.7 Source cves: CVE-2026-113721 Source advisory:...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-113721 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-113721 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

doopass (>=2.7.0, <=2.9.0), dran2 (>=0.0.5, <=0.0.6) +6 more potentially affected by CVE-2026-113721 via virtualenv (20.26.2)

virtualenv PYPI version 20.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - doopass =2.7.0, =0.0.5, =1.0.1, =1.0.0, =0.1.4, =0.1.0, =0.2.0 - openpy-ts-clu 0.1.0 Source cves: CVE-2026-113721 Source advisory:...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-113721 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-113721 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

c2cciutils (>=1.1.47, <=1.1.58), dai-python-commons (5.4.16) +4 more potentially affected by CVE-2026-113721 via virtualenv (20.26.6)

virtualenv PYPI version 20.26.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.47, =0.20.0, =0.20.1 - rosettapy 0.2.3rc181.post1 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...

fzpycreate (>=0.0.12, <=2.0.0), neo-python (0.8.4) potentially affected by CVE-2026-113721 via virtualenv (16.2.0)

virtualenv PYPI version 16.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - fzpycreate =0.0.12, =2.0.0 - neo-python 0.8.4 Source cves: CVE-2026-113721 Source advisory: OSV:GHSA-558C-9HV2-4PRJ...