CLEANSTART-2026-GI85240 urllib3 is an HTTP client library for Python

CVE-2026-97687 affects multiple packages. urllib3 is an HTTP client library for Python. See references for individual vulnerability details...

CLEANSTART-2026-YY80093 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the minio package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CLSA-2026-1792629147 python-virtualenv: Fix of 3 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

CLSA-2026-1792629041 python-virtualenv: Fix of 4 CVEs

Additional fix for CVE-2024-53899: substitute the activation script placeholders in one pass, so a placeholder name inside a path cannot break the quoting - Additional fix for CVE-2024-53899: keep the environment name from running as a command from the shell prompt in bash, POSIX-mode bash and...

SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4807-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4807-1 advisory. This update for python-oauthlib fixes the following issue: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection...

Linux Distros Unpatched Vulnerability : CVE-2026-96637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, SpiderImageFile.seek in src/PIL/SpiderImagePlugin.py reparses a later SPIDER stack frame and replaces...

Oracle MySQL Connectors Python (October 2026 CPU)

The versions of MySQL Connectors installed on the remote host are affected by a vulnerability as referenced in the October 2026 CPU advisory. - Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily...

Important: python-awscrt

Issue Overview: Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting client application, potentially leading to arbitrary code execution, via a crafted...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (crlsa-2026_85239)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202685239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification bypa...

SUSE SLED15: libpython3_6m1_0 / python3 / python3-base / python3-curses / etc (SUSE-SU-2026:4754-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4754-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration...

Fedora 43 : python-cairosvg (2026-0a3e8cc0a0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0a3e8cc0a0 advisory. Update to 2.9.1 upstream release CVE-2026-107378 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

PT-2026-121486

Name of the Vulnerable Software and Affected Versions fpdf2 versions 2.5.0 through 2.8.7 Description The SVGObject.build xref function passes nested SVG references to GraphicsContext.add item. Due to the default clone=True deep-copy behavior during FPDF.image processing, the complete referenced...

PHP 8.5.11 Affected-Version Checker

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain a use-after-free vulnerability. This Python tool non-destructively checks exposed PHP version banners against the patched release thresholds...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.1 of CNCF OpenTelemetry Python contain a resource management error vulnerability. This vulnerability stems from the TraceState.fromheader function in opentelemetry/trace/span.py within the opentelemetry-api. When parsing W3C trace state headers, it uses an...

PT-2026-121675

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The default JWTBearerGrant.get audiences function returns an empty list, which leads JWTBearerGrant.verify claims to only check for the existence of an aud claim without verifying if it matches the...

PT-2026-121677

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description In the RFC 9101 JWTAuthenticationRequest implementation within authlib/oauth2/rfc9101/authorization server.py, the unauthenticated and client-controlled request uri parameter is passed to the abstrac...

PT-2026-121676

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description In the OpenIDImplicitGrant.validate authorization request function, the library checks the client-controlled raw request.payload.scope for the openid scope instead of using the filtered request.scope...

PT-2026-121674

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The OpenIDMixin.parse id token function in the authlib/integrations/base client/sync openid.py and authlib/integrations/base client/async openid.py files incorrectly processes the nonce supported cla...

SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4810-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4810-1 advisory. - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript...

SUSE SLED15 / SLES15 Security Update : python-WebOb (SUSE-SU-2026:4765-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4765-1 advisory. - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an...