PT-2026-121677

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description In the RFC 9101 JWTAuthenticationRequest implementation within authlib/oauth2/rfc9101/authorization server.py, the unauthenticated and client-controlled request uri parameter is passed to the abstrac...

PT-2026-121676

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description In the OpenIDImplicitGrant.validate authorization request function, the library checks the client-controlled raw request.payload.scope for the openid scope instead of using the filtered request.scope...

PT-2026-121674

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.9.0 Description The OpenIDMixin.parse id token function in the authlib/integrations/base client/sync openid.py and authlib/integrations/base client/async openid.py files incorrectly processes the nonce supported cla...

Security update for python-soupsieve (moderate)

openSUSE security update: security update for python-soupsieve ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22149-1 Rating: moderate References: bsc1281119 bsc1281120 Cross-References: CVE-2026-85999 CVE-2026-86000 CVSS scores: CVE-2026-85999 SUS...

NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...

SUSE SLED15 / SLES15 Security Update : python-oauthlib (SUSE-SU-2026:4810-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4810-1 advisory. - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript...

SUSE SLED15 / SLES15 Security Update : python-WebOb (SUSE-SU-2026:4765-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4765-1 advisory. - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an...

Oracle Linux 9 : python-oci-sdk (ELSA-2026-604898)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-604898 advisory. 2.187.0-1.0.5 - Fix multiple CVEs in pyjwt, aiohttp, pyOpenSSL, multidict Tenable has extracted the preceding description block directly from the...

Fedora 46 : python-nh3 / rust-ammonia (2026-938b1c0296)

The remote Fedora 46 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-938b1c0296 advisory. Update the ammonia crate to version 4.1.8. Rebuild python-nh3 to apply security fixes RUSTSEC-2021-0156, RUSTSEC-2021-0158, RUSTSEC-2026-0373. Tenable has...

Red Hat: CVE-2026-114613: msgpack: msgpack: Denial of Service via memory leak during map deserialization

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:22136-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:22136-1 advisory. Changes in python-joserfc: - CVE-2026-102946: JWS signature verification can be bypassed via empty signatures array bsc1285840 Tenable has extracted the...

PT-2026-121510

Name of the Vulnerable Software and Affected Versions msgpack-python versions prior to 1.2.3 Description The msgpack-python C extension msgpack. cmsgpack leaks a decoded map value during deserialization when a key is rejected while strict map key is set to True. This can lead to unbounded process...

phplume

Tests · Security research · Releases · MIT license A small, u...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

PHP2Shell Response Inspector A lightweight Python HTTP/HTTPS...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-113716 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-113716 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-113716 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

hlvox (0.3.10), python-whiteprint (0.7.0) +2 more potentially affected by CVE-2026-113716 via virtualenv (20.16.5)

virtualenv PYPI version 20.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hlvox 0.3.10 - python-whiteprint 0.7.0 - traffic-guardian =1.0.1, =0.1.9, =0.3.7 Source cves: CVE-2026-113716 Source advisory:...

python-webex-bot (0.51.0) potentially affected by CVE-2026-113716 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-113716 Source advisory: OSV:GHSA-CW65-GX24-RC82...

doopass (>=2.7.0, <=2.9.0), dran2 (>=0.0.5, <=0.0.6) +6 more potentially affected by CVE-2026-113716 via virtualenv (20.26.2)

virtualenv PYPI version 20.26.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - doopass =2.7.0, =0.0.5, =1.0.1, =1.0.0, =0.1.4, =0.1.0, =0.2.0 - openpy-ts-clu 0.1.0 Source cves: CVE-2026-113716 Source advisory:...