CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

SUSE-SU-2026:3160-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...

SUSE-SU-2026:3155-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...

ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2025-27516 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2024-34064 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in rootio-Jinja2 - Patched by Root

Root has patched CVE-2024-56201 in the rootio-Jinja2 package for Root:PyPI. Multiple fixed versions available...

MAL-2026-10978 Malicious code in reimagined-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d In this campaign, packages use names similar to popular services e.g. Kimi AI to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicio...

MAL-2026-10976 Malicious code in colorstack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

MAL-2026-10975 Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 29eb6057bbc11a0f0180a030db952f9ec8aa39ce8c4b0d437046b20301f5b21a During import, the code uses steganography to extract code from an image hidden in the dependency. The code then adds a new authorized SSH key and reports back...

Wazuh - Unsafe Deserialization Remote Code Execution

A critical Remote Code Execution RCE vulnerability exists in Wazuh server versions = 4.4.0 and = 4.4.0 and 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using...

[SECURITY] Fedora 43 Update: python-pillow-11.3.0-10.fc43

Python image processing library, fork of the Python Imaging Library PIL This library provides extensive file format support, an efficient internal representation, and powerful image processing capabilities. There are four subpackages: tk tk interface, qt PIL image wrapper for Qt, devel developmen...

Oracle Linux 10 : python3.12 (ELSA-2026-39183)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-39183 advisory. 3.12.13-2.0.1.el102.1 - Remove upstream URL reference 3.12.13-2.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 Tenable has extracted the preceding...

Security update for python-aiohttp (important)

openSUSE security update: security update for python-aiohttp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21372-1 Rating: important References: bsc1268398 bsc1268543 bsc1268544 bsc1268549 bsc1268556 bsc1268559 bsc1268560 bsc1268561...

EulerOS Virtualization 2.12.0 : python-requests (EulerOS-SA-2026-2800)

According to the versions of the python-requests package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a...

EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2026-2801)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level...

EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2026-2798)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable...

AlmaLinux 9 : python3.14 (ALSA-2026:41949)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:41949 advisory. python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-15308 Tenable has extracted the preceding description...

Amazon Linux 2 : vim, --advisory ALAS2-2026-3804 (ALAS-2026-3804)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3804 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iterative...

SUSE SLES15: libpython3_11-1_0 / python311 / python311-base / python311-curses / etc (SUSE-SU-2026:3132-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3132-1 advisory. This update for python311 fixes the following issues - CVE-2026-1502: CR/LF bytes not rejected by HTTP client proxy tunnel headers ...