AZL-110082 CVE-2026-111943 affecting package python-tensorboard 2.16.2-6

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when...

[slackware-security] python-certifi

New python-certifi packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/python-certifi-2026.10.19-i586-1slack15.0.txz: Upgraded. This update provides the latest CA certificates to check for the...

CVE-2026-114116 Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines, which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing...

CVE-2026-114116

The Vyper compiler versions 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 are vulnerable to literal value manipulation. The root cause is the use of str.splitlines() to build the source-line table, which incorrectly treats characters like form feed and U+2028 as line breaks while the Python p...

CVE-2026-114116 Vyper through 0.5.0b1 Literal Value Manipulation via Line Separators

Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines, which treats characters like form feed and U+2028 as line breaks the Python parser ignores, so numeric literals are classified and validated from shifted source text. An attacker contributing...

CLEANSTART-2026-TX79542 python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers

Security vulnerability affects the az package. python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers...

CVE-2026-114053

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mmprocessorkwargs.coderevision to Transformers AutoProcessor.frompretrained, letting clients select which revision of a model's dynamic processor code is imported when trustremotecode is enabled. An attacker controlling a revision in the...

EUVD-2026-106322

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

Multiple vulnerabilities in Python affect AIX

IBM SECURITY ADVISORY First Issued: Wed Oct 21 00:15:44 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory22.asc Security Bulletin: Multiple vulnerabilities in Python affect AIX...

Mercury Python Patch Kernel WebSocket Handler Code Execution

The vulnerability of the patchkernelwebsockethandler function in the Mercury Python framework is related to vulnerabilities in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

BLOCKED_PATTERNS Component Code Execution

The vulnerability of the BLOCKEDPATTERNS component in the Mercury Python framework is related to insufficient processing of regular expressions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-120795

Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK V3 versions prior to 3.10.0 Amazon SageMaker Python SDK V2 versions prior to 2.257.3 Description Insufficient verification of the communication channel source within the default bucket function allows remote actors ...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2026_84798)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smugglin...

RHEL 9 : python-tornado (RHSA-2026:82040)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82040 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Oracle Linux 10 : python-urllib3 (ELSA-2026-85930)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-85930 advisory. - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282258 Tenable has...

SUSE SLES15 Security Update : python-hpack (SUSE-SU-2026:4593-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4593-1 advisory. This update for python-hpack fixes the following issue: - CVE-2026-59980: unbounded variable integer decoding can cause run-away computation...

RHEL 10 : python-tornado (RHSA-2026:82041)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82041 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141788 advisory. An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath, the path will be truncated unexpectedly at the...

Python 3.11.3 URL Parsing Blocklist Bypass

Python version 3.11.3 and earlier affected branches contain a URL parsing discrepancy that can allow leading whitespace to bypass scheme and hostname blocklists. The supplied proof of concept shows urlparse and urlopen interpreting that input differently. https://packetstorm.news/download/236757...

Amazon SageMaker-Python-SDK authorization issue vulnerability

Amazon SageMaker-Python-SDK V3 versions prior to 3.10.0 and V2 versions prior to 2.257.3 contain an authorization issue vulnerability. This vulnerability stems from a lack of validation regarding the communication channel origin in the defaultbucket function. It may allow remote attackers to...