Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-gunicorn (UTSA-2026-142338)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142338 advisory. Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback...

RHEL 10 : python3.12 (RHSA-2026:77020)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:77020 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Slackware Linux 15.0 / current python-certifi Vulnerability (SSA:2026-293-06)

The version of python-certifi installed on the remote host is prior to 2026.10.19. It is, therefore, affected by a vulnerability as referenced in the SSA:2026-293-06 advisory. New python-certifi packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted...

RHEL 10 : python-tornado (RHSA-2026:80741)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:80741 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

Python 3.11.3 URL Parsing Blocklist Bypass

Python version 3.11.3 and earlier affected branches contain a URL parsing discrepancy that can allow leading whitespace to bypass scheme and hostname blocklists. The supplied proof of concept shows urlparse and urlopen interpreting that input differently. https://packetstorm.news/download/236757...

RHEL 9 : python-tornado (RHSA-2026:82040)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:82040 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RockyLinux 8 : python3 (RLSA-2026:85239)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:85239 advisory. python: python: Arbitrary file deletion via race condition during temporary directory cleanup CVE-2026-12345 python: python: Certificate verification...

Mercury Python Patch Kernel WebSocket Handler Code Execution

The vulnerability of the patchkernelwebsockethandler function in the Mercury Python framework is related to vulnerabilities in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Rocky Linux 8 [CIQ] Security Update: pcs / pcs-snmp Multiple Vulnerabilities (crlsa-2026_84798)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202684798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smugglin...

BLOCKED_PATTERNS Component Code Execution

The vulnerability of the BLOCKEDPATTERNS component in the Mercury Python framework is related to insufficient processing of regular expressions. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141788)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141788 advisory. An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath, the path will be truncated unexpectedly at the...

Unity Linux 20.1070a Security Update: python3.11 (UTSA-2026-141792)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-141792 advisory. An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters...

CLSA-2026-1792537548 Fix CVE(s): CVE-2025-7425

SECURITY UPDATE: double free in the Python bindings' SAX attributeDecl callback - debian/patches/CVE-2026-74860.patch: do not PyDECREF the attribute name string after PyListSetItem has stolen its reference in pythonAttributeDecl in python/libxml.c - CVE-2026-74860...

CLSA-2026-1789661605 python: Fix of 3 CVEs

CVE-2026-9669: fix a stack buffer overflow in the bz2 module when a BZ2Decompressor object is reused after a decompression error; the decompressor now becomes unusable once libbz2 reports an error, instead of resuming from an invalid internal state...

CVE-2026-83404

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

AZL-110106 CVE-2026-113776 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiatetemplate replaces placeholders one key at a time across the complete activation template, so trigger names such as VIRTUALNAME, VIRTUALENV, or VIRTUALPROMPT inside a...

AZL-110091 CVE-2026-113732 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote, which uses POSIX shlex.quote even though fish interprets backslashes and single quotes differently. An attacker-influenced environment path, --prompt, or...

CVE-2026-113731

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the findhandlersfortemplate MCP tool in python/djust/mcp/server.py accepts an existing absolute templatepath and reads it without...

AZL-110100 CVE-2026-113726 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASHVERSION is set, so zsh...

CVE-2026-113731

The djust framework (versions 0.9.0 through 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8) contains an arbitrary absolute-path file read vulnerability in the find_handlers_for_template MCP tool located in python/djust/mcp/server.py. The root cause is that the tool accepts an absolute template_path and reads...