pcs security update

An update is available for pcs. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The pcs packages provide a command-line configuration system for the Pacemaker an...

Exploit for Improper Input Validation in Python

CVE-2023-24329 — Python URL Parsing PoC A command-line proof...

[SECURITY] [DLA 4843-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb October 19, 2026 https://wiki.debian.org/LTS -...

CVE-2026-109440

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

logwatch

LogWatch Painel de alertas de log feito em Python, sem depe...

EUVD-2026-104692

Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...

CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...

CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...

CVE-2026-77936 Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access

Letta through 0.16.8 ships a compose.yaml that does not enable LETTASERVERSECURE, so the password middleware is never added and all API routes are unauthenticated, and it exposes a superuser PostgreSQL port with default credentials. Remote attackers can execute arbitrary Python via POST...

CVE-2026-77936

Versions of Letta through 0.16.8 are vulnerable to an insecure default configuration due to a compose.yaml file that fails to enable LETTA_SERVER_SECURE . This omission prevents the password middleware from being added, leaving all API routes unauthenticated . Additionally, the configuration expo...

EUVD-2026-104680

LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or Python by planting instructions in web content retrieved by the agent. Because Bash and ExecuteCode lack an allow-list and human-in-the-loop approval, attacke...

Debian dla-4843 : python-django-doc - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4843 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4843-1 [email protected]...

Alibaba Cloud Linux 3 : 0309: python-lxml (ALINUX3-SA-2026:0309)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0309 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-49825: lxml is a library for processing XM...

CentOS Linux 7 [TuxCare] Security Update: python-setuptools (CENTOS7:CLSA-2026:1791500181)

The CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1791500181 advisory. - Python Packaging Authority PyPA setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or...

Linux Distros Unpatched Vulnerability : CVE-2026-112392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

Ginlix AI LangAlpha security vulnerability

Ginlix AI LangAlpha versions 2026.09.07 and earlier contain a security vulnerability stemming from indirect prompt injection. Due to the absence of allowlists and manual approvals for Bash and ExecuteCode, attackers can insert commands into web pages retrieved by the proxy, thereby executing shel...

PT-2026-117935

Name of the Vulnerable Software and Affected Versions LangAlpha versions prior to 2026.09.07 Description An indirect prompt injection allows remote attackers to execute shell commands or Python by placing instructions within web content retrieved by the agent. This occurs because the Bash and...

PT-2026-119599

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...