Linux Distros Unpatched Vulnerability : CVE-2026-111750

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. ...

Linux Distros Unpatched Vulnerability : CVE-2026-112894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall...

Security update for python-joserfc (critical)

openSUSE security update: security update for python-joserfc ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22136-1 Rating: critical References: bsc1285840 Cross-References: CVE-2026-102946 Affected Products: openSUSE Leap 16.0...

PT-2026-119599

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Python. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attac...

RockyLinux 8 : pcs (RLSA-2026:84798)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:84798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request...

Fedora 44 : GitPython / python-mkdocs-rss-plugin (2026-f2d13d09d7)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-f2d13d09d7 advisory. Update to 3.2.0 Fixes GHSA-gq48-pqfc-9p58, GHSA-23mf-xhv8-69c2, GHSA-f9j4-qggq-h239, GHSA-w8jc-g24h-crhw, GHSA-m64x-33q8-m5h7, and GHSA-fx3j-rwgx-fr94. Tenab...

MiracleLinux 8 : pcs-0.10.18-2.el8_10.10.ML.1 (AXSA:2026-2102:08)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2102:08 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request...

PT-2026-119530

Name of the Vulnerable Software and Affected Versions djust versions 0.9.0 through 1.0.9 djust versions 1.1.0 through 1.1.6 djust versions 1.2.0 through 1.2.3 djust versions 1.3.0rc1 through 1.3.0rc7 Description The find handlers for template MCP tool in python/djust/mcp/server.py accepts an...

Linux Distros Unpatched Vulnerability : CVE-2026-112390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

Exasol Database 7.1.30 Default Credential Python UDF Command Execution

Exasol Database version 7.1.30 docker-db deployments use the documented SYS default credential, which can create a PYTHON3 UDF invoking os.popen and return command output through SELECT. https://packetstorm.news/download/236507...

AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791825473)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791825473 advisory. - ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing...

CentOS Linux 7 [TuxCare] Security Update: python / python-debug / python-devel / python-libs / python-test / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1791485785)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1791485785 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored...

Rocky Linux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791825473)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791825473 advisory. - ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missin...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:4738-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:4738-1 advisory. This update for python fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic...

DEBIAN-CVE-2026-112891

Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow performs quadratic copying when saving a GIF with a long comment. getglobalheader repeatedly copies portions of comment data while assembling the global header, including comments retained from an untrusted input image. An attack...

DEBIAN-CVE-2026-112392

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage; ImagingRankFilter i...

CVE-2026-112894

The Pillow Python imaging library (versions 5.1.0 to 13.0.0 ) is vulnerable to a Denial of Service (DoS) attack due to inefficient algorithmic complexity in the PdfParser.next_object_id() function. When saving many frames with save_all enabled, the library takes quadratic time to reserve PDF obje...

CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall enabled. PdfParser.nextobjectid repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can suppl...

CVE-2026-112894 Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)

Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with saveall enabled. PdfParser.nextobjectid repeatedly rebuilds and scans all previously reserved identifiers for every object. An attacker can suppl...