EUVD-2026-104453

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

EUVD-2026-104420

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111058

The Mercury Python framework (prior to version 3.2.6 ) contains a vulnerability where default tokenless deployments allow anonymous clients to create Jupyter kernels. Attackers can send execute_request messages containing arbitrary Python code because the endpoint blocklist fails to cover /api/ke...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.7. This vulnerability stems from incomplete escaping of environment variables in the bash activate script; backslashes can be unescaped, allowing commands to be executed in the user’s shell when names...

Python Packaging Authority virtualenv encryption vulnerability

The Python Packaging Authority virtualenv version 21.14.8 has a security vulnerability. This vulnerability stems from downloadwheel, which downloads the package index into a reusable cache before validating the target based on the Saved output from pip. Due to a flaw in the digest comparison, a...

djust-org djust path traversal vulnerability

Versions djust-org djust from 0.9.0 up to 1.0.10, from 1.1.0 up to 1.1.7, from 1.2.0.dev0 up to 1.2.4, and from 1.3.0.dev0 up to 1.3.0rc8 contain a path traversal vulnerability. This vulnerability arises because the findhandlersfortemplate MCP tool in python/djust/mcp/server.py fails to restrict...

Letta configuration error vulnerability

Letta versions 0.16.8 and earlier have a configuration error vulnerability. This vulnerability stems from the fact that LETTASERVERSECURE is not enabled in the compose.yaml file. As a result, the password middleware is not added, all API routes are not authenticated, and the PostgreSQL port of th...

Vulnerability related to improper handling of virtualenv output by Python Packaging Authority

A security vulnerability exists in Python Packaging Authority virtualenv versions prior to 21.14.2. This vulnerability arises because FishActivator inherits from ViaTemplateActivator.quote and calls POSIX shlex.quote. However, fish interprets backslashes and single quotes differently. Attackers c...

Oracle MySQL Connectors security vulnerabilities

Oracle MySQL Connectors version 26.7.0 contains security vulnerabilities. These vulnerabilities stem from issues with the Connector/Python component. Unauthorized attackers may gain network access through various protocols, potentially allowing them to access critical data or all accessible data...

CLSA-2026-1791486224 python: Fix of 3 CVEs

CVE-2026-82049: resolve a hard link's target with os.path.realpath before creating the link, so extracting a hard link to a symlink stored deeper in the archive cannot relocate that symlink to a shallower path where its relative target escapes the destination directory - CVE-2026-11940: re-filter...

CLSA-2026-1791486047 python: Fix of 3 CVEs

CVE-2026-82049: resolve a hard link's target with os.path.realpath before creating the link, so extracting a hard link to a symlink stored deeper in the archive cannot relocate that symlink to a shallower path where its relative target escapes the destination directory - CVE-2026-11940: re-filter...

CLSA-2026-1791485785 python: Fix of 3 CVEs

CVE-2026-82049: resolve a hard link's target with os.path.realpath before creating the link, so extracting a hard link to a symlink stored deeper in the archive cannot relocate that symlink to a shallower path where its relative target escapes the destination directory - CVE-2026-11940: re-filter...

ROOT-APP-PYPI-CVE-2024-37891 CVE-2024-37891 in urllib3 - Patched by Root

Root has patched CVE-2024-37891 in the urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-66471 CVE-2025-66471 in urllib3 - Patched by Root

Root has patched CVE-2025-66471 in the urllib3 package for Root:PyPI. Multiple fixed versions available...

Important: Red Hat Security Advisory: pcs security update

An update for pcs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...

Security update for python

This update for python fixes the following issue: CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure bsc1280459. Patch Instructions: To install this SUSE update use the SUSE recommended...