RHEL 8 : pcs (RHSA-2026:84843)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84843 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

RHEL 8 : pcs (RHSA-2026:84798)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84798 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

PT-2026-117373

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function get lib module of the file python/mlc chat/chat module.py. The manipulation of the argument model lib results in code injection. The attack may be launched remotely. Th...

CVE-2026-111058: Missing Authorization

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

ROS-20261019-73-0050

Vulnerability in Python 3.11 related to an uncontrolled element in the search path. Exploiting this vulnerability can allow an attacker to increase their privileges...

PT-2026-132908

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP NO EXTENSIONS or otherwise runs without a...

ROS-20261019-73-0067

The vulnerability in python-h2 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a remote attacker to send hidden HTTP requests a type of HTTP request smuggling attack...

CVE-2026-112140: Improper Control of Generation of Code

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function getlibmodule of the file python/mlcchat/chatmodule.py. The manipulation of the argument modellib results in code injection. The attack may be launched remotely. The...

PT-2026-117482

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active...

Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

RHEL 8 : python-lxml (RHSA-2026:84592)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84592 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

AlmaLinux 8 : pcs (ALSA-2026:84798)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:84798 advisory. python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggli...

RHEL 8 : pcs (RHSA-2026:85135)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:85135 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

RHEL 8 : pcs (RHSA-2026:84844)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:84844 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado:...

PT-2026-117645

Name of the Vulnerable Software and Affected Versions Pillow versions 7.2.0 through 12.11.0 Description A flaw exists when processing MIC images, where the library can enter an infinite loop while determining the frame count. This occurs because MicImageFile inherits TIFF frame traversal, but...

RHEL 8 : python-lxml (RHSA-2026:84593)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84593 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

ALSA-2026:84798 Important: pcs security update

The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: python-tornado: Tornado: Denial of Service via excessive URL-encoded body fields CVE-2026-82397 python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding...

PT-2026-117520

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description The pure Python parser in this asynchronous HTTP client/server framework accepts ambiguous HTTP request framing. This allows an unauthenticated attacker to perform request smuggling when an...

ROS-20261019-73-0036

The vulnerability in python-ecdsa is related to errors in processing parameter values related to input data length. Exploiting this vulnerability can allow a remote attacker to cause service failures...

openSUSE 16 Security Update : python-oauthlib (openSUSE-SU-2026:22103-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22103-1 advisory. - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. -...