CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

EUVD-2026-102323

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

The Python Social Auth library is vulnerable to a Login CSRF attack in the LINE backend (LineOAuth2) prior to version 5.0.2 . The root cause is a failure to validate the returned OAuth state during the authorization code exchange. An attacker can initiate authorization for a controlled LINE accou...

CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

Anthropic Claude Agent SDK for Python: Input validation vulnerability

The Anthropic Claude Agent SDK for Python versions prior to 0.2.121 contain security vulnerabilities. These vulnerabilities stem from the resumption option being passed as an independent token to the Claude CLI without verification. Values starting with a dash are interpreted as independent CLI...

Astra Linux – Vulnerability in pillow

In versions 8.2.0 and earlier of Pillow, as well as versions 1.1.7 and earlier of PIL Python Imaging Library, an attacker can pass controlled parameters directly into the convert function, thereby triggering a buffer overflow in Convert.c...

Astra Linux – vulnerability in python-urllib3

In the urllib3 library up to version 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter...

Astra Linux – vulnerability in Ansible

A flaw was found in Ansible Engine 2.9.18: sensitive information is not masked by default and is not protected by the nolog feature when using the sub-option feature of the basic.py module. This flaw enables an attacker to obtain sensitive data. The primary threat posed by this vulnerability is...

Astra Linux – vulnerability in Jinja2

Jinja is an extensible templating engine. Prior to version 3.1.5, there was a flaw in how the Jinja sandbox environment detected calls to str.format, allowing an attacker who controls the template’s contents to execute arbitrary Python code. To exploit this vulnerability, an attacker must have...

Astra Linux – vulnerability in python3.11, python3.7

When loading a plist file, the plistlib module reads data at a size specified by the file itself; this means that a malicious file can cause OOM and DoS issues...

Astra Linux – vulnerability in python3.11

When reading an HTTP response from a server, if no read amount is specified, the default behavior is to use Content-Length. This allows a malicious server to cause the client to read large amounts of data into memory, potentially leading to an Out-of-Memory OOM condition or other types of...

Astra Linux – vulnerability in python2.7, pypy

In Python 3.x versions prior to 3.5.10, 3.6.x prior to 3.6.12, 3.7.x prior to 3.7.9, and 3.8.x prior to 3.8.5, CRLF injection is possible if the attacker controls the HTTP request method; this was demonstrated by inserting CR and LF control characters into the first argument of...

Astra Linux – Vulnerability in pyasn1

pyasn1 is a generic ASN.1 library for Python. Prior to version 0.6.3, the pyasn1 library was vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion during the decoding of ASN.1 data with deeply nested structures. An attacker could provide a crafted payload containing...

Astra Linux – Vulnerability in Python 3.7

A flaw was discovered in Python. In algorithms with quadratic time complexity that use non-binary bases, when using int“text”, a system may take 50 milliseconds to parse an int string with 100,000 digits, and 5 seconds for strings with 1,000,000 digits. Functions like float, decimal, int.frombyte...

Astra Linux – vulnerability in python3.7, python2.7

In Python aka CPython up to 3.10.8, the mailcap module does not add escape characters to commands found in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input if they lack validation of user-provided filenam...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

Python-Markdown version 3.8 contains a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Since Python-Markdown does not catch this exception, any application that processes Markdown controlled by...