CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

OPENSUSE-SU-2026:22103-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

SUSE-SU-2026:24246-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

SUSE-SU-2026:24189-1 Security update for python-oauthlib

This update for python-oauthlib fixes the following issues: - CVE-2026-49264: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation bsc1283526. - CVE-2026-49265: Oauthlib: Timing Attack Vulnerability in PKCE codeverifier Comparison...

Python Social Auth Cross-Site Request Forgery Vulnerability

Python Social Auth versions prior to 5.0.2 have a cross-site request forgeing vulnerability. This vulnerability arises from the lack of verification of the returned OAuth state when the LINE backend exchanges authorization codes. This can lead to cross-site request forgeing attacks. Attackers can...

adstoolbox (2025.12.2.2), aequitas (>=0.26.0, <=0.42.0) +46 more potentially affected by CVE-2026-110642 via xhtml2pdf (>=0.0.6, <=0.2.18)

xhtml2pdf PYPI version =0.0.6, =0.26.0, =2.3.1, =0.3.0, =1.0.0, =1.0.0, =1.0.3, =1.0.3, =1.3.1, =1.3.3 and more Source cves: CVE-2026-110642 Source advisory: SNYK:PYTHON-XHTML2PDF-20969951...

Exploit for Improper Authentication in Hikvision Ds-2Cd2032-I_Firmware

CVE-2017-7921 Exploiter A Python-based tool for security asses...

CVE-2026-110593

BottleCRM versions through 1.14.5 are vulnerable to a Server-Side Template Injection (SSTI) flaw in the send_email Celery task. The root cause is the insecure compilation of user-supplied AccountEmail message_body content using django.template.Template(). Authenticated organization members can ex...

SUSE-SU-2026:24243-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

OPENSUSE-SU-2026:22100-1 Security update for python-virtualenv

This update for python-virtualenv fixes the following issues: - CVE-2026-102930: missing hash verification for network-fetched wheels can allow wheel tampering bsc1283904. - CVE-2026-102938: crafted prompt values with line boundaries can cause configuration key injection bsc1283890...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

ROOT-APP-PYPI-CVE-2026-85394 CVE-2026-85394 in python-jose - Patched by Root

Root has patched CVE-2026-85394 in the python-jose package for Root:PyPI. Multiple fixed versions available...

python-tornado security update

An update is available for python-tornado. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

RLSA-2026:82040 Important: python-tornado security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

[SECURITY] Fedora 43 Update: python-jupytext-1.19.6-1.fc43

Have you always wished Jupyter notebooks were plain text documents? Wished you could edit them in your favorite IDE? And get clear and meaningful diffs when doing version control? Then... Jupytext may well be the tool you're looking for! Jupytext is a plugin for Jupyter that can save Jupyter...

OPENSUSE-SU-2026:12136-1 python-M2Crypto-doc-0.50.0-2.1 on GA media

These are all security issues fixed in the python-M2Crypto-doc-0.50.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-110248: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-104103: Improper Limitation of a Pathname to a Restricted Directory

Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extractarchive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...

CVE-2026-59951: Uncontrolled Resource Consumption

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

RockyLinux 9 : python-tornado (RLSA-2026:82040)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...