74580 matches found
OPENSUSE-SU-2026:12137-1 python-Twisted-doc-26.4.0-4.1 on GA media
These are all security issues fixed in the python-Twisted-doc-26.4.0-4.1 package on the GA media of openSUSE Tumbleweed...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: libxml2 (UTSA-2026-130064)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-130064 advisory. A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing...
python313-python-engineio-4.13.3-1.2 on GA media (moderate)
python313-python-engineio-4.13.3-1.2 on GA media Announcement ID: openSUSE-SU-2026:12031-1 Rating: moderate Cross-References: CVE-2019-13611 CVSS scores: CVE-2019-13611 SUSE : 5.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Affected Products: openSUSE Tumbleweed An update that solves one...
PT-2026-114022
Insertion of sensitive information into log files in the git utils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because...
PT-2026-113968
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract archive validated tar member names before calling TarFile.extractall but did not validate symlink members or hard-link members. A crafted archive could...
PT-2026-115365
These are all security issues fixed in the python-M2Crypto-doc-0.50.0-2.1 package on the GA media of openSUSE Tumbleweed...
RockyLinux 10 : python-tornado (RLSA-2026:82041)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
CVE-2026-109527: Allocation of Resources Without Limits or Throttling
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...
PT-2026-114020
Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.29.1 mcp versions 2.0.0a1 through 2.0.1 Description The Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. ...
PT-2026-114141
Name of the Vulnerable Software and Affected Versions sgl-project SGLang versions prior to 0.5.20 Description A remote denial of service can be triggered through the manipulation of the session params argument within the generate endpoint, specifically affecting the functionality in the file...
ALSA-2026:82858 Important: python36:3.6 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
RHEL 8 : python36:3.6 (RHSA-2026:82858)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:82858 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...
Fedora 43 : python-jupytext (2026-3942ab86fd)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3942ab86fd advisory. See https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.5 and 1.19.6. For this update, a patch has been applied...
AlmaLinux 9 : python-tornado (ALSA-2026:82040)
The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82040 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
AlmaLinux 10 : python-tornado (ALSA-2026:82041)
The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:82041 advisory. tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-103262 Tenable has extracted the preceding description block directly...
SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4633-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4633-1 advisory. - CVE-2026-6879: quadratic behavior in xml.etree.ElementPath index predicates can lead to a denial of service via high CPU usage...
CVE-2026-85864
Improper privilege management in Python allows an authorized attacker to elevate privileges locally...
Arbitrary Code Injection
Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the ClassRepresentation.renderdocstring process. An attacker can execute...
Arbitrary Code Injection
Overview dataclasses-avroschema is a Generate Avro Schemas from Python classes. Serialize/Deserialize python instances with avro schemas Affected versions of this package are vulnerable to Arbitrary Code Injection via the EnumRepresentation.rendersymbols process. An attacker can execute arbitrary...
