cewler (1.2.0.post1), python-xdoc (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-102993 via pypdf (4.0.1)

pypdf PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - cewler 1.2.0.post1 - python-xdoc =0.1.0, =0.1.1 Source cves: CVE-2026-102993 Source advisory: OSV:GHSA-QV6H-RV94-W285...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-102993 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

AZL-105378 CVE-2026-103262 affecting package python-tornado 6.3.3-11

Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits...

AZL-105375 CVE-2026-103263 affecting package python-tornado 6.3.3-11

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request...

AZL-105372 CVE-2026-103261 affecting package python-tornado 6.3.3-11

Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.init, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauthenticated GET requests with unbounded query-string field counts ...

METIS

METIS - Marco Modular de Explotación e Inteligencia de Amenazas ███╗ ███╗███████╗████████╗██╗███████╗ ████╗ ████║██╔════╝╚══██╔══╝██║██╔════╝ ██╔████╔██║█████╗ ██║ ██║███████╗ ██║╚██╔╝██║██╔══╝ ██║ ██║╚════██║ ██║ ╚═╝ ██║███████╗ ██║ ██║███████║ ╚═╝ ╚═╝╚══════╝ ╚═╝ ╚═╝╚══════╝ Un marco de...

thrift: thrift: Denial of Service via infinite loop in Python bindings

A flaw was found in Apache Thrift's Python bindings. A remote attacker could trigger an infinite loop during data processing, leading to a Denial of Service DoS. By sending specially crafted input, an attacker can cause the application to hang and consume excessive resources, making the service...

thrift: Apache Thrift: Python ≥3.12 host-name check silently becomes a no-op

A flaw was found in Apache Thrift's Python bindings. Due to improper certificate validation and incorrect status code handling, client applications fail to properly verify the authenticity of a remote server during encrypted connections. A remote attacker in a man-in-the-middle position could...

thrift: Apache Thrift: Python `TZlibTransport` stops enforcing its decompressed-size limit once the limit is exactly used up

A flaw was found in Apache Thrift's Python bindings. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service DoS by sending specially crafted input or compressed payloads. Due to improper input validation and improper handling of compressed data, processing these...

thrift: Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

A flaw was found in the Apache Thrift Python bindings, which can lead to a Denial of Service DoS. Due to insecure default settings and a lack of limits or throttling on resource allocation, a remote unauthenticated attacker can cause excessive resource consumption. This behavior can exhaust...

[SECURITY] Fedora 44 Update: uv-0.12.19-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 44 Update: python-uv-build-0.12.19-1.fc44

This package is a slimmed down version of uv containing only the build backend...

[SECURITY] Fedora 44 Update: rust-libcst-1.9.0-1.fc44

A Python parser and Concrete Syntax Tree library...

[SECURITY] Fedora 44 Update: ruff-0.16.9-1.fc44

An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...

SUSE CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

[SECURITY] Fedora 43 Update: ty-0.0.84-1.fc43

An extremely fast Python type checker and language server, written in Rust...

[SECURITY] Fedora 43 Update: python-uv-build-0.12.19-1.fc43

This package is a slimmed down version of uv containing only the build backend...

[SECURITY] Fedora 43 Update: ruff-0.16.9-1.fc43

An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...

[SECURITY] Fedora 43 Update: rust-libcst-1.9.0-1.fc43

A Python parser and Concrete Syntax Tree library...

[SECURITY] Fedora 43 Update: python-cssselect2-0.10.1-1.fc43

cssselect2 is a straightforward implementation of CSS4 Selectors for markup documents HTML, XML, etc. that can be read by ElementTree-like parsers, including cElementTree, lxml, html5lib, etc...