UBUNTU-CVE-2026-19553

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CLSA-2026-1790708389 python-jinja2: Fix of CVE-2025-27516

Bump up version to align with Oracle 2.7.2-4.0.1.el7 - CVE-2025-27516: fix sandbox escape via the |attr filter and str.format - Restore str.format automatic field numbering in the sandbox...

CVE-2026-19553 SSLContext.wrap_bio() missing validation of server_hostname parameter

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CVE-2026-19553

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CVE-2026-19553 SSLContext.wrap_bio() missing validation of server_hostname parameter

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

PSF-2026-44

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

CVE-2026-19553

The Python ssl.SSLContext.wrap_bio() method fails to require a non-None server_hostname argument even when ssl.SSLContext.check_hostname is enabled. Due to a missing parameter check in SSLObject , omitting the server_hostname argument causes certificate hostname verification to be silently skippe...

CVE-2026-19553

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

EUVD-2026-90078

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...

[SECURITY] [DLA 4802-1] python-django security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4802-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 29, 2026 https://wiki.debian.org/LTS -...

aap-client-python (>=0.1.1, <=0.1.3), gcb-web-auth (>=0.6.0, <=2.0.0) +4 more potentially affected by CVE-2026-102270 via pyjwt (1.5.2)

pyjwt PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aap-client-python =0.1.1, =0.6.0, =0.2775.0, =0.3.0, =0.0.1, =4.0.0, =4.0.1 Source cves: CVE-2026-102270 Source advisory: OSV:GHSA-JWRC-G2Q2-PQ5P...

OESA-2026-4218 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

OESA-2026-4219 python-sqlparse security update

A non-validating SQL parser. Security Fixes: sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU...

OESA-2026-4210 python-pdfminer.six security update

PDF parser and analyzer. Security Fixes: pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The library uses Python pickle to deserialize CMap cache files without validation. An attacker with the ability to place a malicious pickle file ...

METIS

METIS - Modular Exploitation & Threat Intelligence Framework...

Security update for python-tornado

This update for python-tornado fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClien...

SUSE-SU-2026:4404-1 Security update for python-tornado

This update for python-tornado fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

Security update for python-tornado6

This update for python-tornado6 fixes the following issues: CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. CVE-2024-58384: CRLF injection in CurlAsyncHTTPClie...

SUSE-SU-2026:4403-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issues: - CVE-2023-54397: Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. At bsc1280689. - CVE-2024-58384: CRLF injection in...

Security update for python-PyYAML

This update for python-PyYAML fixes the following issues: Update to 5.3.1. CVE-2020-14343: A vulnerability was discovered in the PyYAML library, where it was susceptible to arbitrary code execution when it processes untrusted YAML files through the fullload method or with the FullLoader loader...