AZL-105666 CVE-2026-102937 affecting package python-virtualenv 20.36.1-6

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENVPROMPT, or the corresponding...

AZL-105675 CVE-2026-102925 affecting package python-virtualenv for versions less than 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...

AZL-105669 CVE-2026-102930 affecting package python-virtualenv for versions less than 20.36.1-9

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, downloadwheel accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels'...

UBUNTU-CVE-2026-102938

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102904 Source advisory: MEND:CVE-2026-102904...

Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

CVE-2026-12345

A flaw was found in Python. A race condition during the cleanup of temporary directories allows a local attacker with write access to replace a directory with a symbolic link a reference pointing to another location. This can lead to unauthorized deletion or alteration of files outside the...

vestigium

🔎 Vestigium Agente autônomo de análise forense e CTF. Inge...

CLSA-2026-1790708982 python-jinja2: Fix of CVE-2025-27516

Bump up version to align with Oracle 2.7.2-4.0.1.el7 - CVE-2025-27516: fix sandbox escape via the |attr filter and str.format - Restore str.format automatic field numbering in the sandbox...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +5 more potentially affected by CVE-2026-102831 via jupyterlab (>=4.6.0, <=4.6.2)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-102831 Source advisory: MEND:CVE-2026-102831...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack due to a race condition in the onexc handler of TemporaryDirectory.rmtree in Lib/tempfile.py, which responds to a PermissionError or IsADirectoryError by calling resetperms and os.unlink on the absolute path, resolving th...

OPENSUSE-SU-2026:22003-1 Security update for python-pymongo

This update for python-pymongo fixes the following issues: Changes in python-pymongo: - CVE-2026-96749: integer overflow in BSON document encoding allows an unprivileged user to write outside the bounds of an allocated buffer bsc1282845 - CVE-2026-96748: host injection in connection string leadin...

abilian-sbe (>=1.1.0, <=1.1.12), acfx (>=0.3.1, <=0.3.7.dev2) +769 more potentially affected by CVE-2026-102598 via werkzeug (>=3.0.0, <=3.1.8)

werkzeug PYPI version =3.0.0, =1.1.0, =0.3.1, =4.11.0, =2.9.0, =1.0.0, =0.1.3, =0.2.4.1, =0.0.1, =1.3.0, =0.1.0, =1.0.0 and more Source cves: CVE-2026-102598 Source advisory: SNYK:PYTHON-WERKZEUG-20305246...

SUSE-SU-2026:4398-1 Security update for python-pymongo

This update for python-pymongo fixes the following issues: - CVE-2026-96747: improper handling of key management endpoint values ending in .sock allows users with write access to the encryption key metadata to open connections to local sockets on the application host bsc1282844. - CVE-2026-96748:...

Security update for python-pymongo

This update for python-pymongo fixes the following issues: CVE-2026-96747: improper handling of key management endpoint values ending in .sock allows users with write access to the encryption key metadata to open connections to local sockets on the application host bsc1282844. CVE-2026-96748: hos...

AZL-105651 CVE-2026-97687 affecting package python-pip 24.2-10

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

AZL-105678 CVE-2026-97687 affecting package python-virtualenv 20.36.1-6

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

AZL-105663 CVE-2026-97687 affecting package python-urllib3 2.0.7-6

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

AZL-105693 CVE-2026-97687 affecting package python3 3.12.14-2

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxysslcontext, proxyasserthostname, proxyassertfingerprint, sslcontext, certreqs, verifymode, useforwardingforhttps=True, and CERTNONE configuration paths fail to remain separated because target-server TLS settings are...

AZL-105660 CVE-2026-97689 affecting package python-urllib3 for versions less than 2.0.7-7

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.readchunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a...