openSUSE 16 Security Update : python-asyncssh (openSUSE-SU-2026:21953-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21953-1 advisory. Changes in python-asyncssh: - CVE-2026-62949: denial of service via infinite loop when processing zero-sized SSH packets bsc1280972 Tenable has extracte...

SUSE CVE-2026-74860

A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition DTD with enumerated attribute values. This triggers a double-free error in the SAX attributeDecl callbac...

CVE-2026-96795

Horilla , an HR and CRM software, is vulnerable to Remote Code Execution (RCE) in versions prior to 2.0.0 . The flaw exists in HorillaListView.export_data (located in horilla_views/generic/cbv/views.py), where the application accepts an authenticated user's columns POST parameter and takes field_...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

CVE-2026-96795 Horilla: Authenticated RCE in Horilla List-View Export

Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.exportdata in horillaviews/generic/cbv/views.py accepts an authenticated user's columns POST parameter, takes fieldtuple1, interpolates it into dynamicfnstr as Python source, and passes the generated function definition to exec. A...

Malicious Package

Overview vercel-runtime-python is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

sBOMBPath

sBOMBPath Finds whether user input in your Python code can re...

Exploit for Inefficient Regular Expression Complexity in Kjd Internationalized_Domain_Names_In_Applications

Domain Validation Service — CVE-2024-3651 Demo A Python Flask...

K000163420: Python-Markdown vulnerability CVE-2025-69534

Security Advisory Description Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Because Python-Markdown does not catch this exception, any application that processe...

Security update for python-WebOb

This update for python-WebOb fixes the following issues: CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917. Patch Instructions: To install this SUSE upda...

SUSE-SU-2026:4351-1 Security update for python-WebOb

This update for python-WebOb fixes the following issues: - CVE-2026-54770: an unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft bsc1275917...

omnistrike

OmniStrike v2 Modular pentest framework for Termux. Pure Pyth...

CVE-2026-79310

A flaw was found in webpy. This vulnerability, known as Server-Side Template Injection SSTI, allows a remote attacker to execute malicious code on the server. By exploiting how the application precompiles and renders templates, an attacker can bypass security measures and run arbitrary Python cod...

Dnsplit

Dnsplit - Sub-Domain Enumeration Tool 🕵️‍♂️ Dnsplit is a Python-based tool designed for efficiently discovering sub-domains. 🚀 It's a project that's close to my heart as I'm still relatively new to both coding and the ethical hacking field. Despite my beginner status, I've put in the effort to...

HttpStrike

HttpStrike A fast DDoS script written in Python, it will send a lot of get requests if you increase the requests however you please...

MGASA-2026-0450 Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

MGASA-2026-0452 Updated python-webob packages fix a security vulnerability

Location header normalization during redirect leads to open redirect - again...

Updated python-webob packages fix a security vulnerability

Location header normalization during redirect leads to open redirect - again...

Updated python-gitpython packages fix security vulnerabilities

Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing Repository content can impersonate the git directory, leading to arbitrary code execution Residual of GHSA-hmq2-w58f-27jc: the fix validates the .gitmodules name but the sibling...

Malicious code in wallet-connect-adapter (npm)

Source: amazon-inspector 4135dd91724bdca6fc36f3a49906d219acc67afde7802cb1bd114d128984ca3d The package's postinstall hook runs node./loader.js, which base64-decodes an 8 KB embedded blob, XOR-decrypts it with a hardcoded 32-byte key, and pipes the resulting bytes into a detached, window-hidden...