EUVD-2026-84629

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

hackexploit-dark

hackexploit-dark A dark hacking tool coded and built to assis...

CVE-2026-85725 LightRAG: Plaintext Passwords Compared Without Constant-Time Function

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verifypassword in lightrag/api/passwords.py compares plaintext AUTHACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences...

OPENSUSE-SU-2026:21912-1 Security update for python-PyMuPDF

This update for python-PyMuPDF fixes the following issues: Changes in python-PyMuPDF: - CVE-2026-82035: a path traversal vulnerability in the font branch of extractobjects in src/main.py bsc1280486...

CVE-2026-48802

A flaw was found in python-engineio, a Python implementation of the Engine.IO realtime client and server. A remote attacker can exploit a vulnerability in the heartbeat mechanism by sending specific packets, leading to the creation of excessive background threads. This can result in a Denial of...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0303...

tree-sitter-stack-graphs (>=0.3.0, <=0.6.0), tree-sitter-stack-graphs-java (>=0.0.1, <=0.2.0) +4 more potentially affected by unknown CVE via stack-graphs (>=0.10.2, <=0.14.1)

stack-graphs CARGO version =0.10.2, =0.3.0, =0.0.1, =0.0.1, =0.2.0 - tree-sitter-stack-graphs-python 0.0.1 - tree-sitter-stack-graphs-ruby 0.0.1 - tree-sitter-stack-graphs-typescript 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0302...

ROOT-APP-PYPI-GHSA-956X-8GVW-WG5V GHSA-956x-8gvw-wg5v in GitPython - Patched by Root

Root has patched GHSA-956x-8gvw-wg5v in the GitPython package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-WVPP-8HX9-P66J GHSA-wvpp-8hx9-p66j in GitPython - Patched by Root

Root has patched GHSA-wvpp-8hx9-p66j in the GitPython package for Root:PyPI. Multiple fixed versions available...

[SECURITY] Fedora 45 Update: python-torchaudio-2.11.0-4.fc45

The aim of torchaudio is to apply PyTorch to the audio domain. By supporting PyTorch, torchaudio follows the same philosophy of providing strong GPU acceleration, having a focus on trainable features through the autograd system, and having consistent style tensor names and dimension names...

[SECURITY] Fedora 45 Update: python-audioread-3.0.1-15.fc45

Decode audio files using whichever backend is available. Among currently supports backends are o Gstreamer via PyGObject o MAD via the pymad bindings o FFmpeg or Libav via its command-line interface o The standard library wave, aifc, and sunau modules...

PT-2026-96963

Name of the Vulnerable Software and Affected Versions Crypt::SelfCertificate versions 1.01 through 1.05 Description This software contains malware that executes Python code retrieved from an obfuscated URL. The generate certificate function runs a Python script disguised as a certificate file,...

ROS-20260922-73-0133

The vulnerability in Python-Django is related to uncontrolled memory allocation. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

PT-2026-97091

Name of the Vulnerable Software and Affected Versions mcp-toolbox-sdk-python affected versions not specified Description A caching flaw in the toolbox-core package allows a Google ID token to be cached and reused across different audiences within the same process. The module-level token cache fai...

ROS-20260922-73-0134

The vulnerability in Python-Django is related to incorrect external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-sqlalchemy (UTSA-2026-090396)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090396 advisory. SQLAlchemy 1.2.17 has SQL Injection when the groupby parameter can be controlled. Tenable has extracted the preceding description block directly from the Unity Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-090127)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090127 advisory. Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c. Tenable has extracted the preceding description block directly from the Unity Linux...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-090118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090118 advisory. In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state-shuffle is instructed to read beyond state-buffe...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python3 (UTSA-2026-090675)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090675 advisory. A flaw was found in Python, specifically in the FTP File Transfer Protocol client library in PASV passive mode. The issue is how the FTP client trusts the host from...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-mako (UTSA-2023-002842)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002842 advisory. Sqlalchemy mako before 1.2.2 is vulnerable to Regular expression Denial of Service when using the Lexer class to parse. This also affects babelplugin and linguaplugi...