CVE-2026-61652

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained "Content-Encoding" values causes Zapros to...

CVE-2026-61541

Zapros , a Python HTTP client, is vulnerable to denial of service in versions prior to 0.14.0 . The root cause is an unbounded chained Content-Encoding decompression chain : when an application requests content from an untrusted server (or follows a redirect to one), a malicious response containi...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61541 Zapros has an Unbounded Content-Encoding decompression chain that allows denial of service

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

CVE-2026-61652

Zapros , a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion . The root cause is that its streaming decoders ignored the requested chunk size (both explicit iter_bytes(chunk_size=...) and the default), allowing a single compressed response chunk ...

CVE-2026-61652 Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service via memory exhaustion. The issue affects all callers who streamed compressed responses relying on the chunk size — explicit iterbyteschunksize=... or the default — to bound memory. The decoder ignored that...

GHSA-5P39-CFHJ-2XMP vulnerabilities

Vulnerabilities for packages: open-webui, py3.14-anyio, kserve...

CVE-2026-52835

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

CVE-2026-49995

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirecturi parameter but leaves tab, line-feed, and carriage-return characters intact...

CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the importconfig handler and the databasefile branch of importdatabase in plexpy/webserve.py join the attacker-controlled configfile.filename or databasefile.filename directly to CACHEDIR without...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-urllib3: python3-urllib3+brotli-2.8.0-1.hum1 noarch python3-urllib3+h2-2.8.0-1.hum1 noarch python3-urllib3+socks-2.8.0-1.hum1 noarch python3-urllib3+zstd-2.8.0-1.hum1 noarch...

SUSE CVE-2026-77528

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +12 more potentially affected by CVE-2026-82355 via apache-airflow-core (>=3.3.0, <=3.3.1)

apache-airflow-core PYPI version =3.3.0, =0.5.0, =3.3.0, =1.3.0, =14.3.6rc1, =7.5.0rc1, =2.0.5, =1.6.23, =2.1.1, =1.11.1rc1, =1.44.1rc1, =0.2.0rc1, =1.34.6, =5.7.28, =5.13.0 Source cves: CVE-2026-82355 Source advisory: SNYK:PYTHON-APACHEAIRFLOWCORE-20044951...

K000163359: Python vulnerability CVE-2026-30922

Security Advisory Description pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containi...