74641 matches found
CVE-2026-19407 GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...
CVE-2026-19407
CVE-2026-19407 affects the Google Cloud Gemini Enterprise Agent Platform SDK for Python in versions prior to 1.166.1 . The vulnerability is a GCS Bucket Squatting flaw that allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft without requiring prior privileges ...
CVE-2023-54397 Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
CVE-2026-48987
pyLoad , a free and open-source Python download manager, is affected by unbounded memory growth in its EventManager module (src/pyload/core/managers/event_manager.py). Each unique UUID submitted to the authenticated getEvents API endpoint appends a Client object to an internal list, but the avail...
CVE-2026-48737
pyLoad (pyload-ng), a Python-based open-source download manager, has an SSRF guard bypass (CWE-918) in its is_global_address function. The guard relies on Python's ipaddress.IPv6Address.is_global, which classifies 6to4 (2002::/16) and NAT64 (64:ff9b::/96) transition prefixes as globally routable ...
USN-8765-1 python-sql vulnerability
Cédric Krier discovered that python-sql incorrectly escaped values passed to unary operators. An attacker could possibly use this issue to perform SQL injection attacks...
USN-8765-1: python-sql vulnerability
Cédric Krier discovered that python-sql incorrectly escaped values passed to unary operators. An attacker could possibly use this issue to perform SQL injection attacks...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
python: Python: Denial of Service via out-of-bounds write in BZ2 decompression
A flaw was found in Python's bz2.BZ2Decompressor component. An attacker could provide specially crafted input that, when processed by an application reusing a decompressor object after an error, could lead to out-of-bounds writes in memory. This memory corruption could cause the application to...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
python: Python tarfile module: Security filter bypass allows arbitrary file write
A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...
python: Python/Expat: Denial of Service via crafted XML document
A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...
python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers
A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be...
python: Python unicodedata: Denial of Service due to excessive CPU consumption
A flaw was found in the unicodedata.normalize function in Python. This vulnerability allows a remote attacker to cause excessive CPU consumption by providing specially crafted Unicode input. Successful exploitation can lead to a Denial of Service DoS on the affected system...
Security update for python-GitPython
This update for python-GitPython fixes the following issues: CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...
SUSE-SU-2026:4191-1 Security update for python-GitPython
This update for python-GitPython fixes the following issues: - CVE-2026-87817: failure to properly validade the git directory location allows attackers to impersonate the git directory using tracked files and execute arbitrary code by placing pre-commit hooks in the tracked hooks directory...
RLSA-2026:67147 Important: python-tornado security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...