CVE-2026-82049

A flaw was found in Python's tarfile module. This module's data and tar extraction filters are vulnerable to specially crafted archives containing a hard link to a symbolic link. An attacker could exploit this by providing a malicious archive. This could lead to unauthorized modification of file...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python: Improper Input Validation CVE-2025-13462, CVE-2026-3644, Denial of Service CVE-2026-15308, CVE-2026-7210, CVE-2026-66046, Use-After-Free / Memory Corruption CVE-2026-76957, Out-of-Bounds Read / Infinite Loop CVE-2026-72522, CVE-2026-76641, Insufficient Entropy...

ROOT-APP-PYPI-CVE-2026-35523 CVE-2026-35523 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35523 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

Exploit for Improper Access Control in Widgetfactorylimited Jce

E.L.V CVE Research & Assessment Framework E.L.V — Exploit...

giskard-oss giskard-checks/v1.0.4

Evals, Red Teaming and Test Generation for Agentic Systems Modular, Lightweight, Dynamic and Async-first Docs • Website • Community !IMPORTANT Giskard v3 is a fresh rewrite designed for dynamic, multi-turn testing of AI agents. This release drops heavy dependencies for better efficiency while...

WhoCord v1.2.1

WhoCord An interactive OSINT canvas that grows with every discovery. Start with a seed — a Discord user, username, email, domain, phone, image, or URL — and watch the map build itself in real time. Screenshots Gallery: 1 · 2 · 3 | ---|--- | 1. Start page| 2. Canvas with details panel | 3. Multipl...

CVE-2026-91771 Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

Multiple vulnerabilities in Python affect AIX

IBM SECURITY ADVISORY First Issued: Tue Sep 15 00:52:33 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/pythonadvisory21.asc Security Bulletin: Multiple vulnerabilities in Python affect AIX...

CVE-2026-19407: Use of Insufficiently Random Values

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution RCE and tenant-project token theft...

CVE-2026-91943: Server-Side Request Forgery (SSRF)

Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where getpdfpath re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access...

CVE-2026-61667: Improper Neutralization of Special Elements used in an SQL Command

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py checkDataset, where...

CVE-2026-45579: Improper Neutralization of Directives in Dynamically Evaluated Code

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py exportgetRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to...

PT-2026-92107

Name of the Vulnerable Software and Affected Versions Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 Description Bucket Squatting allows an attacker to achieve Remote Code Execution RCE, which is the ability to execute arbitrary commands on a remote machine...

RockyLinux 9 : python-tornado (RLSA-2026:67146)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:4113-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4113-1 advisory. - CVE-2026-59881: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated...

SUSE SLED15 / SLES15 Security Update : python-Authlib (SUSE-SU-2026:4111-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4111-1 advisory. This update for python-Authlib fixes the following issue: - CVE-2026-41479: crafted authorization requests with...

RockyLinux 10 : python-tornado (RLSA-2026:67147)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service...

AlmaLinux 10 : python-tornado (ALSA-2026:67147)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67147 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service v...

AlmaLinux 9 : python-tornado (ALSA-2026:67146)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67146 advisory. tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects CVE-2026-49853 tornado: Tornado: Denial of Service vi...

SUSE SLES15 Security Update : python-sqlparse (SUSE-SU-2026:4109-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4109-1 advisory. This update for python-sqlparse fixes the following issue: - CVE-2026-84305: Reindentation of tuple lists causes near-cap quadratic CPU...