CVE-2026-55585: Improper Control of Generation of Code

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed package passes caller-controlled math expressions directly to SymPy parseexpr without restricted...

CVE-2026-78379: Undefined Security Weakness

Improper neutralization of input used for LLM prompting in the pythonrepl tool in Amazon Strands Agents Tools before 0.8.5 might allow remote actors to execute arbitrary Python code on the agent's host by bypassing the human consent gate, via a crafted prompt that forwards noninteractivemode as a...

python-pyasn1 security update

0.4.8-7.1 - Fix CVE-2026-59886: prevent overflow in Real type float conversion - Resolves: RHEL-217915...

python-pyasn1 security update

0.3.7-6.2 - Fix denial of service in Real type float method CVE-2026-59886 - Resolves: RHEL-217908...

ALSA-2026:59242 Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

CVE-2026-55546: Improper Control of Generation of Code

QWED-MCP is a deterministic verification gateway for MCP. Prior to 0.2.1, verifymathexpression in src/qwedmcp/engines/mathengine.py passes attacker-controlled expression and claimedresult strings directly to SymPy's parseexpr after only normalizing caret syntax to Python exponent syntax, without...

CVE-2026-78683

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

CVE-2026-15310: Uncontrolled Resource Consumption

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion...

python3.12 security update

3.12.14-1.0.1 - Remove upstream URL reference 3.12.14-1 - Update to Python 3.12.14 Resolves: RHEL-227215 3.12.13-3.1 - Security fix for CVE-2026-15308 Resolves: RHEL-193793...

EulerOS Virtualization 2.13.1 : python-pillow (EulerOS-SA-2026-3192)

According to the versions of the python-pillow packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that...

RHEL 8 : python-pyasn1 (RHSA-2026:59246)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59246 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

RHEL 8 : python-pyasn1 (RHSA-2026:59241)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59241 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

EulerOS Virtualization 2.13.0 : python-pillow (EulerOS-SA-2026-3232)

According to the versions of the python-pillow packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that...

EulerOS Virtualization 2.13.0 : python-pip (EulerOS-SA-2026-3233)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

AlmaLinux 10 : python-pyasn1 (ALSA-2026:59243)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59243 advisory. pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-59886 Tenable has extracted the preceding description block directly from the AlmaLinux...

AlmaLinux 8 : python-pyasn1 (ALSA-2026:59241)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:59241 advisory. pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values CVE-2026-59886 Tenable has extracted the preceding description block directly from the AlmaLinux...

Oracle Linux 9 : python-urwid (ELSA-2026-58952)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-58952 advisory. - Fix CVE-2026-9323: use cryptographically secure session identifiers in web display module Tenable has extracted the preceding description block directly from...

Important: python-pyasn1 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 10 : python-pyasn1 (RHSA-2026:59238)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59238 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Oracle Linux 9 : python-pyasn1 (ELSA-2026-59242)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-59242 advisory. - Fix CVE-2026-59886: prevent overflow in Real type float conversion Tenable has extracted the preceding description block directly from the Oracle Linux...