Linux Distros Unpatched Vulnerability : CVE-2026-45309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-55195

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's...

The vulnerability of the tarfile module in the Python programming language, which allows attackers to compromise the integrity of protected information

The vulnerability of the tarfile module in the Python programming language is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-2564)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2623)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

The vulnerability of the Python programming language’s HTTP client module allows attackers to inject arbitrary HTTP headers.

The vulnerability of the Python programming language’s HTTP client module is related to the failure to take measures to neutralize crlf sequences. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

MiracleLinux 8 : python-urllib3-1.24.2-10.el8_10 (AXSA:2026-1235:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1235:03 advisory. urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers CVE-2026-44431 Tenable has extracted the preceding descripti...

EulerOS 2.0 SP12 : python-requests (EulerOS-SA-2026-2563)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

openSUSE 16 Security Update : python-joserfc (openSUSE-SU-2026:21263-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21263-1 advisory. Changes in python-joserfc: - CVE-2026-49852: HS256/HS384/HS512 verify accepts empty/nil HMAC key bsc1270234 Tenable has extracted the preceding...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-2620)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename when...

SUSE SLES15 Security Update : python-Django (SUSE-SU-2026:2819-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2819-1 advisory. This update for python-Django fixes the following issues - CVE-2026-48588: potential exposure of private data via cached Set-Cookie response...

EulerOS 2.0 SP12 : python-jwt (EulerOS-SA-2026-2617)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

EulerOS 2.0 SP12 : python-urllib3 (EulerOS-SA-2026-2624)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...

EUVD-2026-39007

Mistune: Potential DoS via quadratic-time parsing in parselinktext...

CVE-2026-54769 Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

Langroid is a framework for building large-language-model-powered applications. Versions prior to 0.65.2 are vulnerable to a critical Sandbox Escape leading to Remote Code Execution RCE in its TableChatAgent and VectorStore capabilities. When these agents evaluate LLM-generated tool messages with...

CVE-2026-54769

Langroid versions prior to 0.65.2 are affected by a critical Sandbox Escape leading to Remote Code Execution via incomplete mitigation in the TableChatAgent and VectorStore. The root cause is the use of eval() with an empty locals dict under full_eval=True, where builtins is not scrubbed from glo...

MAL-2026-10100 Malicious code in proxy-check-i (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2da390c130eb840eb129a5d43faf0a64a0f0f602070243613aa0e2f8ea8f6d04 The package advertises itself as a wrapper for a 'qsshd executable' but the bundled Go binary is a reverse-SSH daemon that grants a remote operator...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...

CVE-2026-55865 Python Liquid: Infinite loop when parsing malformed `{% case %}` tags

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.1, given a malformed % case % tag without an associated % when % or % else % block and no terminating % endcase % tag, Python Liquid hangs in an infinite loop at parse time because liquid.TokenStream.eof did not give...