SUSE: Security Advisory (SUSE-SU-2026:20992-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the UltraJSON programming language package in Python, related to integer overflow, allows attackers to trigger a service failure.

The vulnerability of the UltraJSON programming language package in Python is related to integer overflow. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the Python programming language-based UltraJSON package lies in the lack of memory release after the effective lifespan, which allows a malicious actor to trigger a service failure.

The vulnerability of the Python programming language-based UltraJSON package is related to the lack of memory release after the effective lifespan of the package. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

FreeBSD : Python -- configparser vulnerable to excessive CPU use (5ec4dcf6-3588-11f1-b51c-6dd25bec137b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5ec4dcf6-3588-11f1-b51c-6dd25bec137b advisory. Stan Ulbrych reports: configparser.RawConfigParser.OPTCRE,OPTCRENV regexes are vulnerable to quadratic...

MiracleLinux 9 : python3.9-3.9.25-3.el9_7.2 (AXSA:2026-419:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-419:03 advisory. python: Python: Command-line option injection in webbrowser.open via crafted URLs CVE-2026-4519 Tenable has extracted the preceding description block directly...

MAL-2026-2569 Malicious code in bloxy-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 943946978741dfa911109b549544e9c3fc70eb20bd14505039ea3d0f52625d77 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in bloxy-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 943946978741dfa911109b549544e9c3fc70eb20bd14505039ea3d0f52625d77 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2570 Malicious code in robase-app (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 596d80290905c61841be2afc4bb833850683b152c52f8e58bce3faa32afe7deb During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

web-pentest-tool

🛡️ AutoPenTest — Automated Penetration Testing Tool ⚠️ DI...

exploitdbsearch

exploitdbsearch Search Exploit-DB for vulnerabilities from th...

Webite-Security-Scanner

Webite-Security-Scanner A modular web...

OPENSUSE-SU-2026:10537-1 python311-biopython-1.87-1.1 on GA media

These are all security issues fixed in the python311-biopython-1.87-1.1 package on the GA media of openSUSE Tumbleweed...

Security update for python-Flask-HTTPAuth (moderate)

openSUSE Security Update: Security update for python-Flask-HTTPAuth Announcement ID: openSUSE-SU-2026:0122-1 Rating: moderate References: 1261355 Cross-References: CVE-2026-34531 Affected Products: openSUSE Backports SLE-15-SP7 An update that fixes one vulnerability is now available. Description:...

MAL-2026-2562 Malicious code in robase-fallback (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a90a9e6e638fef782e18c99b5ab69341776385c7c7e6000af01a6b0fd2c3b0b6 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

A flaw was found in Python. The webbrowser.open API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options,...

python: Python pkgutil.get_data(): Path Traversal via improper resource argument validation

A flaw was found in Python's pkgutil.getdata function, which is used to retrieve data from packages. This function did not properly validate the resource argument, allowing a local attacker to perform path traversal attacks. Path traversal enables an attacker to access files and directories store...

cpython: Header injection via newlines in data URL mediatype in Python

Missing newline filtering has been discovered in Python. User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype...

cpython: Incomplete control character validation in http.cookies

A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update, |= operator, and unpickling paths were not patched to resolve CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.jsoutput lacked the output...

cpython: wsgiref.headers.Headers allows header newline injection in Python

Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers...

cpython: Out-of-memory when loading Plist

A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations...