cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73627 via jupyterlab (>=4.6.0, <=4.6.1)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73627 Source advisory: MEND:CVE-2026-73627...

cellmerge (>=0.1.0, <=0.1.1), jupyter-quant (2606.1.0) +4 more potentially affected by CVE-2026-73626 via jupyterlab (>=4.6.0, <=4.6.1)

jupyterlab PYPI version =4.6.0, =0.1.0, =1.2.0, =0.1.0, =0.1.1 - tiatoolbox 2.1.3 Source cves: CVE-2026-73626 Source advisory: MEND:CVE-2026-73626...

CVE-2026-73486 Flowise before 3.1.3 Code Injection via CSV Agent customReadCSV

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73486

Flowise before 3.1.3 contains a code injection vulnerability in the CSV Agent node's customReadCSV parameter that allows authenticated attackers to execute arbitrary Python code. The validator uses a static regex blocklist that can be bypassed through obfuscation techniques, enabling attackers to...

CVE-2026-73485

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73485 Flowise before 3.1.3 Remote Code Execution via Airtable Agent

Flowise before 3.1.3 contains a code injection vulnerability in the Airtable Agent node that allows unauthenticated attackers to execute arbitrary Python code by bypassing the pythonCodeValidator blocklist through obfuscation techniques. Attackers can send crafted prompts to a chatflow using the...

CVE-2026-73485

Flowise before version 3.1.3 contains a code injection vulnerability in the Airtable Agent node that lets unauthenticated attackers bypass the pythonCodeValidator blocklist via obfuscation and inject malicious Python code. The injected code can run in an unsandboxed pyodide environment with full ...

EUVD-2026-57800

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

CVE-2026-73484 Flowise before 3.1.3 Sandbox Escape via Pandas Methods

Flowise before 3.1.3 contains a sandbox escape vulnerability in pythonCodeValidator.ts that fails to block native Pandas DataFrame methods like tocsv, tojson, pipe, and query. Authenticated attackers can exploit this to exfiltrate uploaded CSV data or write arbitrary files to the server filesyste...

python: Python: Performance degradation in XML processing due to quadratic time complexity

A flaw was found in Python's xml.etree.ElementPath component. This vulnerability can lead to a denial of service DoS when processing specially crafted XML documents. Specifically, certain XPath index predicates used with functions like Element.findall and Element.iterfind can cause the processing...

python: Python tarfile module: Denial of Service via improper EOF handling in streaming mode

A flaw was found in the Python tarfile module. When processing a specially crafted tar archive opened in 'streaming mode' mode='r|', the module does not properly handle the end-of-file EOF condition. This can cause the tarfile module to enter an infinite loop, leading to a Denial of Service DoS f...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

RHSA-2026:54484 Red Hat Security Advisory: python-idna security update

Bulletin has no description...

RHSA-2026:54481 Red Hat Security Advisory: python-idna security update

Bulletin has no description...

RHSA-2026:54417 Red Hat Security Advisory: python-pillow security update

Bulletin has no description...

RHSA-2026:54290 Red Hat Security Advisory: python-idna security update

Bulletin has no description...

CLSA-2026-1786616091 TuxCare security update for django (1 CVE)

TuxCare rebuilt django to address 1 CVE. Fixed in 5.1.4.post2+tuxcare...

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...