NewStart CGSL MAIN 7.02 : python3.11 Vulnerability (NS-SA-2026-0034)

The remote NewStart CGSL host, running version MAIN 7.02, has python3.11 packages installed that are affected by a vulnerability: - There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration APIs. The tar implementation would process tar archives with...

Fedora 42 : python3.6 (2026-156169f944)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-156169f944 advisory. Security fix for CVE-2026-4519. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 44 : maturin / python-fastar / python-uv-build / rust-astral-tokio-tar / etc (2026-e22a7dbf2d)

The remote Fedora 44 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-e22a7dbf2d advisory. Update rust-astral-tokio-tar to 0.6.0, fixing CVE-2026-32766. Update rust-tar to 0.4.45, fixing CVE-2026-33056. Update rust-nix to 0.31.2. Update uv...

Fedora 44 : python3.13 (2026-742bf8c12d)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-742bf8c12d advisory. Security fix for CVE-2026-4519. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Security update for python-orjson (moderate)

openSUSE security update: security update for python-orjson ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20407-1 Rating: moderate References: bsc1257121 Cross-References: CVE-2025-67221 CVSS scores: CVE-2025-67221 SUSE : 5.9...

Security update for python-tornado6 (important)

openSUSE security update: security update for python-tornado6 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20406-1 Rating: important References: bsc1259553 bsc1259630 Cross-References: CVE-2026-31958 CVSS scores: CVE-2026-31958 SUSE : 7.5...

python311-jsonpath-ng-1.8.0-1.1 on GA media (moderate)

python311-jsonpath-ng-1.8.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10418-1 Rating: moderate Cross-References: CVE-2025-56005 CVSS scores: CVE-2025-56005 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVE-2025-56005 SUSE : 8.5...

python311-deepdiff-8.6.2-1.1 on GA media (moderate)

python311-deepdiff-8.6.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:10417-1 Rating: moderate Cross-References: CVE-2026-33155 CVSS scores: CVE-2026-33155 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-33155 SUSE : 8.7...

Security update for python-pyOpenSSL (important)

openSUSE security update: security update for python-pyopenssl ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20419-1 Rating: important References: bsc1259804 bsc1259808 Cross-References: CVE-2026-27448 CVE-2026-27459 CVSS scores: CVE-2026-27448 SU...

python311-intake-2.0.9-1.1 on GA media (moderate)

python311-intake-2.0.9-1.1 on GA media Announcement ID: openSUSE-SU-2026:10426-1 Rating: moderate Cross-References: CVE-2026-33310 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

AZL-80975 CVE-2026-33936 affecting package python-ecdsa for versions less than 0.19.2-1

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Prior to version 0.19.2, an issue in the low-level D...

CVE-2026-33936

CVE-2026-33936 affects the Python package python-ecdsa (pre-0.19.2). A flaw in the low-level DER parsing (remove_octet_string) can cause generated truncated DER inputs to be accepted, allowing SigningKey.from_der() to raise an internal IndexError instead of rejecting malformed data, potentially c...

CVE-2026-33936 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Prior to version 0.19.2, an issue in the low-level D...

CVE-2026-33936 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Prior to version 0.19.2, an issue in the low-level D...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through the Agentic Assistant validation process. An attacker can execute arbitrary server-side Python code by supplying input that causes the assistant to return malicious component code, which is then...

PYSEC-2026-82

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the...

PYSEC-2026-82

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the...

CVE-2026-33873 Langflow has Authenticated Code Execution in Agentic Assistant Validation

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the...

CVE-2026-33873

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Langflow executes LLM-generated Python code during its validation phase. Although this phase appears intended to validate generated component code, the...

Arbitrary Code Injection

Overview smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Injection through the LocalPythonExecutor in the localpythonexecutor.py component. An...