Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

SummaryProblem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. DetailsIn the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

twisted.web has disordered HTTP pipeline response

SummaryThe HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC0. Start a fresh Debian container:shdocker run --workdir /repro --rm -it debian:bookworm-slim1. Install twisted and its dependencies:shap...

PYSEC-2026-1992 twisted.web has disordered HTTP pipeline response

Summary The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC 0. Start a fresh Debian container: sh docker run --workdir /repro --rm -it debian:bookworm-slim 1. Install twisted and its dependencies...

OpaMiddleware does not filter HTTP OPTIONS requests

SummaryHTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application.The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...

PYSEC-2026-1361 OpaMiddleware does not filter HTTP OPTIONS requests

Summary HTTP OPTIONS requests are always allowed by OpaMiddleware, even when they lack authentication, and are passed through directly to the application. The maintainer uncertain whether this should be classed as a "bug" or "security issue" – but is erring on the side of "security issue" as an...

golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses

A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak p...

RLSA-2026:34109 Important: httpd security, bug fix, and enhancement update

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: incomplete fix for CVE-2023-38709 CVE-2024-42516 httpd: NULL pointer dereference via specially crafted request CVE-2026-29169 httpd: Apache HTTP Server: Heap-based Buffer...

gdshechka (2.4.0) potentially affected by CVE-2024-35195 via requests (0.14.2)

requests PYPI version 0.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - gdshechka 2.4.0 Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

callllm (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-35195 via requests (0.13.7)

requests PYPI version 0.13.7 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - callllm =0.1.0, =0.1.1 Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

hoard (1.1.1), maxipago-sdk (>=1.0.0, <=1.0.4) potentially affected by CVE-2024-35195 via requests (1.1.0)

requests PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - hoard 1.1.1 - maxipago-sdk =1.0.0, =1.0.4 Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

128autograder (>=5.0.1, <=6.0.0rc4), 128autograder-python (6.0.0rc1) +10506 more potentially affected by CVE-2024-35195 via requests (>=2.0.0, <=2.31.0)

requests PYPI version =2.0.0, =5.0.1, =0.0.1a0, =0.1.1001, =0.1.0, =0.0.2, =0.0.5, =0.1.0, =0.1.0, =0.1.8 - a3m 0.1.0 and more Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

tinyblog (>=0.3.0, <=0.5.2) potentially affected by CVE-2024-35195 via requests (1.2.0)

requests PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - tinyblog =0.3.0, =0.5.2 Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

mezzanine (>=3.0.0, <=3.0.4) potentially affected by CVE-2024-35195 via requests (1.2.3)

requests PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on requests and may be impacted: - mezzanine =3.0.0, =3.0.4 Source cves: CVE-2024-35195 Source advisory: OSV:PYSEC-2026-1873...

Requests `Session` object does not verify requests after making first request with verify=False

When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later.This occurs because the underlying connection is reused...

PYSEC-2026-1419 gradio Server-Side Request Forgery vulnerability

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

cvgen (>=0.1.0, <=0.4.0), fastapi (>=0.21.0, <=0.23.0) +1 more potentially affected by CVE-2024-3772 via pydantic (0.25.0)

pydantic PYPI version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - cvgen =0.1.0, =0.21.0, =0.1.0, =0.1.1 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...

PYSEC-2026-1676 Mobile Security Framework (MobSF) vulnerable to SSRF in firebase database check

Impact What kind of vulnerability is it? Who is impacted? SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s infrastructure. When malicious app is uploaded to Static analyzer, it is possib...

PYSEC-2026-1494 Kinto Attachment's attachments can be replaced on read-only records

Impact The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket. And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request...

fonttools XML External Entity Injection (XXE) Vulnerability

SummaryAs of fonttools=4.28.2 the subsetting module has a XML External Entity Injection XXE vulnerability which allows an attacker to resolve arbitrary entities when a candidate font OT-SVG fonts, which contains a SVG table, is parsed. This allows attackers to include arbitrary files from the...