753 matches found
wheelaudit
wheelaudit Python Wheel 文件安全扫描器 — 在安装前扫描 .whl 文件中的安全问题。 受近期 Python wheel 处理相关 CVE 的启发： CVE-2026-24049 ：wheel 解包中的路径遍历可导致系统文件权限被篡改 CVE-2026-1703 ：pip 安装 wheel 归档时的路径遍历 Google GHSA-w97x-xxj5-gpjx ：Python wheel 中的 Zip 解析器差分漏洞 零依赖。单文件。Python 3.9+。 为什么？ pip-audit 检查你的包是否存在 已知 CVE 。wheelaudit 检查 wheel...
ROOT-APP-PYPI-CVE-2026-24049 CVE-2026-24049 in wheel - Patched by Root
Root has patched CVE-2026-24049 in the wheel package for Root:PyPI. Multiple fixed versions available...
CVE-2026-80589 block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...
CVE-2026-80589 block: stop the timeout timer when releasing a never added disk
In the Linux kernel, the following vulnerability has been resolved: block: stop the timeout timer when releasing a never added disk diskrelease undoes blkmqinitallocatedqueue for a disk whose probe failed before adddisk, but it only calls blkmqexitqueue. Nothing there stops q-timeout, and that...
EUVD-2026-66237
In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This change was largely...
PT-2026-82205
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-use-after-free issue exists in the block subsystem. The disk release function fails to stop the q-timeout timer when releasing a disk whose probe failed before add disk. This occu...
Astra Linux – Vulnerability in Wheel
A vulnerability was discovered in Python Packaging Authority PyPA Wheel 0.37.1 and earlier. This vulnerability allows remote attackers to cause a denial of service by using attacker-controlled input to the wheel cli...
SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...
SUSE-SU-2026:3635-1 Security update for python
This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...
SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2026:3601-1)
The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3601-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...
Security update for python3
This update for python3 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...
SUSE-SU-2026:3601-1 Security update for python3
This update for python3 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...
MiracleLinux 9 : python3.14-pip-25.2-3.el9_8.5 (AXSA:2026-1469:01)
The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1469:01 advisory. python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite CVE-2026-8643 Tenable has extracted the...
CVE-2026-47764
A flaw was found in pdm, a Python package and dependency manager. This vulnerability allows a remote attacker to write arbitrary files to a system by crafting a malicious Python 'wheel' package. The flaw occurs during the installation process, where a critical function responsible for writing fil...
CVE-2026-47764
Summary of CVE-2026-47764 (pdm) : A path-traversal vulnerability in wheel installation arises from InstallDestination.write_to_fs() in src/pdm/installers/installers.py, where a safe validation helper (_path_with_destdir()) was replaced with a bare os.path.join(), removing path validation. Version...
CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs
pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...
CVE-2026-18481
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...
CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft
Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...