https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T20:56:13.320360+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:23323 ALSA-2025:23323 — Moderate: python3.12 security update 2026-10-02T20:56:14.078729+00:00

Affected: AlmaLinux:9: python3.12, AlmaLinux:9: python3.12-debug, AlmaLinux:9: python3.12-devel, AlmaLinux:9: python3.12-idle, AlmaLinux:9: python3.12-libs, AlmaLinux:9: python3.12-test, AlmaLinux:9: python3.12-tkinter

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked (CVE-2025-8291)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-00313 bdu:2026-00313 2026-10-02T20:56:14.078823+00:00 bdu:2026-00313 https://cve.radiocsirt.org/vuln/bit-libpython-2025-8291 BIT-libpython-2025-8291 — ZIP64 End of Central Directory (EOCD) Locator record offset not checked 2026-10-02T20:56:14.078842+00:00

Affected: Bitnami: libpython

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.

Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0851 certfr-2025-avi-0851 — Une vulnérabilité a été découverte dans Python. Elle permet à un attaquant de provoquer un problème de sécurité non spé… 2026-10-02T20:56:14.078868+00:00 certfr-2025-avi-0851 https://cve.radiocsirt.org/vuln/cleanstart-2026-jy81919 Withdrawn: CLEANSTART-2026-JY81919 — Security fixes in python3 3.14.0-r0 2026-10-02T20:56:14.078884+00:00

Withdrawn by the publisher.

Affected: CleanStart: python3

Package python3 version 3.14.0-r0 fixes 1 vulnerabilities: CVE-2025-8291

 https://cve.radiocsirt.org/vuln/euvd-2026-343262 EUVD-2026-343262 2026-10-02T20:56:14.078904+00:00 EUVD-2026-343262 https://cve.radiocsirt.org/vuln/fkie_cve-2025-8291 fkie_cve-2025-8291 2026-10-02T20:56:14.078916+00:00

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.

Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

 https://cve.radiocsirt.org/vuln/ghsa-49g5-f6qw-8mm7 GHSA-49g5-f6qw-8mm7 2026-10-02T20:56:14.078940+00:00

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.

Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-8291 msrc_CVE-2025-8291 — ZIP64 End of Central Directory (EOCD) Locator record offset not checked 2026-10-02T20:56:14.078959+00:00 msrc_CVE-2025-8291 https://cve.radiocsirt.org/vuln/oesa-2025-2574 OESA-2025-2574 — python3 security update 2026-10-02T20:56:14.078975+00:00

Affected: openEuler:20.03-LTS-SP4: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment activation scripts (ie source venv/bin/activate ). This means that attacker-controlled virtual environments are able to run commands when the virtual environment is activated. Virtual environments which are not created by an attacker or which aren t activated before being used (ie ./venv/bin/python ) are not affected.(CVE-2024-9287)

The zipfile module in CPython would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value. This offset value was not used to locate the ZIP64 EOCD record; instead, the ZIP64 EOCD record was assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the zipfile module compared to other ZI…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15742-1 openSUSE-SU-2025:15742-1 — python312-3.12.12-2.1 on GA media 2026-10-02T20:56:14.079010+00:00

python312-3.12.12-2.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:0353 RHSA-2026:0353 — Red Hat Security Advisory: python3.12 security update 2026-10-02T20:56:14.079028+00:00

cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked

 https://cve.radiocsirt.org/vuln/suse-su-2025:21199-1 SUSE-SU-2025:21199-1 — Security update for python311 2026-10-02T20:56:14.079044+00:00

Security update for python311

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-8291 UBUNTU-CVE-2025-8291 2026-10-02T20:56:14.079059+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 8 more

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2230 WID-SEC-W-2025-2230 — Python (CPython Zipfile Module): Schwachstelle ermöglicht Manipulation von Dateien 2026-10-02T20:56:14.079103+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle im zipfile-Modul von CPython ausnutzen, um Dateien zu manipulieren.