Most recent entries from all

EUVD-2026-337352

2026-10-03T00:00:14.704400+00:00

EUVD-2026-337352

fkie_cve-2026-32640

2026-10-03T00:00:14.704444+00:00

SimpleEval is a library for adding evaluatable expressions into python projects. Prior to 1.0.5, objects (including modules) can leak dangerous modules through to direct access inside the sandbox. If the objects you've passed in as names to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call. The latest version 1.0.5 has this issue fixed. This vulnerability is fixed in 1.0.5.

GHSA-44vg-5wv2-h2hg — SimpleEval: Objects (including modules) can leak dangerous modules through to direct access inside the sandbox

2026-10-03T00:00:14.704482+00:00

Affected: PyPI: simpleeval

### Impact If the objects passed in as `names` to SimpleEval have modules or other disallowed / dangerous objects available as attrs. Additionally, dangerous functions or modules could be accessed by passing them as callbacks to other safe functions to call.

Examples (found by @ByamB4):

Any module where non-underscore attribute chains reach os or sys: - os.path, pathlib, shutil, glob (direct .os / .sys attributes) - statistics (has .sys) - numpy (has .ctypeslib.os and .f2py.sys) - urllib.parse (has .warnings.sys)

### Patches The latest version 1.0.5 has this issue fixed.

### Workarounds Don't pass in objects or modules which have direct attributes to potentially dangerous items. Use a wrapper to wrap the potentially vulnerable items (See the ModuleWrapper in version 1.0.5)

openSUSE-SU-2026:10373-1 — python311-simpleeval-1.0.5-1.1 on GA media

2026-10-03T00:00:14.704516+00:00

python311-simpleeval-1.0.5-1.1 on GA media

PYSEC-2026-132

2026-10-03T00:00:14.704534+00:00

Affected: PyPI: simpleeval

RHSA-2026:10184 — Red Hat Security Advisory: RHOAI 2.25.5 - Red Hat OpenShift AI

2026-10-03T00:00:14.704556+00:00

vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…

UBUNTU-CVE-2026-32640

2026-10-03T00:00:14.704671+00:00

Affected: Ubuntu:Pro:16.04:LTS: simpleeval, Ubuntu:Pro:18.04:LTS: simpleeval, Ubuntu:Pro:20.04:LTS: simpleeval, Ubuntu:Pro:22.04:LTS: simpleeval, Ubuntu:24.04:LTS: simpleeval, Ubuntu:25.10: simpleeval, Ubuntu:26.04:LTS: simpleeval