https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:41:06.726057+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:19019 ALSA-2026:19019 — Important: python3.14 security update 2026-10-02T11:41:07.670369+00:00

Affected: AlmaLinux:10: python3.14, AlmaLinux:10: python3.14-debug, AlmaLinux:10: python3.14-devel, AlmaLinux:10: python3.14-freethreading, AlmaLinux:10: python3.14-freethreading-debug, AlmaLinux:10: python3.14-freethreading-devel, AlmaLinux:10: python3.14-freethreading-idle, AlmaLinux:10: python3.14-freethreading-libs, AlmaLinux:10: python3.14-freethreading-test, AlmaLinux:10: python3.14-freethreading-tkinter and 4 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865) * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297) * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644) * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224) * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519) * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502) * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100) * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-07233 bdu:2026-07233 2026-10-02T11:41:07.670514+00:00 bdu:2026-07233 https://cve.radiocsirt.org/vuln/bell-cve-2026-4519 BELL-CVE-2026-4519 2026-10-02T11:41:07.670535+00:00

Affected: Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0335 certfr-2026-avi-0335 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un contournement de la politiq… 2026-10-02T11:41:07.670563+00:00 certfr-2026-avi-0335 https://cve.radiocsirt.org/vuln/euvd-2026-351823 EUVD-2026-351823 2026-10-02T11:41:07.670580+00:00 EUVD-2026-351823 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4519 fkie_cve-2026-4519 2026-10-02T11:41:07.670592+00:00

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

 https://cve.radiocsirt.org/vuln/ghsa-rm92-fj5q-mpj5 GHSA-rm92-fj5q-mpj5 2026-10-02T11:41:07.670617+00:00

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-4519 msrc_CVE-2026-4519 — webbrowser.open() allows leading dashes in URLs 2026-10-02T11:41:07.670632+00:00 msrc_CVE-2026-4519 https://cve.radiocsirt.org/vuln/oesa-2026-1816 OESA-2026-1816 — python3 security update 2026-10-02T11:41:07.670649+00:00

Affected: openEuler:24.03-LTS-SP2: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.(CVE-2026-2297)

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().(CVE-2026-4519)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10477-1 openSUSE-SU-2026:10477-1 — python310-3.10.20-3.1 on GA media 2026-10-02T11:41:07.670678+00:00

python310-3.10.20-3.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:10065 RHSA-2026:10065 — Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update 2026-10-02T11:41:07.670698+00:00

libxslt: Processing web content may disclose sensitive information nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing net/url: Incorrect parsing of IPv6 host literals in net/url vim: Vim: Arbitrary code execution via 'helpfile' option processing nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin vim: Vim: Denial of service and information disclosure via crafted swap file nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files vim: Vim: Arbitrary code execution via command injection in glob() function

 https://cve.radiocsirt.org/vuln/rlsa-2026:19176 RLSA-2026:19176 — Important: python3.14 security update 2026-10-02T11:41:07.670750+00:00

Affected: Rocky Linux:9: python3.14

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:1206-1 SUSE-SU-2026:1206-1 — Security update for python 2026-10-02T11:41:07.670784+00:00

Security update for python

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-4519 UBUNTU-CVE-2026-4519 2026-10-02T11:41:07.670802+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:16.04:LTS: jython, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:18.04:LTS: jython, Ubuntu:Pro:18.04:LTS: python3.7 and 20 more

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0824 WID-SEC-W-2026-0824 — Python: Schwachstelle ermöglicht Codeausführung 2026-10-02T11:41:07.670860+00:00

Ein Angreifer kann eine Schwachstelle in Python ausnutzen, um beliebigen Programmcode auszuführen.