https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:07:03.123110+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:28247 ALSA-2026:28247 — Important: python3.14 security, bug fix, and enhancement update 2026-10-02T22:07:03.478943+00:00

Affected: AlmaLinux:9: python3.14, AlmaLinux:9: python3.14-debug, AlmaLinux:9: python3.14-devel, AlmaLinux:9: python3.14-freethreading, AlmaLinux:9: python3.14-freethreading-debug, AlmaLinux:9: python3.14-freethreading-devel, AlmaLinux:9: python3.14-freethreading-idle, AlmaLinux:9: python3.14-freethreading-libs, AlmaLinux:9: python3.14-freethreading-test, AlmaLinux:9: python3.14-freethreading-tkinter and 4 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-13663 bdu:2026-13663 2026-10-02T22:07:03.479037+00:00 bdu:2026-13663 https://cve.radiocsirt.org/vuln/bell-cve-2026-6019 BELL-CVE-2026-6019 2026-10-02T22:07:03.479055+00:00

Affected: Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3

 https://cve.radiocsirt.org/vuln/bit-libpython-2026-6019 BIT-libpython-2026-6019 — BaseCookie.js_output() does not neutralize embedded characters 2026-10-02T22:07:03.479075+00:00

Affected: Bitnami: libpython

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0482 certfr-2026-avi-0482 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un contournement de la politiq… 2026-10-02T22:07:03.479097+00:00 certfr-2026-avi-0482 https://cve.radiocsirt.org/vuln/euvd-2026-326515 EUVD-2026-326515 2026-10-02T22:07:03.479112+00:00 EUVD-2026-326515 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6019 fkie_cve-2026-6019 2026-10-02T22:07:03.479122+00:00

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

 https://cve.radiocsirt.org/vuln/ghsa-2755-2mm4-rm5c GHSA-2755-2mm4-rm5c 2026-10-02T22:07:03.479144+00:00

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-6019 msrc_CVE-2026-6019 — BaseCookie.js_output() does not neutralize embedded characters 2026-10-02T22:07:03.479158+00:00 msrc_CVE-2026-6019 https://cve.radiocsirt.org/vuln/oesa-2026-2269 OESA-2026-2269 — python3 security update 2026-10-02T22:07:03.479173+00:00

Affected: openEuler:24.03-LTS: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

http.cookies.Morsel.js_output() returns an inline &lt;script&gt; snippet and only escapes &quot; for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence &lt;/script&gt; inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.(CVE-2026-6019)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10647-1 openSUSE-SU-2026:10647-1 — python310-3.10.20-6.1 on GA media 2026-10-02T22:07:03.479198+00:00

python310-3.10.20-6.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:22952 RHSA-2026:22952 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T22:07:03.479215+00:00

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

 https://cve.radiocsirt.org/vuln/rlsa-2026:28247 RLSA-2026:28247 — Important: python3.14 security, bug fix, and enhancement update 2026-10-02T22:07:03.479230+00:00

Affected: Rocky Linux:9: python3.14

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/suse-su-2026:1818-1 SUSE-SU-2026:1818-1 — Security update for python39 2026-10-02T22:07:03.479279+00:00

Security update for python39

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-6019 UBUNTU-CVE-2026-6019 2026-10-02T22:07:03.479299+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 13 more

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2455 WID-SEC-W-2026-2455 — Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen 2026-10-02T22:07:03.479348+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.