https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:43:57.598356+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bell-cve-2026-82049 BELL-CVE-2026-82049 2026-10-02T18:43:57.843126+00:00

Affected: Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3

 https://cve.radiocsirt.org/vuln/bit-libpython-2026-82049 BIT-libpython-2026-82049 — tarfile extraction filters allow file modification and content disclosure via hard link to symlink 2026-10-02T18:43:57.843185+00:00

Affected: Bitnami: libpython

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1167 certfr-2026-avi-1167 — De multiples vulnérabilités ont été découvertes dans Python. Certaines d'entre elles permettent à un attaquant de provo… 2026-10-02T18:43:57.843247+00:00 certfr-2026-avi-1167 https://cve.radiocsirt.org/vuln/euvd-2026-382003 EUVD-2026-382003 2026-10-02T18:43:57.843267+00:00 EUVD-2026-382003 https://cve.radiocsirt.org/vuln/fkie_cve-2026-82049 fkie_cve-2026-82049 2026-10-02T18:43:57.843280+00:00

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

 https://cve.radiocsirt.org/vuln/ghsa-ghff-gcpf-9r9p GHSA-ghff-gcpf-9r9p 2026-10-02T18:43:57.843302+00:00

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-82049 msrc_CVE-2026-82049 — tarfile extraction filters allow file modification and content disclosure via hard link to symlink 2026-10-02T18:43:57.843317+00:00 msrc_CVE-2026-82049 https://cve.radiocsirt.org/vuln/oesa-2026-4009 OESA-2026-4009 — python3 security update 2026-10-02T18:43:57.843333+00:00

Affected: openEuler:24.03-LTS-SP1: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)

The &qu…

 https://cve.radiocsirt.org/vuln/rhsa-2026:65505 RHSA-2026:65505 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-02T18:43:57.843376+00:00

python: Python: Information disclosure due to incorrect URL scheme matching python: Python stringprep module: Incorrect domain name processing breaks IDNA interoperability python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination python: Python tarfile module: File modification and content disclosure via crafted archives

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-82049 UBUNTU-CVE-2026-82049 2026-10-02T18:43:57.843397+00:00

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 11 more

In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification time of a file outside the destination directory, or expose the contents of that file within the extracted tree.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3367 WID-SEC-W-2026-3367 — Python: Schwachstelle ermöglicht Manipulation und Offenlegung von Daten 2026-10-02T18:43:57.843443+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Python ausnutzen, um Daten zu manipulieren oder offenzulegen.