https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:35:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-07193 bdu:2026-07193 https://cve.radiocsirt.org/vuln/bdu:2026-07193 https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69226 <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> <p><strong>Affected:</strong> Homebrew: aider</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> https://cve.radiocsirt.org/vuln/brew-aider-cve-2025-69226 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0224 https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-2</p> <p>Multiple security vulnerabilities affect the airflow-2 package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-an24336 https://cve.radiocsirt.org/vuln/euvd-2026-264984 EUVD-2026-264984 https://cve.radiocsirt.org/vuln/euvd-2026-264984 https://cve.radiocsirt.org/vuln/fkie_cve-2025-69226 <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-69226 https://cve.radiocsirt.org/vuln/ghsa-54jq-c3m8-4m76 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> https://cve.radiocsirt.org/vuln/ghsa-54jq-c3m8-4m76 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 <p>python311-aiohttp-3.13.3-1.1 on GA media</p> <p>python311-aiohttp-3.13.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10025-1 https://cve.radiocsirt.org/vuln/pysec-2026-1097 <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> <p><strong>Affected:</strong> PyPI: aiohttp</p> <p>### Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components.</p> <p>### Impact If an application uses `web.static()` (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components.</p> <p>------</p> <p>Patch: https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e</p> https://cve.radiocsirt.org/vuln/pysec-2026-1097 https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 <p>Security update for python-aiohttp, python-Brotli</p> <p>Security update for python-aiohttp, python-Brotli</p> https://cve.radiocsirt.org/vuln/suse-su-2026:20425-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69226 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-aiohttp, Ubuntu:Pro:18.04:LTS: python-aiohttp, Ubuntu:Pro:22.04:LTS: python-aiohttp, Ubuntu:Pro:24.04:LTS: python-aiohttp, Ubuntu:25.10: python-aiohttp</p> <p>AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production deployments), it may be possible for an attacker to ascertain the existence of path components. This issue is fixed in version 3.13.3.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-69226