https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:32:41 +0000 https://cve.radiocsirt.org/vuln/brew-ansible-lint-cve-2026-32274 <p><strong>Affected:</strong> Homebrew: ansible-lint</p> <p>### Impact</p> <p>Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.</p> <p>### Patches</p> <p>Fixed in Black 26.3.1.</p> <p>### Workarounds</p> <p>Do not allow untrusted user input into the value of the `--python-cell-magics` option.</p> <p><strong>Affected:</strong> Homebrew: ansible-lint</p> <p>### Impact</p> <p>Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.</p> <p>### Patches</p> <p>Fixed in Black 26.3.1.</p> <p>### Workarounds</p> <p>Do not allow untrusted user input into the value of the `--python-cell-magics` option.</p> https://cve.radiocsirt.org/vuln/brew-ansible-lint-cve-2026-32274 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-mi51590 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Package kserve-storage-controller version 0.19.0-r0 fixes 91 vulnerabilities: CVE-2024-12254, CVE-2024-12718, CVE-2024-6232, CVE-2024-7592, CVE-2024-9287...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kserve-storage-controller</p> <p>Package kserve-storage-controller version 0.19.0-r0 fixes 91 vulnerabilities: CVE-2024-12254, CVE-2024-12718, CVE-2024-6232, CVE-2024-7592, CVE-2024-9287...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-mi51590 https://cve.radiocsirt.org/vuln/euvd-2026-343972 EUVD-2026-343972 https://cve.radiocsirt.org/vuln/euvd-2026-343972 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32274 <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32274 https://cve.radiocsirt.org/vuln/ghsa-3936-cmfr-pm3m <p><strong>Affected:</strong> PyPI: black</p> <p>### Impact</p> <p>Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.</p> <p>### Patches</p> <p>Fixed in Black 26.3.1.</p> <p>### Workarounds</p> <p>Do not allow untrusted user input into the value of the `--python-cell-magics` option.</p> <p><strong>Affected:</strong> PyPI: black</p> <p>### Impact</p> <p>Black writes a cache file, the name of which is computed from various formatting options. The value of the `--python-cell-magics` option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations.</p> <p>### Patches</p> <p>Fixed in Black 26.3.1.</p> <p>### Workarounds</p> <p>Do not allow untrusted user input into the value of the `--python-cell-magics` option.</p> https://cve.radiocsirt.org/vuln/ghsa-3936-cmfr-pm3m https://cve.radiocsirt.org/vuln/oesa-2026-4064 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-black</p> <p>The uncompromising code formatter Security Fix(es):</p> <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.(CVE-2026-32274)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP3: python-black</p> <p>The uncompromising code formatter Security Fix(es):</p> <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.(CVE-2026-32274)</p> https://cve.radiocsirt.org/vuln/oesa-2026-4064 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10372-1 <p>python311-black-26.3.1-1.1 on GA media</p> <p>python311-black-26.3.1-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10372-1 https://cve.radiocsirt.org/vuln/pysec-2026-2121 <p><strong>Affected:</strong> PyPI: black</p> <p>Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> <p><strong>Affected:</strong> PyPI: black</p> <p>Black is the uncompromising Python code formatter. Prior to 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> https://cve.radiocsirt.org/vuln/pysec-2026-2121 https://cve.radiocsirt.org/vuln/rhsa-2026:10184 <p>vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…</p> <p>vllm: Server Side request forgery (SSRF) in MediaConnector feast: Feast: Remote Code Execution via insecure YAML deserialization openshift-ai: Trusty AI Grants All Authenticated users to list pods in any namespace nltk: Zip Slip Vulnerability in nltk Leading to Code Execution golang: net/url: Memory exhaustion in query parameter parsing in net/url golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion urllib3: urllib3 Streaming API improperly handles highly compressed data cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse aiohttp: AIOHTTP&#39;s HTTP Parser auto_decompress feature is vulnerable to zip bomb aiohttp: aiohttp: Denial of Service via specially crafted POST request aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request python-markdown: denial of service via malformed HTML-like sequences nltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function nltk: NLTK: Arbitrary file read via path traversal vulnerability io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files google-cloud-aiplatform: google-cloud-aiplatform: Arbitrary code execution via Stored Cross-Site Scripting (XSS) tensorflow: TensorFlow: Local privilege escalation via…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:10184 https://cve.radiocsirt.org/vuln/suse-su-2026:0900-1 <p>Security update for python-black</p> <p>Security update for python-black</p> https://cve.radiocsirt.org/vuln/suse-su-2026:0900-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32274 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: black, Ubuntu:22.04:LTS: black, Ubuntu:24.04:LTS: black, Ubuntu:25.10: black, Ubuntu:26.04:LTS: black</p> <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: black, Ubuntu:22.04:LTS: black, Ubuntu:24.04:LTS: black, Ubuntu:25.10: black, Ubuntu:26.04:LTS: black</p> <p>Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the filename without sanitization, which allowed an attacker who controls the value of this argument to write cache files to arbitrary file system locations. Fixed in Black 26.3.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-32274 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3046 <p>Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3046