https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:32:15 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-4360 <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> <p><strong>Affected:</strong> Alpaquita:23: python3, Alpaquita:25: python3, Alpaquita:stream: python3, BellSoft Hardened Containers:23: python3, BellSoft Hardened Containers:25: python3, BellSoft Hardened Containers:stream: python3</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-4360 https://cve.radiocsirt.org/vuln/bit-libpython-2026-4360 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2026-4360 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0828 certfr-2026-avi-0828 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0828 https://cve.radiocsirt.org/vuln/euvd-2026-351824 EUVD-2026-351824 https://cve.radiocsirt.org/vuln/euvd-2026-351824 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4360 <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-4360 https://cve.radiocsirt.org/vuln/ghsa-gf2w-jqmq-fcm8 <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> https://cve.radiocsirt.org/vuln/ghsa-gf2w-jqmq-fcm8 https://cve.radiocsirt.org/vuln/msrc_cve-2026-4360 msrc_CVE-2026-4360 https://cve.radiocsirt.org/vuln/msrc_cve-2026-4360 https://cve.radiocsirt.org/vuln/oesa-2026-3180 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&amp;apos;data&amp;apos; to the extract() function.(CVE-2026-4360)</p> <p>`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The incremental HTML parser (html.parser.HTMLParser) allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.(CVE-2026-15308)</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&amp;apos;data&amp;apos; to the extract() function.(CVE-2026-4360)</p> <p>`xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding. Fully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.(CVE-2026-7210)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3180 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11426-1 <p>python310-3.10.20-8.1 on GA media</p> <p>python310-3.10.20-8.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11426-1 https://cve.radiocsirt.org/vuln/rhsa-2026:47892 <p>python: Python Tarfile: Unexpected file ownership when extracting hardlinks</p> <p>python: Python Tarfile: Unexpected file ownership when extracting hardlinks</p> https://cve.radiocsirt.org/vuln/rhsa-2026:47892 https://cve.radiocsirt.org/vuln/suse-su-2026:23159-1 <p>Security update for python313</p> <p>Security update for python313</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23159-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-4360 <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14, Ubuntu:26.04:LTS: python3.14</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> <p><strong>Affected:</strong> Ubuntu:22.04:LTS: python3.10, Ubuntu:24.04:LTS: python3.12, Ubuntu:25.10: python3.13, Ubuntu:25.10: python3.14, Ubuntu:26.04:LTS: python3.14</p> <p>In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks. An affected system that extracts content from untrusted tar files could end up writing files with an unexpected uid/gid despite the user passing filter=&#39;data&#39; to the extract() function.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-4360