https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:02:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-358384 EUVD-2026-358384 https://cve.radiocsirt.org/vuln/euvd-2026-358384 https://cve.radiocsirt.org/vuln/fkie_cve-2026-52902 <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-52902 https://cve.radiocsirt.org/vuln/ghsa-g29c-rgq6-gxgj <p><strong>Affected:</strong> PyPI: awxkit</p> <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> <p><strong>Affected:</strong> PyPI: awxkit</p> <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> https://cve.radiocsirt.org/vuln/ghsa-g29c-rgq6-gxgj https://cve.radiocsirt.org/vuln/pysec-2026-3550 <p><strong>Affected:</strong> PyPI: awxkit</p> <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> <p><strong>Affected:</strong> PyPI: awxkit</p> <p>A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using &#34;awx --conf.format yaml import&#34;. This is a client-side vulnerability requiring user interaction.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3550 https://cve.radiocsirt.org/vuln/rhsa-2026:59135 <p>django: Django: Remote code execution via GeoDjango spatial lookups aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape awxkit: path traversal via YAML !include directive pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Arbitrary Code Execution via Joined Short Options Bypass gitpython: GitPython: Command Injection via Git option prefix abbreviation aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses awx: project archive extraction allows path traversal file writes awx: webhook status callback SSRF leaks the Git PAT awx: notification backends allow SSRF and credential leakage gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding GitPython: GitPython: Arbitrary file read via TagReference.create()</p> <p>django: Django: Remote code execution via GeoDjango spatial lookups aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens tmp: path Traversal via unsanitized prefix/postfix enables directory escape awxkit: path traversal via YAML !include directive pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values gitpython: GitPython: Environment variable exfiltration via attacker-controlled clone URL gitpython: GitPython: Arbitrary code execution via command injection due to unguarded Git options gitpython: GitPython: Arbitrary Code Execution via Joined Short Options Bypass gitpython: GitPython: Command Injection via Git option prefix abbreviation aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses awx: project archive extraction allows path traversal file writes awx: webhook status callback SSRF leaks the Git PAT awx: notification backends allow SSRF and credential leakage gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding GitPython: GitPython: Arbitrary file read via TagReference.create()</p> https://cve.radiocsirt.org/vuln/rhsa-2026:59135