Most recent entries from all

ALSA-2026:28247 — Important: python3.14 security, bug fix, and enhancement update

Affected: AlmaLinux:9: python3.14, AlmaLinux:9: python3.14-debug, AlmaLinux:9: python3.14-devel, AlmaLinux:9: python3.14-freethreading, AlmaLinux:9: python3.14-freethreading-debug, AlmaLinux:9: python3.14-freethreading-devel, AlmaLinux:9: python3.14-freethreading-idle, AlmaLinux:9: python3.14-freethreading-libs, AlmaLinux:9: python3.14-freethreading-test, AlmaLinux:9: python3.14-freethreading-tkinter and 4 more

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786) * python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:AlmaLinux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-13663

BELL-CVE-2026-6019

Affected: Alpaquita:stream: python3, BellSoft Hardened Containers:stream: python3

BIT-libpython-2026-6019 — BaseCookie.js_output() does not neutralize embedded characters

Affected: Bitnami: libpython

http.cookies.Morsel.js_output() returns an inline <script> snippet and only escapes " for JavaScript string context. It does not neutralize the HTML parser-sensitive sequence </script> inside the generated script element. Mitigation base64-encodes the cookie value to disallow escaping using cookie value.

certfr-2026-avi-0482 — Une vulnérabilité a été découverte dans CPython. Elle permet à un attaquant de provoquer un contournement de la politiq…

certfr-2026-avi-0482

EUVD-2026-326515

fkie_cve-2026-6019

GHSA-2755-2mm4-rm5c

msrc_CVE-2026-6019 — BaseCookie.js_output() does not neutralize embedded characters

msrc_CVE-2026-6019

OESA-2026-2269 — python3 security update

Affected: openEuler:24.03-LTS: python3

Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):

openSUSE-SU-2026:10647-1 — python310-3.10.20-6.1 on GA media

python310-3.10.20-6.1 on GA media

RHSA-2026:22952 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

RLSA-2026:28247 — Important: python3.14 security, bug fix, and enhancement update

Affected: Rocky Linux:9: python3.14

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [9.8.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-180642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

SUSE-SU-2026:1818-1 — Security update for python39

Security update for python39

UBUNTU-CVE-2026-6019

Affected: Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 13 more

WID-SEC-W-2026-2455 — Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.