https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 10:03:39 +0000 https://cve.radiocsirt.org/vuln/bit-libpython-2026-87910 <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> <p><strong>Affected:</strong> Bitnami: libpython</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> https://cve.radiocsirt.org/vuln/bit-libpython-2026-87910 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1167 certfr-2026-avi-1167 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1167 https://cve.radiocsirt.org/vuln/euvd-2026-382002 EUVD-2026-382002 https://cve.radiocsirt.org/vuln/euvd-2026-382002 https://cve.radiocsirt.org/vuln/fkie_cve-2026-87910 <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-87910 https://cve.radiocsirt.org/vuln/ghsa-rj44-3777-mh5x <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> https://cve.radiocsirt.org/vuln/ghsa-rj44-3777-mh5x https://cve.radiocsirt.org/vuln/msrc_cve-2026-87910 msrc_CVE-2026-87910 https://cve.radiocsirt.org/vuln/msrc_cve-2026-87910 https://cve.radiocsirt.org/vuln/oesa-2026-4009 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)</p> <p>The &amp;qu…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python3</p> <p>Python combines remarkable power with very clear syntax. It has modules, classes, exceptions, very high level dynamic data types, and dynamic typing. There are interfaces to many system calls and libraries, as well as to various windowing systems. New built-in modules are easily written in C or C++ (or other languages, depending on the chosen implementation). Python is also usable as an extension language for applications written in other languages that need easy-to-use scripting or automation interfaces. Security Fix(es):</p> <p>The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.(CVE-2026-15806)</p> <p>The &amp;qu…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4009 https://cve.radiocsirt.org/vuln/rhsa-2026:67572 <p>python: Python unicodedata: Denial of Service due to excessive CPU consumption python: Python/Expat: Denial of Service via crafted XML document python: Python: FTP connection redirection via ftpcp() function bypass python: Python: Denial of Service via out-of-bounds write in BZ2 decompression python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers python: Python tarfile module: Security filter bypass allows arbitrary file write</p> <p>python: Python unicodedata: Denial of Service due to excessive CPU consumption python: Python/Expat: Denial of Service via crafted XML document python: Python: FTP connection redirection via ftpcp() function bypass python: Python: Denial of Service via out-of-bounds write in BZ2 decompression python: Python: Privilege escalation due to insecure VPATH handling in Windows legacy installers python: Python tarfile module: Security filter bypass allows arbitrary file write</p> https://cve.radiocsirt.org/vuln/rhsa-2026:67572 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87910 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 11 more</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python2.7, Ubuntu:Pro:14.04:LTS: python3.4, Ubuntu:Pro:14.04:LTS: python3.5, Ubuntu:Pro:16.04:LTS: python2.7, Ubuntu:Pro:16.04:LTS: python3.5, Ubuntu:Pro:18.04:LTS: python2.7, Ubuntu:Pro:18.04:LTS: python3.6, Ubuntu:Pro:18.04:LTS: python3.7, Ubuntu:Pro:18.04:LTS: python3.8, Ubuntu:Pro:20.04:LTS: python3.8 and 11 more</p> <p>When tarfile extracts a link on a system that doesn&#39;t support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was ignored. Instead, the member should be skipped if either call returns None.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-87910 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3335 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in CPython ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in CPython ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3335