Search: “Python”

4 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI safety & security 16 Exploit / PoC 13 Malware 6 AI tools & infra 5 AI research 5 Vulnerability 4 Model release 4 Research 4 Phishing & fraud 3 Threat actor 3 Advisory 2 AI industry 2 Tools 1

SeverityAll critical 5 high 14 medium 22 low 1 info 26

Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to symlink

Python discloses CVE-2026-82049: tarfile extraction filters can be bypassed via hard links to symlinks, enabling file modification and content disclosure.

Stan Ulbrych disclosed CVE-2026-82049 on the Python security-announce list, forwarded to oss-security by Alan Coopersmith. The flaw affects CPython's tarfile extraction filters, which can allow file modification and content disclosure when archives contain a hard link to a symlink. Extraction-filter misuse can therefore bypass intended protections during archive unpacking.

oss-securitySep 14, 18:00 UTC · 1d agoVulnerability CVE-2026-82049

CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration

Apache Airflow Kafka provider 1.15.0 before 2.0.0 resolves unvalidated dotted-path strings into Python callables, enabling Scheduler RCE.

CVE-2026-86792 (moderate) affects apache-airflow-providers-apache-kafka versions 1.15.0 before 2.0.0. Dotted-path strings in a Kafka connection's extra field are resolved into Python callables via import_string with no allowlist, then invoked by the confluent-kafka client. This allows someone with Kafka connection configuration access to achieve remote code execution on the Airflow Scheduler; upgrading to 2.0.0 resolves it.

oss-securitySep 15, 20:04 UTC · 15h agoVulnerability CVE-2026-867921

CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None

CPython CVE-2026-87910: tarfile's hardlink fallback ignores custom extraction filters that reject entries via None, rated MEDIUM severity.

Petr Viktorin disclosed CVE-2026-87910 on the CPython security-announce list, rated MEDIUM severity. The flaw is in the tarfile module: when a custom extraction filter rejects an entry by returning None, the hardlink fallback path ignores the rejection. The posted excerpt did not include affected versions or patch details.

oss-securitySep 11, 19:20 UTC · 4d agoVulnerability CVE-2026-879101

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker Newsupdated Sep 10, 12:56 UTC · 5d agofirst Sep 10, 07:12 UTC · 6d agoVulnerability in the wild 4 sources CVE-2026-59821 CVE-2026-59822 CVE-2026-42271+2 CVEs