PatchFirst · Latest vulnerabilities
Vulnerability published for python-doc in the last 30 days: 1. Listed in the KEV catalogue: 0.
Vulnerabilities: 6
This update for python, python-base, python-doc fixes the following issue: - CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file modification and content disclosure (bsc#1280459).
This update for python fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the `configparser` module is used (bsc#1269066). - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: python-pip: pip doesn't reject concatenated ZIP (bsc#1262467). - CVE-2026-3276: quadratic complexity in `unicodedata.normalize()` can lead to DoS when processing specially crafted Unicode input (bsc#1267581). - CVE-2026-6357: pip self-update functionality can imp
This update for python, python-base, python-doc fixes the following issues Security fixes: - CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously crafted wheel archives (bsc#1257599). - CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429). - CVE-2026-3446: Base64 decoding stops at first padded quad by default (bsc#1261970). - CVE-2026-4786: Incomplete mitigation of %action expansion for command injection to webbrowser.open() (bsc#1262319). - CVE-2026-6019: BaseCookie.js_output() does not neutralize embedded characters (bsc#1262654). - CVE-2026-6100: Arbitrary code
This update for python fixes the following issues: - CVE-2025-13462: incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined (bsc#1259611). - CVE-2026-3479: improper resource argument validation can allow path traversal (bsc#1259989). - CVE-2026-3644: incomplete control character validation in `http.cookies` (bsc#1259734). - CVE-2026-4224: C stack overflow when parsing XML with deeply nested DTD content models (bsc#1259735). - CVE-2026-4519: leading dashes in URLs are accepted by the `webbrowser.open()` API and allow for web browser command line option injection (bsc#1260026).
This update for python fixes the following issue: - CVE-2026-1299: header injection when an email is serialized due to improper newline quoting in `BytesGenerator` (bsc#1257181).
This update for python fixes the following issues: - CVE-2025-6075: Fixed performance degradation when using os.path.expandvars() (bsc#1252974). - CVE-2026-0672: Fixed a HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel. (bsc#1257031) - CVE-2026-0865: Fixed a bug where a user-controlled header containing newlines can allow injecting HTTP headers. (bsc#1257042) - CVE-2025-15366: Fixed a bug wherer a user-controlled command can allow additional commands injected using newlines. (bsc#1257044) - CVE-2025-15367: Fixed control characters which may allow the injection of additional commands. (bsc#
Check your installed stack and versions against the current vulnerability feeds.