cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

CVE-2026-69247

### Summary `pkcs7_decrypt_der`, `pkcs7_decrypt_pem`, and `pkcs7_decrypt_smime` reported the outcome of decrypting a `R

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

CVE-2026-69244

### Summary An out-of-bounds heap read could occur in the C response parser while building an error message for a malfo

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP: HTTP request smuggling via WebSocket upgrade

CVE-2026-69243

### Summary The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. ### Impact

历史摘要 · 未重新核验 · GitHub Advisory

AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate

CVE-2026-59881

### Summary The client accepts and decompresses frames with the RSV1 bit set even when the `permessage-deflate` extensi

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count

## Summary `Commit.count()` forwards `**kwargs` into `rev_list` with **no** `check_unsafe_options` guard (the guard exis

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()

**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

**Target:** gitpython-developers/GitPython **Tested:** HEAD `07e80555` (2026-07-25), latest release 3.1.55, `git version

历史摘要 · 未重新核验 · GitHub Advisory

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

CVE-2026-54785

### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

CVE-2026-53502

The file_loader performs `unquote()` on the file path AFTER the `abspath() + startswith()` security check. An attacker c

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

CVE-2026-53505

### Summary Thumbor's `filters:proportion()` filter does not enforce an upper bound on `` and runs in the post-transform

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

CVE-2026-53504

### Summary The regular expression used to parse the `convolution` filter exhibits exponential-time backtracking for cer

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

CVE-2026-53503

### Summary Thumbor's `filters:convolution(, , )` filter passes the user-controlled `` value to a C extension (`thumbor/

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

CVE-2026-53501

# HMAC validation bypass via multiple `.replace()` calls when removing URL signature ## Summary Thumbor’s HMAC validat

历史摘要 · 未重新核验 · GitHub Advisory

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

CVE-2026-53500

## Summary The `ALLOWED_SOURCES` configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images

历史摘要 · 未重新核验 · GitHub Advisory

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

CVE-2026-12075

### Summary `nltk.pathsec` provides an SSRF filter that NLTK documents as a security control, blocking loopback, private

历史摘要 · 未重新核验 · GitHub Advisory

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

CVE-2026-12061

### Summary `ReviewsCorpusReader` extracts feature annotations of the form *label* followed by a bracketed signed digit

历史摘要 · 未重新核验 · GitHub Advisory

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

CVE-2026-12072

### Summary A path-traversal vulnerability in `NKJPCorpusReader` allows an attacker who can influence the `fileids

历史摘要 · 未重新核验 · GitHub Advisory

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

CVE-2026-12074

### Summary `FramenetCorpusReader.frame(name)` interpolates a caller-supplied frame name into an XML file path that is r

历史摘要 · 未重新核验 · GitHub Advisory

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

CVE-2026-54706

### Summary OnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serv

历史摘要 · 未重新核验 · GitHub Advisory

OnionShare Receive mode writes uploaded files even when file uploads are disabled

CVE-2026-54707

### Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode `disable_files` setting at the file upload si

历史摘要 · 未重新核验 · GitHub Advisory