py3.11-ambassador

6 results · Clear filters · Feed

• Medium 4.4
  CVE-2026-25645 Public exploit

  Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

  Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

  psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 25, 2026
• Medium 6.3
  CVE-2026-27199 Public exploit

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

  pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  Feb 21, 2026
• High 7.1
  CVE-2026-24049 Public exploit

  wheel Allows Arbitrary File Permission Modification via Path Traversal

  wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

  pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 22, 2026
• High 7.5
  CVE-2025-67221 Public exploit

  orjson does not limit recursion for deeply nested JSON documents

  The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

  kserve-storage-controller datadog-agent-7.72-core-integrations datadog-agent-7.73-core-integrations py3.10-ambassador Wolfi PyPI
  Jan 22, 2026
• High 7.7
  CVE-2025-47273 Public exploit

  setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

  setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in `PackageIndex` is present in setuptools prior to version 78.1.1. An attacker would be allowed to write files to ar…

  pypa setuptools kserve-storage-controller datadog-agent-7.77 Debian Ubuntu Azure Linux Wolfi PyPI
  May 17, 2025
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/http/httpproxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025