py3.12-ambassador

3 results · Clear filters · Feed

• Medium 4.4
  CVE-2026-25645 Public exploit

  Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

  Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is…

  psf requests open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 25, 2026
• Medium 6.3
  CVE-2026-27199 Public exploit

  Werkzeug safe_join() allows Windows special device names

  Werkzeug is a comprehensive WSGI web application library. Versions 3.1.5 and below, the safe_join function allows Windows device names as filenames if preceded by other path segments. This was previously reported as GHSA-hgf8-39gv-g3f2, but the added filterin…

  pallets werkzeug open-webui airflow-3 Alpine Wolfi PyPI
  Feb 21, 2026
• Medium 4.4
  CVE-2025-22870 Public exploit

  HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

  Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be prox…

  Go standard library golang.org/x/net net/http golang.org/x/net/http/httpproxy Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 12, 2025