CVE-2026-2297
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so
CVSS
—
Sin CVSS
EPSS
0.2%
p12
KEV
—
Exploit Today
4
0-100
Publicado: 4 mar 2026 · Última mod.: 13 ago 2026 · CWE-668
0.2%EPSS · 30 días0.2%
2026-07-182026-08-15
The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.
- github.comhttps://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e
- github.comhttps://github.com/python/cpython/commit/69ddd9bb2cc4bd69b1565647c18659c6a789ccd9
- github.comhttps://github.com/python/cpython/commit/876858c9f65d9ab656c7fa639f268ce7856d89dd
- github.comhttps://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e
- github.comhttps://github.com/python/cpython/commit/c70adad78caeeea33f92f560ecb93331ca11bf66
- github.comhttps://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86
- github.comhttps://github.com/python/cpython/issues/145506
- github.comhttps://github.com/python/cpython/pull/145507
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/03/05/6
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-738439.6 CRÍ21.7%
——7OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.2dCVE-2026-727826.5 MED13.7%
——4Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 interpolate environment variables and secrets (via ${ENV_VAR} strings in the elementId parameter) into Twig templates before rendering, even when the Twig sandbox is enabled. An authenticated attacker with control panel access can render a malicious sandboxed Twig template and, using a blind error-based technique across many requests, incrementally leak arbitrary environment variables and secrets. These can be abused to forge sessions (via CRAFT_SECURITY_KEY), escalate privileges, and steal database, SMTP, API, or blob storage credentials. Fixed in 5.10.6 and 4.18.2.5dCVE-2026-72764—30.5%
——9n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected.5dCVE-2026-706065.9 MED5.3%
——2Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 40.10.6, 41.9.1, 42.5.1, and 43.0.0, when a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that use ProtocolResponse.url, omit ProtocolResponse.session, and rely on separate sessions to isolate content are affected. This issue is fixed in versions 40.10.6, 41.9.1, 42.5.1, and 43.0.0.11dCVE-2026-48499—15.1%
——5Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0.17dCVE-2026-674278.6 ALT26.9%
——8Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability policy denylist for env.get and env.load_dotenv and exfiltrate secrets through allowed modules. This issue is fixed in version 2.26.6.17d