# SUSE-SU-2026:4754-1: Security update for 2 packages SUSE-SU-2026:4754-1, released November 7, 2026, fixes 26 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4754-1 - Platform: Linux - Released: Nov 7, 2026 - Priority: High (Closes CVE-2026-11940, high severity) - CVEs: 26, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4754-1 ## Applies to | Product | Release | Fixed in | |---|---|---| | [python3](https://patchblox.com/security/data/product/linux/python3.md) | sles 15.6 | 3.6.15-150300.10.129.1 | | [python3](https://patchblox.com/security/data/product/linux/python3.md) | sles 15.7 | 3.6.15-150300.10.129.1 | | [python3-core](https://patchblox.com/security/data/product/linux/python3-core.md) | sles 15.6 | 3.6.15-150300.10.129.1 | | [python3-core](https://patchblox.com/security/data/product/linux/python3-core.md) | sles 15.7 | 3.6.15-150300.10.129.1 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-11940](https://patchblox.com/security/data/cve/CVE-2026-11940.md) | High | tarfile extraction filter bypass allows escaping the destination directory | 7.8 | 0.0075 | | | [CVE-2026-4224](https://patchblox.com/security/data/cve/CVE-2026-4224.md) | High | Stack overflow parsing XML with deeply nested DTD content models | 8.1 | 0.0072 | | | [CVE-2026-11972](https://patchblox.com/security/data/cve/CVE-2026-11972.md) | High | tarfile opened in streaming mode mishandles EOF | 8.2 | 0.0072 | | | [CVE-2026-7210](https://patchblox.com/security/data/cve/CVE-2026-7210.md) | High | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 7.5 | 0.0067 | | | [CVE-2026-15308](https://patchblox.com/security/data/cve/CVE-2026-15308.md) | High | Incremental HTMLParser feed() allows CPU-exhaustion DoS via repeated unterminated markup declarations | 8.7 | 0.0064 | | | [CVE-2026-9669](https://patchblox.com/security/data/cve/CVE-2026-9669.md) | High | bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow | 8.2 | 0.0043 | | | [CVE-2026-8643](https://patchblox.com/security/data/cve/CVE-2026-8643.md) | High | pip can extract console_scripts and gui_scripts outside installation directory | 8.0 | 0.0032 | | | [CVE-2026-6019](https://patchblox.com/security/data/cve/CVE-2026-6019.md) | High | BaseCookie.js_output() does not neutralize embedded characters | 7.1 | 0.0021 | | | [CVE-2026-82049](https://patchblox.com/security/data/cve/CVE-2026-82049.md) | High | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | 8.4 | 0.0019 | | | [CVE-2026-17084](https://patchblox.com/security/data/cve/CVE-2026-17084.md) | Routine | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 6.0 | 0.0073 | | | [CVE-2026-7774](https://patchblox.com/security/data/cve/CVE-2026-7774.md) | Routine | tarfile.data_filter path traversal bypass allows writing outside the extraction directory | 6.9 | 0.0060 | | | [CVE-2026-15806](https://patchblox.com/security/data/cve/CVE-2026-15806.md) | Routine | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 6.0 | 0.0053 | | | [CVE-2026-15310](https://patchblox.com/security/data/cve/CVE-2026-15310.md) | Routine | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | 2.1 | 0.0053 | | | [CVE-2026-3276](https://patchblox.com/security/data/cve/CVE-2026-3276.md) | Routine | Potential DoS via quadratic complexity in unicodedata.normalize() | 6.3 | 0.0049 | | | [CVE-2026-4360](https://patchblox.com/security/data/cve/CVE-2026-4360.md) | Routine | Tarfile.extract() doesn't fully respect filter parameter | 5.3 | 0.0048 | | | [CVE-2026-19672](https://patchblox.com/security/data/cve/CVE-2026-19672.md) | Routine | tarfile extraction filter bypass allows creation of directories outside the destination | 6.3 | 0.0047 | | | [CVE-2026-8328](https://patchblox.com/security/data/cve/CVE-2026-8328.md) | Routine | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address | 5.9 | 0.0046 | | | [CVE-2026-1703](https://patchblox.com/security/data/cve/CVE-2026-1703.md) | Routine | Limited path traversal when installing wheel archives | n/a | 0.0044 | | | [CVE-2026-6879](https://patchblox.com/security/data/cve/CVE-2026-6879.md) | Routine | Quadratic Behavior in xml.etree.ElementPath Index Predicates | 2.0 | 0.0036 | | | [CVE-2026-13346](https://patchblox.com/security/data/cve/CVE-2026-13346.md) | Routine | python3: This update for python3 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of li... | 6.5 | 0.0029 | | | [CVE-2026-3479](https://patchblox.com/security/data/cve/CVE-2026-3479.md) | Routine | pkgutil.get_data() does not enforce documented restrictions | 0.0 | 0.0025 | | | [CVE-2026-3446](https://patchblox.com/security/data/cve/CVE-2026-3446.md) | Routine | Base64 decoding stops at first padded quad by default | 6.0 | 0.0018 | | | [CVE-2026-3219](https://patchblox.com/security/data/cve/CVE-2026-3219.md) | Routine | pip doesn't reject concatenated ZIP and tar archives | n/a | 0.0014 | | | [CVE-2026-6357](https://patchblox.com/security/data/cve/CVE-2026-6357.md) | Routine | pip self-update functionality can import newly installed modules after wheel installation | n/a | 0.0014 | | | [CVE-2026-0864](https://patchblox.com/security/data/cve/CVE-2026-0864.md) | Routine | Configuration Injection via Carriage Return (\r) in write() method | 5.5 | 0.0013 | | | [CVE-2026-18503](https://patchblox.com/security/data/cve/CVE-2026-18503.md) | Routine | Super-linear CPU usage for unbounded input to csv.Sniffer.sniff() | 2.4 | 0.0012 | | --- Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.