https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-08T17:31:40.915026+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2018-17175 CVE-2018-17175 2026-10-08T17:31:40.922698+00:00

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

 https://vulnerability.circl.lu/vuln/usn-8225-1 USN-8225-1 — python-marshmallow vulnerabilities 2026-10-08T17:31:40.922790+00:00

Affected: Ubuntu:Pro:18.04:LTS: python-marshmallow, Ubuntu:Pro:20.04:LTS: python-marshmallow, Ubuntu:Pro:22.04:LTS: python-marshmallow, Ubuntu:Pro:24.04:LTS: python-marshmallow, Ubuntu:Pro:26.04:LTS: python-marshmallow

Jared Deckard discovered that Python marshmallow did not correctly handle hiding certain fields. An attacker could possibly use this issue to leak sensitive information. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-17175)

It was discovered that Python marshmallow did not efficiently handle merging certain objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2025-68480)