| Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-15830 · GHSA-Q238-5CXM-5C9HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsingCVE-2026-15307 · GHSA-WVQV-FJ8W-QMHMVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-54284 · GHSA-PWGV-4X5Q-6M9FVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| Django: GDALRaster may over-read heap memory when constructed from bytesCVE-2026-53877 · GHSA-CRHF-3PFG-W68WVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django: cache middleware may expose private responses when unrelated request cookies are presentCVE-2026-48588 · GHSA-3H9F-R86X-QVJXVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django: DomainNameValidator permits newline characters that may enable HTTP header injectionCVE-2026-53878 · GHSA-8QCX-XF44-272XVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django: has_vary_header may expose cached responses when Vary values contain whitespaceCVE-2026-48587 · GHSA-923M-GV2P-W5QPVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from VaryCVE-2026-35193 · GHSA-QPC8-7FXC-CM4PVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django: signed cookies are vulnerable to salt namespace collisionsCVE-2026-6873 · GHSA-H7PC-VWP9-298GVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handlingCVE-2026-8404 · GHSA-8CJM-8MP7-R2XFVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshakeCVE-2026-7666 · GHSA-MM6V-Q8Q9-PGCFVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django has an Improper Handling of Length Parameter InconsistencyCVE-2026-5766 · GHSA-W26R-RMM8-9C29Version ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django Uses Persistent Cookies Containing Sensitive Information CVE-2026-35192 · GHSA-7H2M-M8VJ-598HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| django: Server-side request forgery via `SpatialReference` string inputCVE-2026-114582 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
Red Hat |
Low
|
No fix reported |
|
| django: Password hash disclosure to "view only" admin users with custom user modelsCVE-2026-113733 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/lightspeed-rhel8 |
Red Hat |
Low
|
No fix reported |
|
