| Twisted: IMAP wildcardToRegexp() ReDoSCVE-2026-106454 · GHSA-8PQF-F4M5-798GVersion ranges need review. |
twistedRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-15830 · GHSA-Q238-5CXM-5C9HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core has an Improper Authentication issueCVE-2026-57175 · GHSA-VQ6G-G6C7-5F2JVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core has a Session Fixation issueCVE-2026-57179 · GHSA-VQG6-3FW6-J9JGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendCVE-2026-57176 · GHSA-FP7W-M676-W7GCVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendCVE-2026-57177 · GHSA-X7QQ-23VW-7PFGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`CVE-2026-73228 · GHSA-2M8G-3CMR-WG3WVersion ranges need review. |
djangorestframeworkRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requestsCVE-2026-73229 · GHSA-G47C-3XMW-Q6M2Version ranges need review. |
djangorestframeworkRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| django: Django: Denial-of-service vulnerability due to excessive memory consumptionCVE-2026-15337 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| django: Django: Cross-site scripting via unvalidated URLField values in the adminCVE-2026-15920 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| podman: buildah: buildah/copier: Directory escape via crafted tar symlinks when used outside Buildah by non-root callersCVE-2026-79705 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-25/eda-controller-rhel8 |
Red Hat |
Medium
|
No fix reported |
|
| podman: buildah: skopeo: containers/storage: Malicious tar whiteout header allows replacement of extraction destination directoryCVE-2026-79699 |
Red Hat Ansible Automation Platform 2/ansible-automation-platform-24/eda-controller-rhel8Red Hat Ansible Automation Platform 2/ansible-automation-platform-25/eda-controller-rhel8 |
Red Hat |
Low
|
No fix reported |
|
