| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-15830 · GHSA-Q238-5CXM-5C9HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core has an Improper Authentication issueCVE-2026-57175 · GHSA-VQ6G-G6C7-5F2JVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core has a Session Fixation issueCVE-2026-57179 · GHSA-VQG6-3FW6-J9JGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendCVE-2026-57176 · GHSA-FP7W-M676-W7GCVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendCVE-2026-57177 · GHSA-X7QQ-23VW-7PFGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)CVE-2026-73624 · GHSA-FJR4-X663-MWXCVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URLCVE-2026-67322 · GHSA-RWJ8-PGH3-R573Version ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)CVE-2026-73622 · GHSA-94P4-4CQ8-9G67Version ranges need review. |
gitpythonRed Hat AI Inference Server/rhaiis/vllm-cpu-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)CVE-2026-78675 · GHSA-7833-FR7J-V32QVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)CVE-2026-78679 · GHSA-3WXW-XV34-2FRGVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklistCVE-2026-67325 · GHSA-2F96-G7MH-G2HXVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooksCVE-2026-73623 · GHSA-6P8H-3WGX-97GFVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.countCVE-2026-73621 · GHSA-P538-C434-8V24Version ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command executionCVE-2026-73625 · GHSA-R9MR-M37C-5FR3Version ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
