| Paramiko rsakey.py allows the SHA-1 algorithmCVE-2026-44405 · GHSA-R374-RXX8-8654Version ranges need review. |
paramikoMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-15830 · GHSA-Q238-5CXM-5C9HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useCVE-2026-102930 · GHSA-94P9-XGH2-XP45Version ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Command injection via --prompt in activate.bat (batch activator)CVE-2026-102937 · GHSA-X78J-V8H9-3J2QVersion ranges need review. |
virtualenvRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionCVE-2026-102938 · GHSA-9H9J-4VRJ-GF7GVersion ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv bash and fish activation scripts execute commands embedded in pathsCVE-2026-102925 · GHSA-P58F-9548-MPM2Version ranges need review. |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsingCVE-2026-15307 · GHSA-WVQV-FJ8W-QMHMVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-25/ansible-dev-tools-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 allows an unbounded number of links in the decompression chainCVE-2025-66418 · GHSA-GM62-XV2J-4W53Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizerCVE-2025-6638 · GHSA-59P9-H35M-WG4GVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933 · GHSA-37MW-44QP-F5JMVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-54284 · GHSA-PWGV-4X5Q-6M9FVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltkCVE-2026-33230 · GHSA-GFWX-W7GR-FVH7Version ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderCVE-2026-27795 · GHSA-MPHV-75CG-56WG |
@langchain/communityOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
