| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django GeoDjango vulnerable to denial of service through deeply nested geometry collectionsCVE-2026-15830 · GHSA-Q238-5CXM-5C9HVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-102275 · GHSA-X33G-CR3X-6449Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core has an Improper Authentication issueCVE-2026-57175 · GHSA-VQ6G-G6C7-5F2JVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)CVE-2026-101917 · GHSA-2GX3-RCP4-G85QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT accepts public JWK containers as HMAC secretsCVE-2026-102273 · GHSA-W2CX-738M-MC7WVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| social-auth-core has a Session Fixation issueCVE-2026-57179 · GHSA-VQG6-3FW6-J9JGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendCVE-2026-57176 · GHSA-FP7W-M676-W7GCVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-101918 · GHSA-42VR-XJ54-VC7VVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102269 · GHSA-HXM8-2XGR-2P9MVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97689 · GHSA-VXQ7-64XX-V4GWVersion ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-97687 · GHSA-8988-9CW3-XX77Version ranges need review. |
urllib3Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendCVE-2026-57177 · GHSA-X7QQ-23VW-7PFGVersion ranges need review. |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetCVE-2026-102274 · GHSA-W6J9-CWV2-H6WQVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerCVE-2026-102265 · GHSA-8WJV-2P76-3863Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.CVE-2026-102270 · GHSA-JWRC-G2Q2-PQ5PVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Django REST framework: Potential bypass of Django `DATA_UPLOAD_MAX_MEMORY_SIZE` when parsing oversized JSON and urlencoded request bodies via DRF `request.data`CVE-2026-73228 · GHSA-2M8G-3CMR-WG3WVersion ranges need review. |
djangorestframeworkRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
