| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| urllib3 streaming API improperly handles highly compressed dataCVE-2025-66471 · GHSA-2XPW-W6GG-JR37Version ranges need review. |
urllib3Builds for Red Hat OpenShift/openshift-builds/openshift-builds-shared-resource-webhook-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AIOHTTP: HTTP request smuggling via WebSocket upgradeCVE-2026-69243 · GHSA-MFX4-HV73-Q22VVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-59881 · GHSA-MQ44-7P77-Q5H7Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategyCVE-2026-59888 · GHSA-3PJW-73GF-8QR5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizerCVE-2025-6638 · GHSA-59P9-H35M-WG4GVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Transformers is vulnerable to ReDoS attack through its DonutProcessor classCVE-2025-3933 · GHSA-37MW-44QP-F5JMVersion ranges need review. |
transformersOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in nltkCVE-2026-33230 · GHSA-GFWX-W7GR-FVH7Version ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| LangChain Community: redirect chaining can lead to SSRF bypass via RecursiveUrlLoaderCVE-2026-27795 · GHSA-MPHV-75CG-56WG |
@langchain/communityOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockCVE-2026-22701 · GHSA-QMGC-5H2G-MVRWVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP Vulnerable to Cookie Parser Warning StormCVE-2025-69230 · GHSA-FH55-R93G-J68GVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP vulnerable to DoS through chunked messagesCVE-2025-69229 · GHSA-G84X-MCQJ-X9QQVersion ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP has unicode match groups in regexes for ASCII protocol elementsCVE-2025-69225 · GHSA-MQQC-3GQH-H2X8Version ranges need review. |
aiohttpMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Low
|
Fix reported |
|
| orjson does not limit recursion for deeply nested JSON documentsCVE-2025-67221 · GHSA-HX9Q-6W63-J58VVersion ranges need review. |
orjsonOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible Infinite Loop when processing outlines/bookmarksCVE-2026-24688 · GHSA-2Q4J-M29V-HQ73Version ranges need review. |
pypdfOpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)CVE-2026-21441 · GHSA-38JV-5279-WG99Version ranges need review. |
urllib3External Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
