| ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)CVE-2026-115919 · GHSA-48M4-24CQ-37QF |
onnxRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlserver-cuda-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required AttributeCVE-2026-115921 · GHSA-M4PR-6V3C-6FGR |
onnxRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlserver-cuda-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rankCVE-2026-115920 · GHSA-6PWM-X34P-FVJ2 |
onnxRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlserver-cuda-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIsCVE-2026-115922 · GHSA-Q69G-F4F5-V8M7 |
onnxRed Hat OpenShift AI (RHOAI)/rhoai/odh-mlserver-cuda-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114603 · GHSA-XCQ7-P3PF-P88H |
opentelemetry-apiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111065 · GHSA-6CJC-53GC-5RQM |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111748 · GHSA-F9XW-JH8M-3MWQ |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111749 · GHSA-GX76-C99X-2C96 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| AIOHTTP: Pure-Python parser request smugglingCVE-2026-111750 · GHSA-PQXQ-W44R-73XW |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-104874 · GHSA-54P9-H82J-F925Version ranges need review. |
multidictExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsCVE-2026-63349 · GHSA-3W57-8XMC-8V26Version ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| AnyIO process-pool workers can block indefinitely on undrained stderrCVE-2026-64847 · GHSA-5P39-CFHJ-2XMPVersion ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateCVE-2026-59881 · GHSA-MQ44-7P77-Q5H7Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp: CRLF injection in multipart headersCVE-2026-50269 · GHSA-M6QW-4CW2-HM4MVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| aiohttp: Unread Compressed Request Bodies Bypass client_max_size During CleanupCVE-2026-54278 · GHSA-G3CQ-J2XW-WF74Version ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| python-multipart: Semicolon treated as querystring field separator enables parameter smugglingCVE-2026-53538 · GHSA-6JV3-5F52-599MVersion ranges need review. |
python-multipartExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| aiohttp: HTTP/1 Pipelined Requests Queue Without LimitCVE-2026-54273 · GHSA-4FVR-RGM6-GQMCVersion ranges need review. |
aiohttpExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp allows unlimited trailer headers, leading to possible uncapped memory usageCVE-2026-22815 · GHSA-W2FM-2CPV-W7V5Version ranges need review. |
aiohttpLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| python-multipart affected by Denial of Service via large multipart preamble or epilogue dataCVE-2026-40347 · GHSA-MJ87-HWQH-73PJVersion ranges need review. |
python-multipartLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
