| NLTK has a Path Traversal issueCVE-2026-0847 · GHSA-68J8-PQ59-FQGMVersion ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockCVE-2026-112941 · GHSA-WFHQ-Q4J2-C37M |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112911 · GHSA-9C4X-GM8V-WGC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112912 · GHSA-9J6Q-WVJ5-JGJG |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerCVE-2026-112939 · GHSA-RFPC-QCW5-3PC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathCVE-2026-112909 · GHSA-69HJ-F68J-2879 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutCVE-2026-112915 · GHSA-CWQR-HH33-GH44 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordCVE-2026-112934 · GHSA-FJ95-FR6C-H845 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersCVE-2026-112935 · GHSA-FQ56-3CX3-FJXP |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| filelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112936 · GHSA-J8F7-RJXC-MR56 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| NLTK: SSRF Fail-Open in validate_network_url() via DNS Resolution FailureCVE-2026-63311 · GHSA-3GQM-FCW5-W839Version ranges need review. |
nltkExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| NLTK: Missing Post-Download Integrity Verification Allows Malicious Package InjectionCVE-2026-12259 · GHSA-5WP5-5229-5G6Q |
nltkExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Temporary app-data can leave dangling seed package linksCVE-2026-113713 · GHSA-4F8H-VR72-P32C |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Pip seeding with download omits wheel digest verificationCVE-2026-113717 · GHSA-CX28-75Q4-X26Q |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| virtualenv: Downloaded wheel selection and caching precede verificationCVE-2026-113714 · GHSA-494P-63J8-28P3 |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| virtualenv: Xonsh activation literals depend on the script decoding codecCVE-2026-113718 · GHSA-394H-QWMC-48PF |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Seeded files retain permissions from an older cacheCVE-2026-113720 · GHSA-FC2G-4W5P-6WHM |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| virtualenv: Bash prompt values can change meaning under older compatibility modesCVE-2026-113723 · GHSA-6W3R-XR62-4XCP |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| virtualenv: Venv configuration readback can reinterpret path boundariesCVE-2026-113715 · GHSA-QMX5-4P3X-WVQF |
virtualenvOpenShift Lightspeed/openshift-lightspeed/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
