| zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCECVE-2026-115905 · GHSA-M665-V7PM-7GRJ |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Critical
|
Fix reported |
|
| Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagsCVE-2026-112902 · GHSA-XVH5-G6GV-559V |
pillowExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-123817 · GHSA-2G87-PP6C-29X5 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCECVE-2026-61536 · GHSA-64VX-6H2C-RJH7 |
banksExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File OverwriteCVE-2026-33236 · GHSA-469J-VMHF-R6V7Version ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892 · GHSA-P423-J2CM-9VMQVersion ranges need review. |
cryptographyLightspeed Core/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| NLTK has a Path Traversal issueCVE-2026-0847 · GHSA-68J8-PQ59-FQGMVersion ranges need review. |
nltkLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed rootsCVE-2026-81726 · GHSA-8MGP-746C-J5XPVersion ranges need review. |
nltkExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During ExtractionCVE-2026-115909 · GHSA-Q7V9-X93C-XQV3Version ranges need review. |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
High
|
Fix reported |
|
| pypdf has possible infinite loop when hitting EOF in standard xref table during trailer searchCVE-2026-119203 · GHSA-5849-834G-HVW5 |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible large memory usage when parsing page treeCVE-2026-119204 · GHSA-CGGF-277G-3Q54 |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible infinite loop when cloning dictionariesCVE-2026-119205 · GHSA-MFR5-77XH-9J7H |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible large memory usage for exceptions in strict modeCVE-2026-119207 · GHSA-4VQV-7265-GM2W |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible long runtimes when retrieving page labelsCVE-2026-119206 · GHSA-42GH-23HR-VPHW |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pypdf has possible long runtimes/large memory usage for encrypted PDF filesCVE-2026-119208 · GHSA-62M5-6WH8-28X7 |
pypdfAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
