| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp: Multiple instances of excessive or unbounded memory/CPU useCVE-2026-123817 · GHSA-2G87-PP6C-29X5 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exportsCVE-2026-6658 · GHSA-9754-6RHW-GJ3H |
nbconvertMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| Authlib RFC 7592 examples omit registration-access-token client bindingCVE-2026-116672 · GHSA-C73Q-W75P-J82V |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionCVE-2026-119283 · GHSA-JPXQ-7H8P-2Q76 |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119284 · GHSA-9PG5-8C7X-5HFX |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsCVE-2026-114614 · GHSA-JJ7H-C3HG-M23XVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysCVE-2026-114615 · GHSA-7VR2-2FGP-9W7PVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)CVE-2026-114616 · GHSA-8M4G-J4WP-WGCGVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114617 · GHSA-C5MF-XMP2-59RCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114618 · GHSA-FCH4-3C6X-J4GCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114619 · GHSA-Q686-2QMG-HQC7Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114620 · GHSA-X4RV-C3WX-4CR8Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsCVE-2026-118667 · GHSA-3FX2-CQW9-XR3C |
langgraph-sdklanggraph |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116685 · GHSA-5H93-6WHR-6Q8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116684 · GHSA-W4FH-QVV9-3V23 |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
