| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Podman: WORKDIR symlink traversal vulnerabilityCVE-2026-55686 · GHSA-Q6R4-3WMG-FWCQVersion ranges need review. |
github.com/containers/podman/v2github.com/containers/podman/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Authlib RFC 7592 examples omit registration-access-token client bindingCVE-2026-116672 · GHSA-C73Q-W75P-J82V |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionCVE-2026-119283 · GHSA-JPXQ-7H8P-2Q76 |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119284 · GHSA-9PG5-8C7X-5HFX |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsCVE-2026-114614 · GHSA-JJ7H-C3HG-M23XVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysCVE-2026-114615 · GHSA-7VR2-2FGP-9W7PVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)CVE-2026-114616 · GHSA-8M4G-J4WP-WGCGVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114617 · GHSA-C5MF-XMP2-59RCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114618 · GHSA-FCH4-3C6X-J4GCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114619 · GHSA-Q686-2QMG-HQC7Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114620 · GHSA-X4RV-C3WX-4CR8Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116685 · GHSA-5H93-6WHR-6Q8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116684 · GHSA-W4FH-QVV9-3V23 |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasCVE-2026-116686 · GHSA-RWRF-2PQF-9J8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: empty signatures validation in JWS JSON deserializationCVE-2026-96760 · GHSA-6V38-4H7W-RJ9H |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Critical
|
Fix reported |
|
| github.com/moby/sys/user has a possible DoS via unbounded parsing of user and group database filesCVE-2026-61801 · GHSA-MJCV-P78Q-W5FWVersion ranges need review. |
github.com/moby/sys/userAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-59951 · GHSA-84M7-P3X7-PCFV |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
