| zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCECVE-2026-115905 · GHSA-M665-V7PM-7GRJ |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
Critical
|
Fix reported |
|
| Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892 · GHSA-P423-J2CM-9VMQVersion ranges need review. |
cryptographyLightspeed Core/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionCVE-2026-119283 · GHSA-JPXQ-7H8P-2Q76 |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119284 · GHSA-9PG5-8C7X-5HFX |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsCVE-2026-114614 · GHSA-JJ7H-C3HG-M23XVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
| Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114617 · GHSA-C5MF-XMP2-59RCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114618 · GHSA-FCH4-3C6X-J4GCVersion ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114619 · GHSA-Q686-2QMG-HQC7Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114620 · GHSA-X4RV-C3WX-4CR8Version ranges need review. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116685 · GHSA-5H93-6WHR-6Q8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116684 · GHSA-W4FH-QVV9-3V23 |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasCVE-2026-116686 · GHSA-RWRF-2PQF-9J8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114603 · GHSA-XCQ7-P3PF-P88H |
opentelemetry-apiAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-102275 · GHSA-X33G-CR3X-6449Version ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)CVE-2026-101917 · GHSA-2GX3-RCP4-G85QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsCVE-2026-63349 · GHSA-3W57-8XMC-8V26Version ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-101918 · GHSA-42VR-XJ54-VC7VVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102269 · GHSA-HXM8-2XGR-2P9MVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| AnyIO process-pool workers can block indefinitely on undrained stderrCVE-2026-64847 · GHSA-5P39-CFHJ-2XMPVersion ranges need review. |
anyioAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
