| dnspython dns.name.from_wire_parser() excessive CPU useCVE-2026-114605 · GHSA-45C3-73F7-PV4M |
dnspythonAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102267 · GHSA-9V7F-9G4P-FFGJVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseCVE-2026-103001 · GHSA-GVP8-978C-RX2QVersion ranges need review. |
pyjwtAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
Medium
|
No fix reported |
|
| GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsingCVE-2026-87819 · GHSA-G5VV-9GXW-82HXVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Repository content can impersonate the git directory, leading to arbitrary code executionCVE-2026-87817 · GHSA-239G-WHFQ-7XJ9Version ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)CVE-2026-78675 · GHSA-7833-FR7J-V32QVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)CVE-2026-78679 · GHSA-3WXW-XV34-2FRGVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| WebOb: Open redirect in Location header normalization via leading C0 control / space charactersCVE-2026-54770 · GHSA-6HX8-3WJJ-GR8GVersion ranges need review. |
webobRed Hat Ceph Storage 4/python-webob |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-71491 · GHSA-F2FF-P2WW-7P4PVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-59894 · GHSA-3496-9G83-7V6XVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-59893 · GHSA-PRG7-HCFM-MFCRVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-54284 · GHSA-PWGV-4X5Q-6M9FVersion ranges need review. |
sqlparseRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
High
|
Fix reported |
|
| libsodium has Incomplete List of Disallowed InputsCVE-2025-69277 · GHSA-MRFV-M5WM-5W6WVersion ranges need review. |
paragonie/sodium_compathdwallet |
ComposerPyPIRed Hat |
Medium
|
Fix reported |
|
| GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPythonCVE-2026-76222 · GHSA-HMQ2-W58F-27JCVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()CVE-2026-78678 · GHSA-5XXX-QHH7-9287Version ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destinationCVE-2026-78677 · GHSA-8MCC-HRX5-HVXCVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCECVE-2026-78676 · GHSA-284H-M62Q-GF8WVersion ranges need review. |
gitpythonExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 |
PyPIRed Hat |
Critical
|
Fix reported |
|
| `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributesCVE-2026-49825 · GHSA-4JHM-JV67-739FVersion ranges need review. |
lxml-html-cleanLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| OpenStack's Mistral Client has a local file inclusion vulnerabilityCVE-2021-4472 · GHSA-75HX-6R6J-HW56Version ranges need review. |
python-mistralclientRed Hat OpenStack Platform 13 (Queens)/rhosp13/openstack-aodh-api |
PyPIRed Hat |
Medium
|
Fix reported |
|
