| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimCVE-2026-115910 · GHSA-H2R5-X5M7-3935 |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)CVE-2026-116579 · GHSA-PJH6-C8MG-3X7M |
autobahnRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lockCVE-2026-112941 · GHSA-WFHQ-Q4J2-C37M |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusionCVE-2026-112911 · GHSA-9C4X-GM8V-WGC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takerCVE-2026-112912 · GHSA-9J6Q-WVJ5-JGJG |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markerCVE-2026-112939 · GHSA-RFPC-QCW5-3PC4 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathCVE-2026-112909 · GHSA-69HJ-F68J-2879 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeoutCVE-2026-112915 · GHSA-CWQR-HH33-GH44 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordCVE-2026-112934 · GHSA-FJ95-FR6C-H845 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersCVE-2026-112935 · GHSA-FQ56-3CX3-FJXP |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: ReadWriteLock follows a symlink at the lock path into SQLiteCVE-2026-112936 · GHSA-J8F7-RJXC-MR56 |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failureCVE-2026-114613 · GHSA-J586-36CW-2GC2 |
msgpackLightspeed Services for Advanced Cluster Management/lightspeed-services-acm/ocp-rules-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address ValidationCVE-2026-83813 · GHSA-JJ36-9PVH-VJ5R |
twistedRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directoryCVE-2026-112914 · GHSA-CRV4-6MHJ-J5JH |
filelockAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
