| Paramiko rsakey.py allows the SHA-1 algorithmCVE-2026-44405 · GHSA-R374-RXX8-8654بازه‌ها نیاز به بررسی دارند. |
paramikoMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| jupyter/nbconvert allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exportsCVE-2026-6658 · GHSA-9754-6RHW-GJ3H |
nbconvertMigration Toolkit for Applications 8/mta/mta-solution-server-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح اعلام نشده |
|
| uv has ZIP payload obfuscation through parsing differentialsCVE-2025-13327 · GHSA-V653-R55G-HCMG |
uvRed Hat AI Inference Server/rhaiis-preview/vllm-cuda-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIsCVE-2026-39892 · GHSA-P423-J2CM-9VMQبازه‌ها نیاز به بررسی دارند. |
cryptographyLightspeed Core/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAtCVE-2026-2950 · GHSA-F23M-R3PF-42RH |
lodash-amdlodash-es |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| go-git missing validation decoding Index v4 files leads to panicCVE-2026-33762 · GHSA-GM2X-2G9H-CCM8بازه‌ها نیاز به بررسی دارند. |
github.com/go-git/go-git/v4github.com/go-git/go-git/v5 |
GoRed Hat |
کم
|
اصلاح گزارش شده |
|
| Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunksCVE-2026-115927 · GHSA-R4J5-9XPP-3985 |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Tornado: Quadratic CPU usage when parsing HTTP headers with line foldingCVE-2026-116577 · GHSA-PCG2-G6CJ-Q92C |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Tornado: Open redirect in RedirectHandler via protocol-relative URLsCVE-2026-116578 · GHSA-PW9P-V7R6-GX4P |
tornadoLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| AIOHTTP: Secure attribute not enforced for shared cookieCVE-2026-111063 · GHSA-494J-54XM-RWP3 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| uv vulnerable to arbitrary file deletion through RECORD entriesCVE-2026-114110 · GHSA-PJJW-68HJ-V9MW |
uvRed Hat AI Inference Server/rhaiis/model-opt-cuda-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| Mistune: Path Traversal and XSS in Include directiveCVE-2026-115355 · GHSA-H7WW-273W-6CM8 |
mistuneRed Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| GitPython validates a submodule's ".git" path only after cloning into it (RCE)CVE-2026-114145 · GHSA-83VG-56QC-22M7 |
gitpythonExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidocCVE-2026-114140 · GHSA-PJVX-PRJX-H659 |
nbconvertRed Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationCVE-2026-114135 · GHSA-354V-3Q48-CV69 |
jupyter-serverRed Hat OpenShift AI (RHOAI)/rhoai/odh-feature-server-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| AIOHTTP: Connector pool exhaustion via Max-Age overflowCVE-2026-111065 · GHSA-6CJC-53GC-5RQM |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| AIOHTTP: Absolute-form request targets can spoof Request.schemeCVE-2026-111748 · GHSA-F9XW-JH8M-3MWQ |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookiesCVE-2026-111749 · GHSA-GX76-C99X-2C96 |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| AIOHTTP: File descriptor exhaustion in multipart requestsCVE-2026-111066 · GHSA-9XW5-W5JJ-PVCG |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| AIOHTTP: Pure-Python parser request smugglingCVE-2026-111750 · GHSA-PQXQ-W44R-73XW |
aiohttpExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
