| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| zip: AES Entry HMAC Authentication Bypass on Premature EOFCVE-2026-115906 · GHSA-8HXF-QR8P-62X4 |
zipAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)CVE-2026-115730 · GHSA-9JHJ-WVMW-CFX5 |
i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victimCVE-2026-115910 · GHSA-H2R5-X5M7-3935 |
social-auth-coreRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query stringCVE-2026-118258 · GHSA-3CMX-XJWW-583X |
i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTMLCVE-2026-118660 · GHSA-C8P4-J97H-3VG8 |
happy-domRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/gateway-rhel9 |
npmRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Happy DOM has cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookiesCVE-2026-118661 · GHSA-5FPQ-26GF-QWCR |
happy-domRed Hat Ansible Automation Platform 2/ansible-automation-platform-26/gateway-rhel9 |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| i18next-http-backend incomplete URL validation permits SSRFCVE-2026-105800 · GHSA-XVQ9-WJP8-HWQF |
i18next-http-backendMigration Toolkit for Applications 8/mta/mta-ui-rhel9 |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Django REST framework: JSONParser applies an attacker-named codec to the request streamCVE-2026-114136 · GHSA-3547-9M27-7RXG |
djangorestframeworkRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationCVE-2026-114138 · GHSA-33WH-FXXF-88VV |
djangorestframeworkRed Hat Ansible Automation Platform 2/ansible-automation-platform-24/controller-rhel8 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| ammonia: mXSS via MathML `annotation-xml` encoding stripCVE-2026-63430 · GHSA-9JH8-V38H-CVHRبازه‌ها نیاز به بررسی دارند. |
ammoniaAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
Rust / CargoRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token fileCVE-2026-112948 · GHSA-P458-7748-MCP3 |
@vitest/browser@vitest/ui |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vitest: Code injection via unauthenticated manual mock registrationCVE-2026-112949 · GHSA-QXG6-89MG-RQV8 |
@vitest/mockerRed Hat AMQ Broker 7/amq-broker-bin.zip |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Cross origin script execution through Vite custom middlewareCVE-2026-112945 · GHSA-9JRQ-W75R-8GCW |
vite-plusvite |
npmRed Hat |
کم
|
اصلاح گزارش شده |
|
| Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`CVE-2026-112947 · GHSA-VFPM-58RQ-9QCG |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machineCVE-2026-112946 · GHSA-RQ7H-C2JC-7F22 |
vite-plusvite |
npmRed Hat |
متوسط
|
اصلاح گزارش شده |
|
