| OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different clientCVE-2026-118669 · GHSA-7984-QGVG-3J9C |
oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Authlib RFC 7592 examples omit registration-access-token client bindingCVE-2026-116672 · GHSA-C73Q-W75P-J82V |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decodingCVE-2026-119195 · GHSA-9M75-VC3G-4X39 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic-complexity denial of service in binary REAL decodingCVE-2026-119197 · GHSA-MM57-4V3P-RCHX |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decodingCVE-2026-119194 · GHSA-FM9C-5RCF-2Q5P |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| pyasn1 has quadratic CPU consumption in constructed BIT STRING decodingCVE-2026-119196 · GHSA-2QM8-X737-GMW5 |
pyasn1Ansible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key DecryptionCVE-2026-119283 · GHSA-JPXQ-7H8P-2Q76 |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| joserfc: Compact JWS size guard allocates attacker-controlled segments before rejectionCVE-2026-119284 · GHSA-9PG5-8C7X-5HFX |
joserfcExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hostsCVE-2026-114614 · GHSA-JJ7H-C3HG-M23Xبازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
کم
|
اصلاح گزارش شده |
|
| Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keysCVE-2026-114615 · GHSA-7VR2-2FGP-9W7Pبازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)CVE-2026-114616 · GHSA-8M4G-J4WP-WGCGبازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
زیاد
|
اصلاح گزارش شده |
|
| Authlib: ID token can disable its own nonce validation via the nonce_supported claimCVE-2026-114617 · GHSA-C5MF-XMP2-59RCبازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Authlib: Default JWT bearer grant accepts assertions for the wrong audienceCVE-2026-114618 · GHSA-FCH4-3C6X-J4GCبازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokensCVE-2026-114619 · GHSA-Q686-2QMG-HQC7بازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRFCVE-2026-114620 · GHSA-X4RV-C3WX-4CR8بازه‌ها نیاز به بررسی دارند. |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsCVE-2026-118667 · GHSA-3FX2-CQW9-XR3C |
langgraph-sdklanggraph |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesCVE-2026-116685 · GHSA-5H93-6WHR-6Q8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverCVE-2026-116684 · GHSA-W4FH-QVV9-3V23 |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasCVE-2026-116686 · GHSA-RWRF-2PQF-9J8J |
mcpAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-backend-rhel9 |
PyPIRed Hat |
متوسط
|
اصلاح گزارش شده |
|
| Authlib: empty signatures validation in JWS JSON deserializationCVE-2026-96760 · GHSA-6V38-4H7W-RJ9H |
authlibExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
PyPIRed Hat |
بحرانی
|
اصلاح گزارش شده |
|
