TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
PyJWT is a JSON Web Token implementation in Python.
RHSA-2026:10140
Red Hat Enterprise Linux AI 3.3.1
Released 2026-04-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
Fixes 6 records
TI-2026-22237 CVE-2026-27893 · GHSA-7972-pg2x-xr59
vLLM's hardcoded trust_remote_code=True in NemotronVL and KimiK25 bypasses user security opt-out
Priority MEDIUM 43
vLLM is an inference and serving engine for large language models (LLMs).
TI-2026-05344 CVE-2026-6100 · GHSA-pg25-7cx5-cvcm
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Priority MEDIUM 42
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.
TI-2026-20764 CVE-2026-25679 · GHSA-j3gx-2473-5fp8
Incorrect parsing of IPv6 host literals in net/url
Priority MEDIUM 40
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
TI-2026-04175 CVE-2026-4786 · GHSA-cccx-m78h-m3xw
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Priority LOW 33
Mitgation of CVE-2026-4519 was incomplete.
TI-2026-03926 CVE-2026-4519 · GHSA-rm92-fj5q-mpj5
webbrowser.open() allows leading dashes in URLs
Priority LOW 33
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.