TI-2026-25107 CVE-2026-32597 · GHSA-752w-5fwx-jx9f
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Priority HIGH 72
PyJWT is a JSON Web Token implementation in Python.
RHSA-2026:13553
Red Hat Ansible Automation Platform 2.5 Container Release Update
Released 2026-05-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/gateway-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +2
Fixes 10 records
TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-18923 CVE-2026-23490 · GHSA-63vm-454h-vhhq
pyasn1 has a DoS vulnerability in decoder
Priority HIGH 72
pyasn1 is a generic ASN.1 library for Python.
TI-2026-25584 CVE-2026-33154 · GHSA-pxrr-hq57-q35p
dynaconf Affected by Remote Code Execution (RCE) via Insecure Template Evaluation in @jinja Resolver
Priority HIGH 70
dynaconf is a configuration management tool for Python.
TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc
lodash vulnerable to Code Injection via `_.template` imports key names
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
TI-2026-24803 CVE-2026-32274 · GHSA-3936-cmfr-pm3m
Black: Arbitrary file writes from unsanitized user input in cache file name
Priority MEDIUM 45
Black is the uncompromising Python code formatter.
TI-2026-23219 CVE-2026-29074 · GHSA-xpqw-6gx7-v673
SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)
Priority MEDIUM 40
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.
TI-2026-21021 CVE-2026-26007 · GHSA-r6ph-v2qm-q3c2
cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Priority LOW 36
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
TI-2026-21866 CVE-2026-27459 · GHSA-5pwr-322w-8jr4
pyOpenSSL DTLS cookie callback buffer overflow
Priority LOW 35
pyOpenSSL is a Python wrapper around the OpenSSL library.
TI-2025-42681 CVE-2025-69227 · GHSA-jj3x-wxrx-4x23
AIOHTTP vulnerable to DoS when bypassing asserts
Priority LOW 35
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.