RHSA-2026:37275

Starlette is a lightweight ASGI framework/toolkit.

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

A vulnerability in the `TFSMLayer` class of the `keras` package, version 3.13.0, allows attacker-controlled TensorFlow SavedModels to be loaded during deserialization of `.keras` models, even when `safe_mode=True`.

LangChain is a framework for building agents and LLM-powered applications.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

PyJWT is a JSON Web Token implementation in Python.

pyasn1 is a generic ASN.1 library for Python.

pyasn1 is a generic ASN.1 library for Python.

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's file…

PyJWT is a JSON Web Token implementation in Python.

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.

gRPC-Go is the Go language implementation of gRPC.

A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.

Pillow is a Python imaging library.

SimpleEval is a library for adding evaluatable expressions into python projects.

Tornado is a Python web framework and asynchronous networking library.

vLLM is an inference and serving engine for large language models (LLMs).

The net/url package does not set a limit on the number of query parameters in a query.

urllib3 is an HTTP client library for Python.

Python-Multipart is a streaming multipart parser for Python.

multipart is a fast multipart/form-data parser for python.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path, and samesite arguments to .RequestHandler.set_cookie were not checked for crafted characters.

urllib3 is an HTTP client library for Python.

React Router is a router for React.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

pypdf is a free and open-source pure-python PDF library.

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…