Priority HIGH 80
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.
RHSA-2026:92666
satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
Released 2026-10-29 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Satellite 6.19 registry.redhat.io/satellite/foreman-mcp-server-rhel9
Fixes 15 records
TI-2026-65303 CVE-2026-102268 · GHSA-ffc3-869f-jxw9
Improper signature verification in jpadilla pyjwt
Priority HIGH 80
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-79518 CVE-2026-114615 · GHSA-7vr2-2fgp-9w7p
Authlib fix bypass lets attackers forge HS256 tokens with PEM keys
Priority HIGH 74
Authlib is a Python library which builds OAuth and OpenID Connect servers.
TI-2026-65307 CVE-2026-102272 · GHSA-r6x4-923q-g947
PyJWT BOM Bypass
Priority HIGH 68
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-63856 CVE-2026-96760 · GHSA-6m87-8wg6-hh8w · GHSA-6v38-4h7w-rj9h
Authlib library contains a signature‑verification bypass vulnerability
Priority MEDIUM 49
Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability.
TI-2026-45177 CVE-2026-63374 · GHSA-82r6-8w77-94w6
AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing
Priority MEDIUM 48
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio.
TI-2026-79519 CVE-2026-114616 · GHSA-8m4g-j4wp-wgcg
Authlib accepts empty HMAC keys, allowing JWT signature forgery
Priority MEDIUM 41
Authlib is a Python library which builds OAuth and OpenID Connect servers.
TI-2026-81427 CVE-2026-116672 · GHSA-c73q-w75p-j82v
Authlib RFC 7592 examples allow changing other clients' registrations
Priority MEDIUM 40
Authlib is a Python library which builds OAuth and OpenID Connect servers.
Priority MEDIUM 40
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients.
TI-2026-65302 CVE-2026-102267 · GHSA-9v7f-9g4p-ffgj
PyJWT: PyJWKClient follows redirects when fetching JWKS
Priority MEDIUM 40
PyJWT is a Python implementation of JSON Web Token standards.
TI-2026-79318 CVE-2026-114605 · GHSA-45c3-73f7-pv4m
Excessive CPU use in dnspython DNS name parsing
Priority LOW 39
dnspython is a DNS toolkit for Python.
TI-2026-64264 CVE-2026-97689 · GHSA-vxq7-64xx-v4gw
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
Priority LOW 38
urllib3 is an HTTP client library for Python.
TI-2026-74320 CVE-2026-59951 · GHSA-84m7-p3x7-pcfv
Unbounded sessions in MCP Python SDK StreamableHTTP transport
Priority LOW 37
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).
TI-2026-64262 CVE-2026-97687 · GHSA-8988-9cw3-xx77
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
Priority LOW 35
urllib3 is an HTTP client library for Python.
TI-2026-65308 CVE-2026-102273 · GHSA-w2cx-738m-mc7w
PyJWT accepts public JWK containers as HMAC secrets
Priority LOW 34
PyJWT is a Python implementation of JSON Web Token standards.