VulnSea

exploit_intelligence vulnerabilities

CVEs whose affected-version data names the exploit_intelligence package (go, npm, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

76 CVEsRSS

CVE-2026-53492High· 8.2
2mo ago

github.com/containerd/containerd: containerd: Security bypass via Container Device Interface (CDI) annotation smuggling during checkpoint r…

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) implementation, which allows Kubernetes to interact with container runtimes, improperly trusts Container Device Interface (CDI) annotat…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.20EPSS 0.35%via CSAF
CVE-2026-12243High· 7.5PoC
2mo ago

nltk: NLTK: Information disclosure via path traversal vulnerability (CVE-2026-12243)

A flaw was found in NLTK. An attacker can exploit a path traversal vulnerability by providing specially crafted input to `nltk.data.load()` or `nltk.data.find()`. This allows the attacker to read arbitrary files accessible to the Python pr…

MidnightRed Hat · Red Hat OpenShift AI 3.4via CSAF
CVE-2026-13149High· 7.5
2mo ago

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time c…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.20EPSS 0.36%via CSAF
CVE-2026-54283High· 7.5
3mo ago

starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS (CVE-2026-54283)

A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by s…

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.40%via CSAF
CVE-2026-45409Medium· 5.3
3mo ago

python-idna: idna: Denial of Service via specially crafted long inputs (CVE-2026-45409)

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding f…

SunlitRed Hat · Red Hat Enterprise Linux 9EPSS 0.41%via CSAF
CVE-2026-34993High· 7.2
3mo ago

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() (CVE-2026-34993)

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to …

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.18%via CSAF
CVE-2026-44740High· 7.5
3mo ago

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation an…

TwilightRed Hat · Red Hat Openshift Data Foundation 4.22EPSS 0.39%via CSAF
CVE-2026-39833Medium· 5.5⚖ disputed
4mo ago

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation (CVE-2026-39833)

A flaw was found in golang.org/x/crypto/ssh/agent. The NewKeyring() function, which creates an in-memory keyring, failed to enforce the ConfirmBeforeUse constraint on keys. This allowed keys configured to require user confirmation before u…

SunlitRed Hat · Red Hat OpenShift Container Platform 4EPSS 0.41%via CSAF
CVE-2026-44431Medium· 5.3
4mo ago

urllib3 is an HTTP client library for Python

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive hea…

SunlitRed Hat · Red Hat Enterprise Linux AppStream (v. 8)EPSS 0.33%via NVD
CVE-2026-42308Medium· 6.2
4mo ago

Pillow: Pillow: Denial of Service via integer overflow in font processing (CVE-2026-42308)

A flaw was found in Pillow, a Python imaging library. If a font advances for each glyph by an exceeding large amount, an integer overflow can occur when Pillow tracks the current position. This could lead to a denial of service (DoS) condi…

SunlitRed Hat · Red Hat Enterprise Linux 8EPSS 0.11%via CSAF
CVE-2026-42311High· 7.8
4mo ago

Pillow: python-pillow: Pillow: Arbitrary code execution via malicious PSD file processing (CVE-2026-42311)

A flaw was found in Pillow, a Python imaging library. An attacker could exploit this vulnerability by tricking a user into processing a specially crafted malicious PSD file. This could lead to memory corruption, potentially causing the app…

TwilightRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.15%via CSAF
CVE-2026-42501Medium· 5.3
4mo ago

cmd/go: golang: Go command (cmd/go): Integrity bypass due to checksum validation flaw via malicious module proxy (CVE-2026-42501)

A flaw was found in the Go command (`cmd/go`). A malicious module proxy can exploit this vulnerability by bypassing the validation of module checksums. This allows the proxy to serve altered versions of the Go toolchain, which the `go` com…

SunlitRed Hat · Red Hat Enterprise Linux AppStream (v. 8)EPSS 0.23%via CSAF
CVE-2026-42284High· 7.5
4mo ago

GitPython: GitPython: Arbitrary code execution via improper validation of clone options (CVE-2026-42284)

A flaw was found in GitPython, a Python library for interacting with Git repositories. A remote attacker could exploit an input validation vulnerability in the `_clone()` function. By crafting a malicious string in the `multi_options` para…

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.57%via CSAF
CVE-2026-44244High· 7.3
4mo ago

GitPython: GitPython: Arbitrary code execution via injected newlines in Git configuration (CVE-2026-44244)

A flaw was found in GitPython, a Python library used to interact with Git repositories. The `GitConfigParser.set_value()` function does not properly validate input for newlines. This vulnerability allows an attacker to inject malicious con…

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.24%via CSAF
CVE-2026-42215High· 7.5
4mo ago

GitPython: GitPython: Arbitrary command execution due to bypass of dangerous Git option checks (CVE-2026-42215)

A flaw was found in GitPython, a Python library used to interact with Git repositories. This vulnerability allows an attacker to achieve arbitrary command execution by providing specially crafted arguments (kwargs) to functions such as Rep…

TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.75%via CSAF
CVE-2026-6357Medium· 5.8
4mo ago

pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation (CVE-2026-6357)

A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially …

SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.14%via CSAF
exploit_intelligence vulnerabilities (CVEs) — page 3 · VulnSea