CVE-2026-15925High· 7.4▾ TwilightA flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. This cou…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
— → 7.4
critical → high
A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. This could allow the attacker to bypass certificate hostname validation, leading to the acceptance of connections without proper verification. Consequently, this vulnerability may expose sensitive credentials and query data to interception and tampering, and could enable the attacker to execute arbitrary SQL commands within the victim's session.
snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification — rated Important by Red Hat. Released 2026-07-16, updated 2026-10-19.
Fixed:
Not affected:
For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Affected packages:
snowflake-connector-python < 3.18.1snowflake-connector-python >= 4.0.0, < 4.7.1Patched in:
snowflake-connector-python 3.18.1snowflake-connector-python 4.7.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-81725Medium· 5.9nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks (CVE-2026-81725)
CVE-2026-80205High· 7.5nltk: NLTK: Denial of Service via unvalidated regular expressions (CVE-2026-80205)
CVE-2026-79674High· 7.5nltk: NLTK: Information disclosure via path traversal in corpus-reader constructors (CVE-2026-79674)
CVE-2026-79675High· 8.1nltk: NLTK before 3.10.3 JVM Argument Injection via Per-Call Options (CVE-2026-79675)
CVE-2026-76222High· 8.2gitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names (CVE-2026-76222)
CVE-2026-66007Medium· 6.5datasets: Datasets: Information disclosure via path traversal vulnerability (CVE-2026-66007)