ansible_automation_platform vulnerabilities
CVEs whose affected-version data names the ansible_automation_platform package (go, npm, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
212 CVEsRSS
CVE-2026-75509Medium· 6.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing…
CVE-2026-63310High· 7.1Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-64846Low· 2.8Nix is a package manager for Linux and other Unix systems
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the …
CVE-2026-49825High· 8.2lxml is a library for processing XML and HTML in the Python language
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. cont…
CVE-2026-76220High· 8.8gitpython: GitPython: Arbitrary command execution via crafted kwargs (CVE-2026-76220)
A flaw was found in GitPython. A remote attacker can bypass the `check_unsafe_options` guard by combining a single-character keyword argument with `split_single_char_options=False`. This allows the attacker to supply a crafted dictionary o…
CVE-2026-76221High· 8.8gitpython: GitPython: Arbitrary code execution via config-name injection (CVE-2026-76221)
A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary gi…
CVE-2026-76222High· 8.2PoCgitpython: GitPython: Arbitrary file creation via path traversal in .gitmodules submodule names (CVE-2026-76222)
A flaw was found in GitPython where it fails to properly validate submodule names within .gitmodules files. A remote attacker could craft a malicious Git repository containing specially formed submodule names with directory traversal seque…
CVE-2026-76218High· 7.5gitpython: GitPython: Remote Code Execution via malicious Git hooks (CVE-2026-76218)
A flaw was found in GitPython. This vulnerability allows a remote attacker to achieve arbitrary code execution. By supplying a specially crafted template parameter to the `Repo.init` function, an attacker can point to a directory containin…
CVE-2026-76219High· 8.1gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection (CVE-2026-76219)
A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the `git read-tree` command through methods like `IndexFile.from_tree`, `IndexFile.reset`, …
CVE-2026-61711Medium· 6.3github.com/moby/buildkit: BuildKit: Security bypass allows disabling container protections (CVE-2026-61711)
A flaw was found in BuildKit. A custom frontend could craft a build request with an invalid security mode, leading to the disabling of Seccomp and AppArmor protections for the build container. This bypasses the intended sandbox mechanisms,…
CVE-2026-61712Medium· 5.5github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing (CVE-2026-61712)
A flaw was found in BuildKit. A remote attacker could provide a malicious base image or build with oversized /etc/passwd and /etc/group files. When BuildKit attempts to resolve usernames or group identifiers from these files, it reads them…
CVE-2026-75838Medium· 6.1DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that ex…
CVE-2026-50187High· 8.8Oh My Zsh is a community-driven framework for managing Zsh configuration
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .en…
CVE-2026-73646High· 7.5PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree
PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to joi…
CVE-2026-71491High· 7.5sqlparse is a non-validating SQL parser module for Python
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption t…
CVE-2026-73643High· 7.5js-yaml is a JavaScript YAML parser and dumper
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection…
CVE-2026-73569High· 7.5fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and pa…
CVE-2026-73566High· 7.5node-tar is a tar archive manipulation library for Node.js
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(..…
CVE-2026-45819High· 7.5baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service.
CVE-2026-73625High· 8.8gitpython: GitPython: Remote Code Execution via kwarg value smuggling (CVE-2026-73625)
A flaw was found in GitPython. Attackers can bypass the `check_unsafe_options` guard by smuggling git options within single-character keyword argument (kwarg) values. This allows them to supply specially crafted option dictionaries to vari…
CVE-2026-73622High· 7.5PoCgitpython: GitPython: Information disclosure via environment variable expansion in URL handling (CVE-2026-73622)
A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pu…
CVE-2026-73623High· 7.5PoCgitpython: GitPython: Remote Code Execution via malicious Git template (CVE-2026-73623)
A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary co…
CVE-2026-73619Medium· 6.5PoCgitpython: GitPython: Arbitrary file read vulnerability via `Repo.archive()` (CVE-2026-73619)
A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the `unsafe_git_archive_options` guard, an attacker can supply specific options, such…
CVE-2026-73620High· 8.8PoCgitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding (CVE-2026-73620)
A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. An authenticated attacker can exploit this by passing uns…
CVE-2026-49478High· 8.7⚖ disputedFulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discover…
CVE-2026-73088High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, normalizeStats() in node.js, reached unconditionally through getStat() and loadStat() on every browserslist()…
CVE-2026-73089High· 7.5Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools
Browserslist is a configuration tool for sharing target browsers and Node.js versions between front-end tools. Prior to 4.28.7, index.js retains every distinct `(queries, context)` result in cache and every parseQueries() AST in parseCac…
CVE-2026-71556High· 7.1go-git is an extensible git implementation library written in pure Go
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resoluti…
CVE-2026-67422High· 7.5pymdown-extensions is a collection of extensions for the Python Markdown library
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can parti…
CVE-2026-54876High· 7.5Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker…
Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker…