openshift_lightspeed vulnerabilities
CVEs whose affected-version data names the openshift_lightspeed package (go, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
147 CVEsRSS
CVE-2026-39826Medium· 5.4html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping (CVE-2026-39826)
A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block,…
CVE-2026-39825Medium· 6.5net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2…
A flaw was found in the `net/http/httputil` package, specifically within the `ReverseProxy` component. This vulnerability allows the `ReverseProxy` to forward query parameters that are not visible to `Rewrite` functions. This occurs becaus…
CVE-2026-39836High· 7.5net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows (CVE-2026-39836)
A flaw was found in the `net` package of Go (golang). When running on Windows, the `Dial` and `LookupPort` functions can panic if they receive an input containing a NUL (0) byte. This can be triggered by a remote attacker providing a speci…
CVE-2026-6357Medium· 5.8pip: pip: Arbitrary code execution or information disclosure via malicious wheel package installation (CVE-2026-6357)
A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially …
CVE-2026-6993Medium· 5.3go-kratos: go-kratos kratos: Information disclosure via unintended HTTP server intermediary (CVE-2026-6993)
A flaw was found in go-kratos kratos. A remote attacker could exploit a vulnerability in the HTTP server's `NewServer` function, specifically within the `http.DefaultServeMux Fallback Handler`. This manipulation creates an unintended inter…
CVE-2026-41481Medium· 6.5langchain-text-splitters: LangChain: Information Disclosure via Server-Side Request Forgery (SSRF) Redirect Bypass (CVE-2026-41481)
A flaw was found in LangChain and langchain-text-splitters. This vulnerability, a Server-Side Request Forgery (SSRF) bypass, allows a remote attacker to redirect a seemingly safe URL to internal network resources. By exploiting unvalidated…
CVE-2026-28684High· 7.1python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following (CVE-2026-28684)
A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of ar…
CVE-2026-3219Medium· 5.0pip: pip: Incorrect file installation due to improper archive handling (CVE-2026-3219)
A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentia…
CVE-2026-32289Medium· 5.4html/template: golang: html/template: Cross-Site Scripting (XSS) via improper context and brace depth tracking in JS template literals (CVE…
A flaw was found in the `html/template` package. This vulnerability arises from improper tracking of context and brace depth within JavaScript (JS) template literals. A remote attacker could exploit these issues to cause content to be inco…
CVE-2026-32282High· 7.8golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before ac…
CVE-2026-1839Medium· 6.7transformers: HuggingFace Transformers: Arbitrary code execution via malicious checkpoint file (CVE-2026-1839)
A flaw was found in HuggingFace Transformers. A remote attacker can exploit this vulnerability by supplying a specially crafted checkpoint file (e.g., `rng_state.pth`). The `_load_rng_state()` method in the `Trainer` class loads this file …
CVE-2026-35536Medium· 5.4tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)
A flaw was found in Tornado. A remote attacker could exploit this vulnerability by injecting specially crafted characters into the `domain`, `path`, and `samesite` arguments when setting cookies. This could lead to cookie attribute injecti…
CVE-2026-22815Medium· 5.3aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling (CVE-2026-22815)
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for Python. Insufficient restrictions in header and trailer handling could allow a remote attacker to cause uncapped memory usage. This can lead to a Denial of Servi…
CVE-2026-33699Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode (CVE-2026-33699)
A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resou…
CVE-2026-25645Medium· 4.7PoCrequests: Requests: Security bypass due to predictable temporary file creation (CVE-2026-25645)
A flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creatin…
CVE-2026-33123Medium· 4.3pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF (CVE-2026-33123)
A flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Ser…
CVE-2026-33230Medium· 6.1nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)
A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attack…
CVE-2026-32889Medium· 6.5tinytag: tinytag: Denial of Service via malicious MP3 file parsing (CVE-2026-32889)
A flaw was found in tinytag, a Python library for reading audio file metadata. An attacker who can supply specially crafted MP3 files for parsing can trigger a non-terminating loop within the library. This can cause the parsing operation t…
CVE-2026-30922High· 7.5PoCpyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x3…
CVE-2026-32274High· 7.5black: Black: Arbitrary file writes from unsanitized user input in cache file name (CVE-2026-32274)
A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the…
CVE-2026-31826Medium· 6.5pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF (CVE-2026-31826)
A flaw was found in pypdf, a pure-Python PDF library. An attacker can craft a malicious PDF file containing a content stream with an intentionally large /Length value. When this PDF is parsed, it can lead to excessive memory consumption, r…
CVE-2026-0846High· 7.5PoCnltk: NLTK: Arbitrary file read via improper path validation in `filestring()` function (CVE-2026-0846)
A flaw was found in the `nltk` component. This vulnerability, specifically within the `filestring()` function of the `nltk.util` module, allows an attacker to perform arbitrary file reads. By providing specially crafted input paths, either…
CVE-2026-28804Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter (CVE-2026-28804)
A flaw was found in pypdf, a pure-python PDF library. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that utilizes the /ASCIIHexDecode filter. Processing this specially crafted PDF can lead to excessively…
CVE-2026-0847High· 7.5PoCnltk: NLTK: Arbitrary file read via path traversal vulnerability (CVE-2026-0847)
A flaw was found in NLTK (Natural Language Toolkit). This vulnerability allows a remote attacker to read arbitrary files on the server due to improper sanitization of file paths in several CorpusReader classes, including WordListCorpusRead…
CVE-2026-28351Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with RunLengthDecode filter (CVE-2026-28351)
A flaw was found in pypdf, a free and open-source pure-python PDF library. An attacker can exploit this vulnerability by crafting a malicious PDF file that, when parsed, leads to excessive memory consumption. This occurs specifically when …
CVE-2026-27896High· 7.2modelcontextprotocol/go-sdk: improper handling of case sensitivity (CVE-2026-27896)
A flaw was found in the Go MCP SDK. This issue occurs due to an improper handling of case sensitivity during JSON-RPC message parsing, specifically in the matching of JSON keys to struct field tags. This behavior violates the JSON-RPC 2.0 …
CVE-2026-27888Medium· 5.3pypdf: pypdf: Denial of Service via crafted PDF (CVE-2026-27888)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF document. When a user processes this specially crafted PDF, it can lead to excessive memory consumption, resulting in a Denial of Servi…
CVE-2026-27794Medium· 6.6langgraph-checkpoint: LangGraph Checkpoint: Remote Code Execution via insecure deserialization in caching layer (CVE-2026-27794)
A flaw was found in LangGraph Checkpoint. This vulnerability allows a remote attacker with write access to the cache backend to achieve remote code execution. This occurs when applications enable cache backends that inherit from `BaseCache…
CVE-2026-27628High· 7.5pypdf: possible infinite loop when loading circular /Prev entries in cross-reference streams (CVE-2026-27628)
A flaw was found in pypdf. Processing a specially crafted PDF document, specifically with circular /Prev references in the cross-reference (xref) chain, can cause an infinite loop and a high consumption of CPU, resulting in a denial of ser…
CVE-2026-27025Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with large font values (CVE-2026-27025)
A flaw was found in pypdf. An attacker can craft a malicious PDF file containing unusually large values in the /ToUnicode entry of a font. When this crafted PDF is processed, for example during text extraction, it can lead to excessive res…