satellite vulnerabilities
CVEs whose affected-version data names the satellite package (maven, npm, pip, rust). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
133 CVEsRSS
CVE-2026-114138High· 7.5djangorestframework: djangorestframework: Denial of Service via unbounded Accept header parsing (CVE-2026-114138)
A flaw was found in djangorestframework. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending HTTP requests with a specially crafted Accept header containing an excessive number of media types with complex para…
CVE-2026-114145High· 7.5GitPython: GitPython: arbitrary code execution via improper submodule path validation (CVE-2026-114145)
A flaw was found in GitPython. This vulnerability allows an attacker to achieve arbitrary code execution by supplying an untrusted submodule path. Because the library fails to properly validate destination paths before cloning repository d…
CVE-2026-114136High· 7.5djangorestframework: djangorestframework: Denial of Service via improper charset handling in JSON parser (CVE-2026-114136)
A flaw was found in Django REST framework. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by exhausting server memory. The issue occurs because the JSON parser accepts arbitrary client-suppl…
CVE-2026-111943Medium· 6.8PoCcrypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signe…
CVE-2026-112915Medium· 5.5PoCfilelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)
A flaw was found in filelock. When utilizing the ReadWriteLock mechanism, the library attempts to open an SQLite database without properly restricting schema and query operations. A local attacker able to replace the lock database can prov…
CVE-2026-112892High· 7.5pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decom…
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
A flaw was found in aiohttp. When processing multipart requests, the framework fails to properly limit the number of open file descriptors retained during request handling. An unauthenticated remote attacker can exploit this issue by sendi…
CVE-2026-111064High· 7.5aiohttp: aiohttp: Denial of Service via missing initial request timeout (CVE-2026-111064)
A flaw was found in aiohttp. The server does not enforce a timeout during the initial phase of a request before any data is received. A remote attacker can exploit this vulnerability by keeping idle connections open indefinitely, exhaustin…
CVE-2026-112307High· 7.3sqlparse: sqlparse: Arbitrary code execution via unescaped PHP output formatting (CVE-2026-112307)
A flaw was found in sqlparse. The PHP output formatting filter does not properly sanitize dollar-sign sequences when formatting SQL statements into PHP code. An attacker can exploit this vulnerability by supplying crafted SQL input contain…
CVE-2026-107929Low· 3.7curl: curl: local interface connection reuse mixup (CVE-2026-107929)
A flaw was found in curl. When connection pooling is used with forced local interface binding options, curl fails to include the source interface configuration in its connection reuse cache. An attacker able to initiate network requests in…
CVE-2026-89091High· 8.8A flaw was found in ansible-core
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links …
CVE-2026-12542Medium· 5.3A flaw was found in Foreman
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then exe…
CVE-2026-96659Critical· 9.1A flaw was found in Foreman
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, t…
CVE-2026-96658Critical· 9.9A flaw was found in Foreman
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an a…
CVE-2026-12544High· 7.7A flaw was found in Foreman
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a m…
CVE-2026-12541High· 8.2A flaw was found in Foreman
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) an…
CVE-2026-12540High· 8.2A flaw was found in Foreman
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. W…
CVE-2026-12423High· 7.5A flaw was found in Foreman
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioni…
CVE-2026-87933High· 8.6PoCcJSON: cJSON: Memory corruption via use after free in cJSONUtils_MergePatch (CVE-2026-87933)
A flaw was found in DaveGamble cJSON. The `cJSONUtils_MergePatch` function in `cJSON_Utils.c` is vulnerable to a use-after-free error. A remote attacker could exploit this memory corruption vulnerability, potentially leading to information…
CVE-2026-85242Medium· 5.3PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost,…
CVE-2026-84394High· 7.5fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies (CVE-2026-84394)
A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier (URI) hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This hos…
CVE-2026-83557Medium· 5.6DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe bas…
CVE-2026-84371Medium· 5.4ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value…
CVE-2026-82417Medium· 5.3⚖ disputed### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member
### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)`…
CVE-2026-81658Medium· 6.5A flaw was found in Foreman
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_…
CVE-2026-78679Medium· 6.5PoCGitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file=<path> to read arb…
CVE-2023-54354Medium· 5.9Rejected reason: This CVE ID has been rejected as a duplicate.
Rejected reason: This CVE ID has been rejected as a duplicate.
CVE-2026-75509Medium· 6.5joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to version 1.7.3, JWTClaimsRegistry applies membership matching to list-valued iss and sub claims, allowing…
CVE-2026-62243High· 7.5Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is use…
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is use…
CVE-2026-64846Low· 2.8Nix is a package manager for Linux and other Unix systems
Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the …