fastapi (>=0.16.0, <=0.20.1), pyartifactory (>=1.0.1, <=1.0.2) potentially affected by CVE-2024-3772 via pydantic (0.23.0)

pydantic PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - fastapi =0.16.0, =1.0.1, =1.0.2 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

cvgen (>=0.1.0, <=0.4.0), fastapi (>=0.21.0, <=0.23.0) +1 more potentially affected by CVE-2024-3772 via pydantic (0.25.0)

pydantic PYPI version 0.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - cvgen =0.1.0, =0.21.0, =0.1.0, =0.1.1 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

botx (>=0.10.0, <=0.10.3), fastapi (>=0.24.0, <=0.29.1) +2 more potentially affected by CVE-2024-3772 via pydantic (0.26.0)

pydantic PYPI version 0.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - botx =0.10.0, =0.24.0, =0.2.0, =1.0.0, =2.0.2 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

fastapi (>=0.9.0, <=0.15.0) potentially affected by CVE-2024-3772 via pydantic (0.21.0)

pydantic PYPI version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - fastapi =0.9.0, =0.15.0 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

asynql (0.1.0), botx (>=0.11.0, <=0.11.3) +2 more potentially affected by CVE-2024-3772 via pydantic (0.28.0)

pydantic PYPI version 0.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - asynql 0.1.0 - botx =0.11.0, =0.30.0, =0.1.4, =0.4.1 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

cupcake (0.0.4), fastapi (>=0.31.0, <=0.32.0) +6 more potentially affected by CVE-2024-3772 via pydantic (0.29.0)

pydantic PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - cupcake 0.0.4 - fastapi =0.31.0, =0.0.1, =0.0.3, =0.1.0, =0.1.4, =0.0.1, =0.0.2 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

balto (>=0.1.5, <=0.3.0), botx (0.12.0) +4 more potentially affected by CVE-2024-3772 via pydantic (0.30.0)

pydantic PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on pydantic and may be impacted: - balto =0.1.5, =0.1.2, =0.33.0, =0.1.7, =0.1.23 Source cves: CVE-2024-3772 Source advisory: OSV:PYSEC-2026-1812...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +481 more potentially affected by CVE-2024-0727 via cryptography (3.4.8)

cryptography PYPI version 3.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =0.1.1, =0.1.1, =0.0.1, =1.77.3, =0.9.16, =0.1.3, =0.0.1.dev0, =0.1.1, =0.1.0, =0.2.4 and more Sourc...

fastapi-cognito (>=2.5.0, <=2.7.0), fds-sdk-utils (2.0.0) +3 more potentially affected by CVE-2026-49852 via joserfc (0.9.0)

joserfc PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on joserfc and may be impacted: - fastapi-cognito =2.5.0, =0.1.3, =0.18.1, =0.1.0, =0.5.5 Source cves: CVE-2026-49852 Source advisory: OSV:GHSA-GG9X-QCX2-XMRH...

PYSEC-2026-419 mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/ are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled MLFLOWSERVERENABLEJOBEXECUTION=true and any j...

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/ are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled MLFLOWSERVERENABLEJOBEXECUTION=true and any j...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-27962 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-27962...

data-integration-babel (>=0.3.0, <=0.5.0), dbfactory (>=1.0.4, <=1.0.10) +9 more potentially affected by CVE-2024-36039 via pymysql (0.10.0)

pymysql PYPI version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymysql and may be impacted: - data-integration-babel =0.3.0, =1.0.4, =0.2.0, =2.2.6, =1.0.0, =0.2.2, =0.6.10, =1.42.14, =9.4.219.dev3, =10.0.71 - telegraf-pyplug 0.1.1 Source...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-sentry-sdk: python3-sentry-sdk+aiohttp-2.48.0-6.hum1 noarch python3-sentry-sdk+asyncpg-2.48.0-6.hum1 noarch python3-sentry-sdk+bottle-2.48.0-6.hum1 noarch...

aad-fastapi (>=1.0.0, <=1.1.2), aad-fastapi-dl37 (1.0.3) +11 more potentially affected by CVE-2026-41479 via authlib (0.15.4)

authlib PYPI version 0.15.4 is affected by a known vulnerability. The following packages have a transitive dependency on authlib and may be impacted: - aad-fastapi =1.0.0, =0.0.1, =1.0.2, =1.0.2, =0.1.9, =3.37.0, =1.0.0, =2.6.0.dev1, =0.1.1, =0.4.0, =14.0.3, =14.8.2 Source cves: CVE-2026-41479...

definitive-openassistants (>=0.0.1, <=0.0.7), definitive-openassistants-fastapi (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2026-55443 via langchain (0.0.346)

langchain PYPI version 0.0.346 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - definitive-openassistants =0.0.1, =0.0.1, =1.7.0, =1.7.0, =2.7.0 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

accidental-vulnerability (>=2.0.4, <=2.0.5), fastapi (>=0.1.19, <=0.5.1) potentially affected by CVE-2026-54282 via starlette (0.10.1)

starlette PYPI version 0.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - accidental-vulnerability =2.0.4, =0.1.19, =0.5.1 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...

axdocsystem (>=0.1.2, <=0.1.52), columbus (>=0.1.0, <=0.1.9) +10 more potentially affected by CVE-2026-54282 via starlette (0.24.0)

starlette PYPI version 0.24.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - axdocsystem =0.1.2, =0.1.0, =2.0.7, =0.0.31, =0.1.2, =1.0.1rc1, =0.2.4, =5.3.0b1, =5.3.0b2 Source cves: CVE-2026-54282 Source advisory:...

esmerald (0.4.0), fast-token-classifier (>=0.1.0, <=0.2.3) +2 more potentially affected by CVE-2026-54282 via starlette (0.23.0)

starlette PYPI version 0.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 0.4.0 - fast-token-classifier =0.1.0, =0.2.3 - fastapi 0.90.0 - fastapi-stack-utils 0.8.4 Source cves: CVE-2026-54282 Source advisor...

bali-core (>=3.1.0, <=3.2.1), datapipe-app (0.1.7) +7 more potentially affected by CVE-2026-54282 via starlette (0.15.0)

starlette PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - bali-core =3.1.0, =0.9.0, =1.0.0, =0.1.3, =0.1.7 - yiri-mirai 0.1.3 Source cves: CVE-2026-54282 Source advisory: OSV:PYSEC-2026-248...