CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322 Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

EUVD-2026-102323

Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to visit the resultin...

CVE-2026-62322

The Python Social Auth library is vulnerable to a Login CSRF attack in the LINE backend (LineOAuth2) prior to version 5.0.2 . The root cause is a failure to validate the returned OAuth state during the authorization code exchange. An attacker can initiate authorization for a controlled LINE accou...

CVE-2026-59951

A flaw was found in the Model Context Protocol MCP Python SDK. Stateful streamable HTTP servers fail to enforce idle session expiration or limits on active sessions, preventing terminated or rejected requests from releasing their resources. A remote attacker can exploit this issue by repeatedly...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

CVE-2026-102946 joserfc: JWS signature verification bypass via empty signatures array in jws.deserialize_json

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.7.4, joserfc.jws.deserializejson accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verifygeneraljson loop performs no...

Anthropic Claude Agent SDK for Python: Input validation vulnerability

The Anthropic Claude Agent SDK for Python versions prior to 0.2.121 contain security vulnerabilities. These vulnerabilities stem from the resumption option being passed as an independent token to the Claude CLI without verification. Values starting with a dash are interpreted as independent CLI...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.11, Python 3.7

Python-Markdown version 3.8 contains a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParser to raise an unhandled AssertionError during Markdown parsing. Since Python-Markdown does not catch this exception, any application that processes Markdown controlled by...

Astra Linux – Vulnerability in Pypy

In the http.cookiejar.py module of Python, prior to version 3.7.3, the domain validation mechanism was not properly implemented. This vulnerability could allow existing cookies to be sent to the wrong server. Attackers could exploit this flaw by using a server whose hostname contains another vali...

Astra Linux – Vulnerability in python-git

GitPython is a Python library used for interacting with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython automatically blocked dangerous Git options such as --upload-pack and --receive-pack. However, the corresponding Python functions uploadpack and receivepack bypassed...

Astra Linux – Vulnerability in python-git

GitPython versions before 3.1.54 contain a remote code execution vulnerability in the checkunsafeoptions guard, which can be bypassed by introducing Git options into single-character kwarg values. Attackers can provide crafted option dictionaries to methods such as clonefrom, fetch, pull, push,...

Astra Linux – vulnerability in python-urllib3

urllib3 versions prior to 1.25.9 allow CRLF injection if the attacker controls the HTTP request method; this can be demonstrated by inserting CR and LF control characters into the first argument of putrequest. NOTE: this is similar to CVE-2020-26116...