signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2026-34073 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-34073 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-34073 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2026-26007 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-26007 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-26007 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2026-26007 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-26007 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

EUVD-2025-16676

Malicious code in bioql PyPI...

EUVD-2025-16666

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-48995

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared...

Linux Distros Unpatched Vulnerability : CVE-2025-48994

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared...

Timing Side-channel Attack

signxml is vulnerable to a Timing side-channel attack. The vulnerability is due to information leakage during HMAC comparison when requirex509=False and hmackey is used, allowing attackers to infer the correct HMAC...

pytrustnfe3 (>=0.1.0, <=0.9.4) potentially affected by CVE-2025-48994 via signxml (2.5.2)

signxml PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pytrustnfe3 =0.1.0, =0.9.4 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

cl-sii (>=0.5.1, <=0.11.0), md-sign (>=0.1.0, <=0.1.1) +4 more potentially affected by CVE-2025-48994 via signxml (2.10.1)

signxml PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - cl-sii =0.5.1, =0.1.0, =0.5.3, =0.5.27, =5.0.0, =5.1.1 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

pynfse (0.2.0) potentially affected by CVE-2025-48994 via signxml (2.6.0)

signxml PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pynfse 0.2.0 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

aos-signer (>=0.0.6, <=0.4.0) potentially affected by CVE-2025-48994 via signxml (2.7.2)

signxml PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =0.0.6, =0.4.0 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

erpbrasil-assinatura (>=0.5.1, <=0.5.2) potentially affected by CVE-2025-48994 via signxml (2.8.0)

signxml PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =0.5.1, =0.5.2 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

erpbrasil-assinatura (>=1.0.2, <=1.2.0) potentially affected by CVE-2025-48994 via signxml (2.8.1)

signxml PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =1.0.2, =1.2.0 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...

erpbrasil-assinatura (1.4.0) potentially affected by CVE-2025-48994 via signxml (2.8.2)

signxml PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura 1.4.0 Source cves: CVE-2025-48994 Source advisory: OSV:GHSA-6VX8-PCWV-XHF4...