cloeextensions (>=20230717.1.0, <=20231120.1.0), dbt-snowflake (>=1.4.0rc1, <=1.5.0b2) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.8.1)

snowflake-connector-python PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - cloeextensions =20230717.1.0, =1.4.0rc1, =1.5.0b2 - odd-dbt 0.1.7 Source cves: CVE-2026-86597 Source advisor...

inthub-cli (>=0.1.4, <=0.1.26), omnata-plugin-devkit (>=0.5.3, <=0.11.0) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.12.0)

snowflake-connector-python PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - inthub-cli =0.1.4, =0.5.3, =0.5.0a112, =0.11.9 - snowflake-cli-labs 3.0.0rc0 Source cves: CVE-2026-86597...

habu-snowflake-cli (>=4.5.0, <=5.1.0), klondike (>=0.2.0, <=0.2.3) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.10.1)

snowflake-connector-python PYPI version 3.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - habu-snowflake-cli =4.5.0, =0.2.0, =2.5.0rc0, =2.5.0 Source cves: CVE-2026-86597 Source advisory:...

dbt (>=0.15.3rc1, <=0.16.0b1), dbt-snowflake (>=0.15.3rc1, <=0.16.0b1) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.0.4)

snowflake-connector-python PYPI version 2.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.15.3rc1, =0.15.3rc1, =1.0.5, =1.1.0 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

pipelinewise-target-snowflake (1.12.0) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.4.2)

snowflake-connector-python PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-target-snowflake 1.12.0 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

database-factory (>=1.0.5, <=1.0.6), mage-ai (>=0.1.0, <=0.2.8) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.9)

snowflake-connector-python PYPI version 2.7.9 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - database-factory =1.0.5, =0.1.0, =1.4.0, =2.0.4 Source cves: CVE-2026-86597 Source advisory:...

snowflake-sqlalchemy (>=1.0.9, <=1.1.14), target-snowflake (0.0.2) potentially affected by CVE-2026-86597 via snowflake-connector-python (1.9.1)

snowflake-connector-python PYPI version 1.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - snowflake-sqlalchemy =1.0.9, =1.1.14 - target-snowflake 0.0.2 Source cves: CVE-2026-86597 Source advisory:...

airbyte (>=0.0.1.dev7, <=0.10.5), airbyte-lib (>=0.1.0.dev1, <=0.1.0) +7 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.6.0)

snowflake-connector-python PYPI version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - airbyte =0.0.1.dev7, =0.1.0.dev1, =1.0.23, =0.1.0, =0.1.1 - refractbatch 1.24.1 - snowflake-cli-labs 2.0.0rc...

dynamiq (>=0.13.0, <=0.44.0), mcp-snowflake-server (0.4.0) +8 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.13.2)

snowflake-connector-python PYPI version 3.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dynamiq =0.13.0, =0.4.3, =0.4.0, =0.0.27.post2, =0.4.0, =3.13.0, =3.14.2 - snowflake-cli 3.4.1 -...

aladdinsdk (>=0.0.1a4.post0, <=2.0.0b6), icsdatavalidation (>=1.0.232, <=1.0.378) +3 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.7.1)

snowflake-connector-python PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - aladdinsdk =0.0.1a4.post0, =1.0.232, =0.2.0, =0.1.0, =0.3.0 Source cves: CVE-2026-86597 Source advisory:...

1xn-vmcp (>=0.1.0, <=0.6.1), a2 (>=0.1.0, <=0.8.3) +2059 more potentially affected by CVE-2024-33663 +1 more via python-jose (>=3.0.0, <=3.5.0)

python-jose PYPI version =3.0.0, =0.1.0, =0.1.0, =0.3.6, =0.1.0a1, =0.1.2b0, =0.0.1a1, =0.1.0, =0.1.1, =3.1.0b1, =0.0.3, =1.0.0, =1.0.3, =0.1.0a0, =1.0.0, =1.1.0 and more Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:PYSEC-2026-4298...

core-devoops (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-33663 +1 more via python-jose (1.4.0)

python-jose PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - core-devoops =0.0.1, =0.0.2 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:PYSEC-2026-4298...

datawire-cloudtools (0.2.6) potentially affected by CVE-2024-33663 +1 more via python-jose (0.5.5)

python-jose PYPI version 0.5.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - datawire-cloudtools 0.2.6 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:PYSEC-2026-4298...

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

flask-adfs (>=0.1.9, <=0.1.19), ghoauth (>=0.5.1, <=0.6.1) +1 more potentially affected by CVE-2024-33663 +1 more via python-jose (1.3.2)

python-jose PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - flask-adfs =0.1.9, =0.5.1, =0.3.2, =0.3.3 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:PYSEC-2026-4298...

PYSEC-2026-4298 python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...

allennlp (>=0.8.0, <=0.8.2), cloudless (0.0.0) +6 more potentially affected by CVE-2024-33663 +1 more via python-jose (2.0.2)

python-jose PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on python-jose and may be impacted: - allennlp =0.8.0, =1.0.0, =1.3.4, =0.4.3, =0.0.25, =0.0.26 Source cves: CVE-2024-33663, CVE-2026-85394 Source advisory: OSV:PYSEC-2026-4298...

CVE-2026-79824

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

CVE-2026-79824 HPE NonStop Python 3.x - Directory traversal vulnerability

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...

CVE-2026-79824 HPE NonStop Python 3.x - Directory traversal vulnerability

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. dot dot sequence in filenames in a TAR archive...