sd-python-wrapper (>=0.1.2, <=0.1.26) potentially affected by CVE-2026-88029 via pymongo (3.2.0)

pymongo PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - sd-python-wrapper =0.1.2, =0.1.26 Source cves: CVE-2026-88029 Source advisory: OSV:PYSEC-2026-4294...

PYSEC-2026-4240 LangGraph SDK custom auth silently ignores actions= on resource decorators

Impact What kind of vulnerability is it? Who is impacted? langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons. In affected versions, a decorator such as: python...

dbt-gen (>=0.1.1, <=0.1.4) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.7.4)

snowflake-connector-python PYPI version 2.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-gen =0.1.1, =0.1.4 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

omnata-cli (>=0.1.4, <=0.1.7), omnata-snowcli-fork (>=0.3.0, <=0.3.1) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.0.3)

snowflake-connector-python PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - omnata-cli =0.1.4, =0.3.0, =0.2.0, =0.0.1, =0.0.11 Source cves: CVE-2026-86597 Source advisory:...

kpc-nifi-utils (0.2.3) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.0.0)

snowflake-connector-python PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - kpc-nifi-utils 0.2.3 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

dbt-snowflake (1.4.0b1) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.8.3)

snowflake-connector-python PYPI version 2.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt-snowflake 1.4.0b1 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

snowchange (0.0.4.post2) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.2.8)

snowflake-connector-python PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - snowchange 0.0.4.post2 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

kzr-snowflake (>=0.0.4, <=0.0.9), snowypushy (>=0.2.0, <=0.4.3) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.6.2)

snowflake-connector-python PYPI version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - kzr-snowflake =0.0.4, =0.2.0, =0.4.3 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

ae-mcp (0.2.0), analytics-agent-connector-snowflake (>=0.1.0, <=0.4.0) +30 more potentially affected by CVE-2026-86597 via snowflake-connector-python (>=4.0.0, <=4.7.2)

snowflake-connector-python PYPI version =4.0.0, =0.1.0, =2020.5.20rc1, =1.0.0b2, =0.185.0, =1.0.3, =1.0.0, =0.1.0, =1.10.7, =1.2.1, =2.79.1a0, =2.86.2 - klondike 0.3.0 - lib2dlp 0.0.10 and more Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

soda-sql (>=2.0.0b17, <=2.0.0b27), soda-sql-snowflake (>=2.1.0b12, <=2.1.6) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.4.0)

snowflake-connector-python PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - soda-sql =2.0.0b17, =2.1.0b12, =2.1.6 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

habu-snowflake-cli (>=4.5.0, <=5.1.0), klondike (>=0.2.0, <=0.2.3) +1 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.10.1)

snowflake-connector-python PYPI version 3.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - habu-snowflake-cli =4.5.0, =0.2.0, =2.5.0rc0, =2.5.0 Source cves: CVE-2026-86597 Source advisory:...

dagster-snowflake (>=0.6.4rc0, <=0.6.5), data-lineage (>=0.5.1, <=0.9.0) +5 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.0.1)

snowflake-connector-python PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.6.4rc0, =0.5.1, =0.8.3, =1.0.7, =2.43.2, =0.16.0, =0.21.2 - piicatcher-spacy 0.1.2 Sour...

dagster-snowflake (>=0.4.0rc2, <=0.6.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (1.7.11)

snowflake-connector-python PYPI version 1.7.11 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dagster-snowflake =0.4.0rc2, =0.6.1 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

snowflake-cli-labs (>=2.3.0rc0, <=2.4.1) potentially affected by CVE-2026-86597 via snowflake-connector-python (3.10.0)

snowflake-connector-python PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - snowflake-cli-labs =2.3.0rc0, =2.4.1 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

cafex (1.0.0), cafex-db (1.0.0) +2 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.8.1)

snowflake-connector-python PYPI version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - cafex 1.0.0 - cafex-db 1.0.0 - snowflake-cli-labs =2.2.0rc0, =0.17.7, =0.17.28 Source cves: CVE-2026-86597...

hera-ingestion (1.12.6.30), ingestr (>=0.14.142, <=0.14.155) +3 more potentially affected by CVE-2026-86597 via snowflake-connector-python (3.18.0)

snowflake-connector-python PYPI version 3.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - hera-ingestion 1.12.6.30 - ingestr =0.14.142, =0.4.36, =3.13.0, =3.13.0, =3.16.0 Source cves: CVE-2026-8659...

snowchange (>=0.0.1, <=0.0.4.post1) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.2.6)

snowflake-connector-python PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - snowchange =0.0.1, =0.0.4.post1 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

datupapi (>=0.5.19, <=1.0.3) potentially affected by CVE-2026-86597 via snowflake-connector-python (2.5.0)

snowflake-connector-python PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - datupapi =0.5.19, =1.0.3 Source cves: CVE-2026-86597 Source advisory: OSV:PYSEC-2026-4301...

dbt (>=0.16.0b2, <=0.18.0b2), dbt-schema-builder (>=0.1.0, <=0.2.2) +3 more potentially affected by CVE-2026-86597 via snowflake-connector-python (2.2.1)

snowflake-connector-python PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.16.0b2, =0.1.0, =0.16.0b2, =0.2.0, =0.2.5 - snowshu 0.0.1b3 Source cves: CVE-2026-86597 Source...

python-jose algorithm confusion guard bypassed by DER-encoded public keys

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pass verification when algorithms are not explicitly restricte...