signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2026-69248 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-69248 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-69248 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-69248 Source advisory: OSV:PYSEC-2026-3554...

cloudmesh-client (>=4.5.0, <=4.7.3), django-ca (>=1.5.0, <=1.5.1) +5 more potentially affected by CVE-2026-69248 via cryptography (1.7.2)

cryptography PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - cloudmesh-client =4.5.0, =1.5.0, =0.5.1, =1.0.0, =5.4.0, =2.2.2, =0.7.0, =0.7.3 Source cves: CVE-2026-69248 Source advisory:...

signxml (>=0.4.2, <=0.4.4) potentially affected by CVE-2026-69249 via cryptography (0.9.3)

cryptography PYPI version 0.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - signxml =0.4.2, =0.4.4 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

atlassian-jwt-auth (>=2.0.0, <=2.1.0), pyjwe (0.1.4) +3 more potentially affected by CVE-2026-69249 via cryptography (1.0.2)

cryptography PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =2.0.0, =1.0.1, =0.4.5, =0.5.0, =0.5.1 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

atlassian-jwt-auth (2.5.0), netlib (0.16.0) +1 more potentially affected by CVE-2026-69249 via cryptography (1.2.3)

cryptography PYPI version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 2.5.0 - netlib 0.16.0 - signxml =0.5.0, =1.0.0 Source cves: CVE-2026-69249 Source advisory: OSV:PYSEC-2026-3553...

SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential algorithm confusion attack. Unless the user explicitly limits the expected signature...

SignXML's signature verification with HMAC is vulnerable to a timing attack

When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., prior versions of SignXML are vulnerable to a potential timing attack. The verifier may leak information about the correct HMAC when comparing...

pytrustnfe3 (>=0.1.0, <=0.9.4) potentially affected by CVE-2025-48994 via signxml (2.5.2)

signxml PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pytrustnfe3 =0.1.0, =0.9.4 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...

pytrustnfe3 (>=0.1.0, <=0.9.4) potentially affected by CVE-2025-48995 via signxml (2.5.2)

signxml PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pytrustnfe3 =0.1.0, =0.9.4 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...

pynfse (0.2.0) potentially affected by CVE-2025-48995 via signxml (2.6.0)

signxml PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pynfse 0.2.0 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...

pynfse (0.2.0) potentially affected by CVE-2025-48994 via signxml (2.6.0)

signxml PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - pynfse 0.2.0 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...

aos-signer (>=0.0.6, <=0.4.0) potentially affected by CVE-2025-48994 via signxml (2.7.2)

signxml PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =0.0.6, =0.4.0 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...

aos-signer (>=0.0.6, <=0.4.0) potentially affected by CVE-2025-48995 via signxml (2.7.2)

signxml PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - aos-signer =0.0.6, =0.4.0 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...

erpbrasil-assinatura (>=0.5.1, <=0.5.2) potentially affected by CVE-2025-48994 via signxml (2.8.0)

signxml PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =0.5.1, =0.5.2 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...

erpbrasil-assinatura (>=0.5.1, <=0.5.2) potentially affected by CVE-2025-48995 via signxml (2.8.0)

signxml PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =0.5.1, =0.5.2 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...

erpbrasil-assinatura (>=1.0.2, <=1.2.0) potentially affected by CVE-2025-48994 via signxml (2.8.1)

signxml PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =1.0.2, =1.2.0 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...

erpbrasil-assinatura (>=1.0.2, <=1.2.0) potentially affected by CVE-2025-48995 via signxml (2.8.1)

signxml PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura =1.0.2, =1.2.0 Source cves: CVE-2025-48995 Source advisory: OSV:PYSEC-2026-1922...

erpbrasil-assinatura (1.4.0) potentially affected by CVE-2025-48994 via signxml (2.8.2)

signxml PYPI version 2.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on signxml and may be impacted: - erpbrasil-assinatura 1.4.0 Source cves: CVE-2025-48994 Source advisory: OSV:PYSEC-2026-1921...