Critical
3
High
27
Medium
20
Low
3
Unknown
0
Not affected
0
Trivy 0.76.1 scan of the Python dependencies pinned in the release requirements file, with the vulnerability database as of 2026-11-02. The Python runtime embedded by the build is not covered.
Vulnerabilities (53)
| Severity | Identifier | CVSS | Package | Version | Fixed in | Description | Assessment |
|---|---|---|---|---|---|---|---|
| Critical | CVE-2026-15925 GHSA-5cc2-282f-jjq2 | 9.2 | snowflake-connector-python transitive | 4.2.0 | 3.18.1, 4.7.1 | snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification | Not assessed |
| Critical | GHSA-6q48-6c7w-9gw2 | 9.1 | certifi transitive | 2026.1.4 | 2026.10.18 | certifi bundles emSign root CAs with compromised intermediate CA keys | Not assessed |
| Critical | CVE-2026-102268 GHSA-ffc3-869f-jxw9 | 9.1 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via improper public key validation | Not assessed |
| High | CVE-2026-27459 GHSA-5pwr-322w-8jr4 | 9.8 | pyopenssl transitive | 25.3.0 | 26.0.0 | pyOpenSSL: DTLS cookie callback buffer overflow | Not assessed |
| High | CVE-2026-102267 GHSA-9v7f-9g4p-ffgj | 9.1 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects | Not assessed |
| High | CVE-2026-97689 GHSA-vxq7-64xx-v4gw | 8.9 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser | Not assessed |
| High | CVE-2026-69249 GHSA-jwv3-5hgf-82ww | 8.7 | cryptography transitive | 46.0.3 | 49.0.0 | python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building | Not assessed |
| High | CVE-2026-43871 GHSA-8wv5-x4w7-5gww | 8.7 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift: Denial of Service via infinite loop | Not assessed |
| High | CVE-2026-49272 GHSA-3jp2-3mrg-2vxc | 8.5 | oauthlib transitive | 3.3.1 | 4.0.0 | OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow | Not assessed |
| High | CVE-2026-118669 GHSA-7984-qgvg-3j9c | 8.4 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers | Not assessed |
| High | CVE-2026-26007 GHSA-r6ph-v2qm-q3c2 | 8.2 | cryptography transitive | 46.0.3 | 46.0.5 | cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | Not assessed |
| High | CVE-2026-69247 GHSA-g6cj-pr64-35w5 | 8.2 | cryptography transitive | 46.0.3 | 50.0.0 | python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing | Not assessed |
| High | CVE-2026-0994 GHSA-7gcm-g887-7qv7 | 8.2 | protobuf transitive | 6.33.4 | 6.33.5, 5.29.6 | python: protobuf: Protobuf: Denial of Service due to recursion depth bypass | Not assessed |
| High | CVE-2026-97687 GHSA-8988-9cw3-xx77 | 8.1 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override | Not assessed |
| High | GHSA-537c-gmf6-5ccf | 7.5 | cryptography transitive | 46.0.3 | 48.0.1 | Vulnerable OpenSSL included in cryptography wheels | Not assessed |
| High | CVE-2026-119194 GHSA-fm9c-5rcf-2q5p | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.5 | pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding | Not assessed |
| High | CVE-2026-119195 GHSA-9m75-vc3g-4x39 | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.5 | pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data | Not assessed |
| High | CVE-2026-119196 GHSA-2qm8-x737-gmw5 | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.5 | pyasn1: pyasn1: Denial of Service via constructed bit string decoding | Not assessed |
| High | CVE-2026-119197 GHSA-mm57-4v3p-rchx | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.5 | pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding | Not assessed |
| High | CVE-2026-30922 GHSA-jr27-m4p2-rc6r | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.3 | pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion | Not assessed |
| High | CVE-2026-59884 GHSA-m4p7-r5rc-7g4j | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.4 | python-pyasn1: pyasn1: Denial of Service via crafted BER input | Not assessed |
| High | CVE-2026-59885 GHSA-8ppf-4f7h-5ppj | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.4 | pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER | Not assessed |
| High | CVE-2026-59886 GHSA-hm4w-wwcw-mr6r | 7.5 | pyasn1 transitive | 0.6.2 | 0.6.4 | pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values | Not assessed |
| High | CVE-2026-32597 GHSA-752w-5fwx-jx9f | 7.5 | pyjwt transitive | 2.10.1 | 2.12.0 | pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation) | Not assessed |
| High | CVE-2026-41608 GHSA-6pjx-3pjc-mrj8 | 7.5 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift Python bindings: Denial of Service via data amplification | Not assessed |
| High | CVE-2026-44432 GHSA-mf9v-mfxr-j63j | 7.5 | urllib3 transitive | 2.6.3 | 2.7.0 | urllib3: urllib3: Denial of Service due to excessive HTTP response decompression | Not assessed |
| High | CVE-2026-102271 GHSA-p4g4-x82p-q773 | 7.4 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets | Not assessed |
| High | CVE-2026-48526 GHSA-xgmm-8j9v-c9wx | 7.4 | pyjwt transitive | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens | Not assessed |
| High | GHSA-pxh4-856f-4h89 | 7.4 | pyjwt transitive | 2.10.1 | 2.14.0 | PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery | Not assessed |
| High | CVE-2026-44431 GHSA-qccp-gfcp-xxvc | 5.9 | urllib3 transitive | 2.6.3 | 2.7.0 | urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers | Not assessed |
| Medium | CVE-2026-39892 GHSA-p423-j2cm-9vmq | 9.8 | cryptography transitive | 46.0.3 | 46.0.7 | cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API | Not assessed |
| Medium | CVE-2026-102275 GHSA-x33g-cr3x-6449 | 8.2 | pyjwt transitive | 2.10.1 | 2.15.0 | pyjwt: PyJWT: Token verification bypass via mismatched OKP key components | Not assessed |
| Medium | CVE-2026-101917 GHSA-2gx3-rcp4-g85q | 7.5 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers | Not assessed |
| Medium | CVE-2026-101918 GHSA-42vr-xj54-vc7v | 7.5 | pyjwt transitive | 2.10.1 | 2.15.0 | pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload | Not assessed |
| Medium | CVE-2026-102274 GHSA-w6j9-cwv2-h6wq | 7.5 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set | Not assessed |
| Medium | CVE-2026-69248 GHSA-m2h6-j472-rp4c | 7.4 | cryptography transitive | 46.0.3 | 49.0.0 | python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees | Not assessed |
| Medium | CVE-2026-97688 GHSA-gh4c-6fx4-qh6g | 6.9 | urllib3 transitive | 2.6.3 | 2.8.0 | urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding | Not assessed |
| Medium | CVE-2026-49265 GHSA-xpv3-w29h-x7cv | 6.8 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery | Not assessed |
| Medium | CVE-2026-86597 GHSA-qqj6-54q6-cxv6 | 6.5 | snowflake-connector-python transitive | 4.2.0 | 4.7.3 | Snowflake drivers writes sensitive information to logs | Not assessed |
| Medium | CVE-2026-112909 GHSA-69hj-f68j-2879 | 6.1 | filelock transitive | 3.20.3 | 4.2.1 | filelock: filelock: arbitrary file truncation via lock path replacement | Not assessed |
| Medium | CVE-2026-49264 GHSA-hj66-6f7g-4r5v | 6.1 | oauthlib transitive | 3.3.1 | 4.0.0 | oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | Not assessed |
| Medium | CVE-2026-66053 GHSA-hwrj-9rr4-24xh | 5.9 | thrift transitive | 0.20.0 | 0.24.0 | thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation | Not assessed |
| Medium | CVE-2026-25645 GHSA-gc5v-m9x4-r6x2 | 5.5 | requests transitive | 2.32.5 | 2.33.0 | requests: Requests: Security bypass due to predictable temporary file creation | Not assessed |
| Medium | CVE-2026-102269 GHSA-hxm8-2xgr-2p9m | 5.4 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding | Not assessed |
| Medium | CVE-2026-48523 GHSA-jq35-7prp-9v3f | 5.4 | pyjwt transitive | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access | Not assessed |
| Medium | CVE-2026-112910 GHSA-8mx5-7m5m-r77g | 5.3 | filelock transitive | 3.20.3 | 4.2.1 | filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL | Not assessed |
| Medium | CVE-2026-45409 GHSA-65pc-fj4g-8rjx | 5.3 | idna transitive | 3.11 | 3.15 | python-idna: idna: Denial of Service via specially crafted long inputs | Not assessed |
| Medium | CVE-2026-48525 GHSA-w7vc-732c-9m39 | 5.3 | pyjwt transitive | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens | Not assessed |
| Medium | CVE-2026-102270 GHSA-jwrc-g2q2-pq5p | 4.9 | pyjwt transitive | 2.10.1 | 2.14.0 | pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format | Not assessed |
| Medium | CVE-2026-48522 GHSA-993g-76c3-p5m4 | 4.2 | pyjwt transitive | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient | Not assessed |
| Low | CVE-2026-48524 GHSA-fhv5-28vv-h8m8 | 5.9 | pyjwt transitive | 2.10.1 | 2.13.0 | python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs | Not assessed |
| Low | CVE-2026-27448 GHSA-vp96-hxj8-p424 | 5.4 | pyopenssl transitive | 25.3.0 | 26.0.0 | pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback | Not assessed |
| Low | CVE-2026-34073 GHSA-m959-cc7f-wv43 | 5.3 | cryptography transitive | 46.0.3 | 46.0.6 | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation | Not assessed |
Dependency licenses
undetermined