CVE-2026-7246
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.2
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-77, CWE-77, CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2026-26375
7.2
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
EUVD-2026-26375- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
NVD
7.2
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSVBELL-CVE-2026-7246
7.2
- Record
BELL-CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
7.2
[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-7246
7.2
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
DEBIAN-CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVOESA-2026-2302
7.2
python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.
Security Fix(es):
Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)
- Record
OESA-2026-2302- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2303
7.2
python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.
Security Fix(es):
Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)
- Record
OESA-2026-2303- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2304
7.2
python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.
Security Fix(es):
Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)
- Record
OESA-2026-2304- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2026-2305
7.2
python-click security update
Click is a Python package for creating beautiful command line interfaces in a composable way with as little code as necessary. It's the "Command Line Interface Creation Kit". It's highly configurable but comes with sensible defaults out of the box.
Security Fix(es):
Pallets Click, versions 8.3.2 and below, contains a command injection vulnerability in the click.edit() function. The vulnerability allows attackers to inject arbitrary OS commands through unsanitized filename parameters in the click.edit() function. Attackers can exploit this vulnerability to execute malicious commands from an unprivileged account, potentially leading to complete system compromise.(CVE-2026-7246)
- Record
OESA-2026-2305- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2026-2132
7.2
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
PYSEC-2026-2132- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:24761
7.8
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:24761- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:24762
8.1
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:24762- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-7246
7.2
(Pallets Click, versions 8.3.2 and below, contain a command injection v ...)
- Record
UBUNTU-CVE-2026-7246- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-86910 No score
CVE-2026-7246 affecting package python-click for versions less than 8.1.7-3
This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below:
Pallets Click, versions 8.3.2 and below, contain a command injection vulnerability in the click.edit() function, allowing attackers to pass arbitrary OS commands from an unprivileged account.
- Record
AZL-86910- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:10760-1 No score
python311-click-8.3.3-2.1 on GA media
These are all security issues fixed in the python311-click-8.3.3-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10760-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21017-1 No score
Security update for python-click
This update for python-click fixes the following issue
- CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
- Record
openSUSE-SU-2026:21017-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22254-1 No score
Security update for python-click
This update for python-click fixes the following issue
- CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
- Record
SUSE-SU-2026:22254-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22321-1 No score
Security update for python-click
This update for python-click fixes the following issue
- CVE-2026-7246: Arbitrary command execution via command injection in click.edit() (bsc#1263898).
- Record
SUSE-SU-2026:22321-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-clickAzure Linux:3 |
before 8.1.7-3 | 8.1.7-3 |
py3-clickAlpaquita:stream |
8.3.1-r0 up to 8.3.3-r0 | 8.3.3-r0 |
python-clickDebian:12 |
All versions, plus listed versions 8.1.3-28.1.6-18.1.6-28.1.7-18.1.7-2 Show 9 moreShow less8.1.8-18.1.8-28.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.2.0-18.3.3-18.3.3-1~exp18.3.3-28.3.3-3 |
None known |
python-clickDebian:13 |
All versions, plus listed versions 8.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.3.3-18.3.3-1~exp18.3.3-28.3.3-3 |
None known |
python-clickDebian:14 |
before 8.3.3-1, plus listed versions 8.2.0+0.really.8.1.8-18.2.0+0.really.8.1.8-28.3.3-1~exp1 |
8.3.3-1 |
python-clickopenEuler:24.03-LTS-SP1 |
before 8.1.7-2.oe2403sp1 | 8.1.7-2.oe2403sp1 |
python-clickopenEuler:24.03-LTS-SP3 |
before 8.1.7-2.oe2403sp3 | 8.1.7-2.oe2403sp3 |
python-clickopenEuler:22.03-LTS-SP4 |
before 8.0.4-2.oe2203sp4 | 8.0.4-2.oe2203sp4 |
python-clickopenEuler:24.03-LTS |
before 8.1.7-2.oe2403 | 8.1.7-2.oe2403 |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:2.5.20260422-3.el8ap | 0:2.5.20260422-3.el8ap |
Show 71 moreShow less
| Package | Affected | Fixed |
|---|---|---|
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:2.5.20260422-3.el9ap | 0:2.5.20260422-3.el9ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el8ap | 0:8.3.3-1.el8ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:4.6.29-2.el8ap | 0:4.6.29-2.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:4.6.29-2.el9ap | 0:4.6.29-2.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:2.5.10-6.el8ap | 0:2.5.10-6.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el8ap | 0:1.6.5-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el8ap | 0:46.0.7-1.el8ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el8 From an advisory covering 16 CVEs |
before 0:12.2.0-1.el8ap | 0:12.2.0-1.el8ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.5::el9 From an advisory covering 16 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.9-1.el9ap | 0:2.6.9-1.el9ap |
python3-clickRed Hat:ansible_automation_platform_developer:2.6::el10 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el10ap | 0:8.3.3-1.el10ap |
python3-clickRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el10ap | 0:8.3.3-1.el10ap |
python3.12-clickRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
python3.12-clickRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:8.3.3-1.el9ap | 0:8.3.3-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:4.7.12-1.el9ap | 0:4.7.12-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el10 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el10ap | 0:1.6.5-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
automation-gateway-proxyRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
automation-gateway-proxy-server-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:2.6.14-3.el9ap | 0:2.6.14-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptor-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptor-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
receptorctlRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:1.6.5-1.el9ap | 0:1.6.5-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform_developer:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform_inside:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptographyRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-cryptography-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:46.0.7-1.el9ap | 0:46.0.7-1.el9ap |
python3.12-pillowRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
python3.12-pillow-debuginfoRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
python3.12-pillow-debugsourceRed Hat:ansible_automation_platform:2.6::el9 From an advisory covering 12 CVEs |
before 0:12.2.0-1.el9ap | 0:12.2.0-1.el9ap |
python-clickSUSE:Linux Micro 6.2 |
before 8.2.1-160000.3.1 | 8.2.1-160000.3.1 |
python-clickSUSE:Linux Enterprise Server 16.0 |
before 8.2.1-160000.3.1 | 8.2.1-160000.3.1 |
python-clickSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 8.2.1-160000.3.1 | 8.2.1-160000.3.1 |
python-clickopenSUSE:Tumbleweed |
before 8.3.3-2.1 | 8.3.3-2.1 |
python-clickopenSUSE:Leap 16.0 |
before 8.2.1-160000.3.1 | 8.2.1-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-7246 is a high vulnerability (CVSS 7.2) in Pallets Click Click, published April 30, 2026. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 59th percentile. Fixed in python-click 8.1.7-3.
References
github.com/pallets/click/releases/tag/8.3.3
github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
access.redhat.com/security/cve/CVE-2026-7246
bugzilla.redhat.com/show_bug.cgi?id=2464121
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json
access.redhat.com/errata/RHSA-2026:24762
Show 135 moreShow less
access.redhat.com/errata/RHSA-2026:24761
nvd.nist.gov/vuln/detail/CVE-2026-7246
docs.bell-sw.com/security/cves/CVE-2026-7246
github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7246.json
security-tracker.debian.org/tracker/CVE-2026-7246
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2302
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2303
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2304
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-2305
access.redhat.com/security/updates/classification
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5
bugzilla.redhat.com/show_bug.cgi?id=2441268
bugzilla.redhat.com/show_bug.cgi?id=2442922
bugzilla.redhat.com/show_bug.cgi?id=2448553
bugzilla.redhat.com/show_bug.cgi?id=2451867
bugzilla.redhat.com/show_bug.cgi?id=2452450
bugzilla.redhat.com/show_bug.cgi?id=2452457
bugzilla.redhat.com/show_bug.cgi?id=2452458
bugzilla.redhat.com/show_bug.cgi?id=2452464
bugzilla.redhat.com/show_bug.cgi?id=2456179
bugzilla.redhat.com/show_bug.cgi?id=2456336
bugzilla.redhat.com/show_bug.cgi?id=2456338
bugzilla.redhat.com/show_bug.cgi?id=2456339
bugzilla.redhat.com/show_bug.cgi?id=2456735
bugzilla.redhat.com/show_bug.cgi?id=2456913
bugzilla.redhat.com/show_bug.cgi?id=2458856
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24761.json
access.redhat.com/security/cve/CVE-2025-62718
cve.org/CVERecord?id=CVE-2025-62718
nvd.nist.gov/vuln/detail/CVE-2025-62718
datatracker.ietf.org/doc/html/rfc1034
datatracker.ietf.org/doc/html/rfc3986
github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df
github.com/axios/axios/pull/10661
github.com/axios/axios/releases/tag/v1.15.0
github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5
access.redhat.com/security/cve/CVE-2026-4926
cve.org/CVERecord?id=CVE-2026-4926
nvd.nist.gov/vuln/detail/CVE-2026-4926
cna.openjsf.org/security-advisories.html
cve.org/CVERecord?id=CVE-2026-7246
access.redhat.com/security/cve/CVE-2026-26996
cve.org/CVERecord?id=CVE-2026-26996
nvd.nist.gov/vuln/detail/CVE-2026-26996
github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5
github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26
access.redhat.com/security/cve/CVE-2026-27904
cve.org/CVERecord?id=CVE-2026-27904
nvd.nist.gov/vuln/detail/CVE-2026-27904
github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74
access.redhat.com/security/cve/CVE-2026-30922
cve.org/CVERecord?id=CVE-2026-30922
nvd.nist.gov/vuln/detail/CVE-2026-30922
github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
access.redhat.com/security/cve/CVE-2026-32280
cve.org/CVERecord?id=CVE-2026-32280
nvd.nist.gov/vuln/detail/CVE-2026-32280
go.dev/cl/758320
go.dev/issue/78282
groups.google.com/g/golang-announce/c/0uYbvbPZRWU
pkg.go.dev/vuln/GO-2026-4947
access.redhat.com/security/cve/CVE-2026-32282
cve.org/CVERecord?id=CVE-2026-32282
nvd.nist.gov/vuln/detail/CVE-2026-32282
go.dev/cl/763761
go.dev/issue/78293
pkg.go.dev/vuln/GO-2026-4864
access.redhat.com/security/cve/CVE-2026-32283
cve.org/CVERecord?id=CVE-2026-32283
nvd.nist.gov/vuln/detail/CVE-2026-32283
go.dev/cl/763767
go.dev/issue/78334
pkg.go.dev/vuln/GO-2026-4870
access.redhat.com/security/cve/CVE-2026-33891
cve.org/CVERecord?id=CVE-2026-33891
nvd.nist.gov/vuln/detail/CVE-2026-33891
github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023
github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx
access.redhat.com/security/cve/CVE-2026-33894
cve.org/CVERecord?id=CVE-2026-33894
nvd.nist.gov/vuln/detail/CVE-2026-33894
datatracker.ietf.org/doc/html/rfc2313
github.com/digitalbazaar/forge/security/advisories/GHSA-ppp5-5v6c-4jwp
mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE
rfc-editor.org/rfc/rfc8017.html
access.redhat.com/security/cve/CVE-2026-33895
cve.org/CVERecord?id=CVE-2026-33895
nvd.nist.gov/vuln/detail/CVE-2026-33895
datatracker.ietf.org/doc/html/rfc8032
github.com/digitalbazaar/forge/commit/bdecf11571c9f1a487cc0fe72fe78ff6dfa96b85
github.com/digitalbazaar/forge/security/advisories/GHSA-q67f-28xg-22rw
access.redhat.com/security/cve/CVE-2026-33896
cve.org/CVERecord?id=CVE-2026-33896
nvd.nist.gov/vuln/detail/CVE-2026-33896
github.com/digitalbazaar/forge/commit/2e492832fb25227e6b647cbe1ac981c123171e90
github.com/digitalbazaar/forge/security/advisories/GHSA-2328-f5f3-gj25
access.redhat.com/security/cve/CVE-2026-39363
cve.org/CVERecord?id=CVE-2026-39363
nvd.nist.gov/vuln/detail/CVE-2026-39363
github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583
access.redhat.com/security/cve/CVE-2026-39892
cve.org/CVERecord?id=CVE-2026-39892
nvd.nist.gov/vuln/detail/CVE-2026-39892
openwall.com/lists/oss-security/2026/04/08/12
github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5
github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq
access.redhat.com/security/cve/CVE-2026-40192
cve.org/CVERecord?id=CVE-2026-40192
nvd.nist.gov/vuln/detail/CVE-2026-40192
github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628
github.com/python-pillow/Pillow/pull/9521
github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j
pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6
bugzilla.redhat.com/show_bug.cgi?id=2453496
bugzilla.redhat.com/show_bug.cgi?id=2457432
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24762.json
access.redhat.com/security/cve/CVE-2026-4800
cve.org/CVERecord?id=CVE-2026-4800
nvd.nist.gov/vuln/detail/CVE-2026-4800
github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
access.redhat.com/security/cve/CVE-2026-40175
cve.org/CVERecord?id=CVE-2026-40175
nvd.nist.gov/vuln/detail/CVE-2026-40175
github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1
github.com/axios/axios/pull/10660
github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx
suse.com/support/update/announcement/2026/suse-su-202622254-1
bugzilla.suse.com/1263898
suse.com/security/cve/CVE-2026-7246
suse.com/support/update/announcement/2026/suse-su-202622321-1
ubuntu.com/security/CVE-2026-7246