{"id":"CVE-2026-49825","aliases":["ALSA-2026:66203","ALSA-2026:66204","ALSA-2026:67943","AZL-96857","BELL-CVE-2026-49825","CLSA-2026-1792809744","CLSA-2026-1792809858","DEBIAN-CVE-2026-49825","EUVD-2026-63390","GHSA-4jhm-jv67-739f","OESA-2026-3217","PYSEC-2026-2614","RHSA-2026:66203","RHSA-2026:66204","RHSA-2026:67324","RHSA-2026:67325","RHSA-2026:67326","RHSA-2026:67943","RHSA-2026:74081","RHSA-2026:74082","RHSA-2026:74505","RHSA-2026:74506","RHSA-2026:84592","RHSA-2026:84593","RLSA-2026:66203","RLSA-2026:66204","RLSA-2026:67943","SUSE-SU-2026:4580-1","SUSE-SU-2026:4581-1","SUSE-SU-2026:4582-1","SUSE-SU-2026:4583-1","SUSE-SU-2026:4584-1","SUSE-SU-2026:4585-1","UBUNTU-CVE-2026-49825","USN-8897-1","openSUSE-SU-2026:11147-1","openSUSE-SU-2026:11191-1"],"status":"published","title":"lxml: javascript: URL bypass in Cleaner via xlink:href","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00297,"percentile":0.22622,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-184","CWE-79"],"published":"2026-06-29T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"lxml-html-clean","fixed_in":["0.4.5"],"sources":["ghsa","osv"]},{"ecosystem":"AlmaLinux:9","package":"python3.12-lxml","fixed_in":["4.9.3-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"python3-lxml","fixed_in":["4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"python3-lxml","fixed_in":["4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-lxml","fixed_in":["4.9.3-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-lxml","fixed_in":["4.9.3-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-lxml","fixed_in":["5.3.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-lxml","fixed_in":["6.1.1-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"python-lxml","fixed_in":["3.2.1-4.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:7","package":"python-lxml-docs","fixed_in":["3.2.1-4.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"python-lxml","fixed_in":["3.2.1-4.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:RHEL:7","package":"python-lxml-docs","fixed_in":["3.2.1-4.el7.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"lxml","fixed_in":["4.9.2-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml","fixed_in":["6.1.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lxml-html-clean","fixed_in":["0.4.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-lxml","fixed_in":["5.1.0-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"python-lxml","fixed_in":["5.1.0-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"python-lxml","fixed_in":["5.1.0-5.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-lxml","fixed_in":["4.5.2-11.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-lxml","fixed_in":["4.7.1-10.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml","fixed_in":["0:4.9.3-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml-debuginfo","fixed_in":["0:4.9.3-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml-debugsource","fixed_in":["0:4.9.3-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml","fixed_in":["0:4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml","fixed_in":["0:4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-lxml","fixed_in":["0:4.6.5-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.6.5-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-lxml","fixed_in":["0:4.6.5-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.6.5-3.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python-lxml","fixed_in":["0:4.6.5-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.6.5-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-lxml","fixed_in":["0:4.6.5-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.6.5-3.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-lxml","fixed_in":["0:4.6.5-3.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.6.5-3.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-lxml","fixed_in":["0:4.6.5-3.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.6.5-3.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-lxml","fixed_in":["0:4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lxml","fixed_in":["0:4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml","fixed_in":["0:4.9.3-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml-debuginfo","fixed_in":["0:4.9.3-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml-debugsource","fixed_in":["0:4.9.3-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml","fixed_in":["0:4.9.3-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml-debuginfo","fixed_in":["0:4.9.3-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml-debugsource","fixed_in":["0:4.9.3-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-lxml","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-lxml","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-lxml","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-lxml","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.2.3-4.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-lxml","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-lxml","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-lxml","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-lxml-debugsource","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-lxml","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-lxml-debuginfo","fixed_in":["0:4.2.3-4.el8_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python3.12-lxml","fixed_in":["0:4.9.3-2.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"python-lxml","fixed_in":["0:4.6.5-3.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"python-lxml","fixed_in":["0:4.2.3-5.el8_10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lxml","fixed_in":["3.3.3-1ubuntu0.2+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxml","fixed_in":["3.5.0-1ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxml","fixed_in":["4.2.1-1ubuntu0.6+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lxml","fixed_in":["4.5.0-1ubuntu0.5+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"lxml","fixed_in":["4.8.0-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"lxml","fixed_in":["5.2.1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"lxml","fixed_in":["6.0.2-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-lxml_html_clean","fixed_in":["0.4.5-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3.12-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.1-r1"},{"fixed":"4.9.3-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.1-r0"},{"fixed":"5.3.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.9.1-r1"},{"fixed":"6.1.1-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"python-lxml-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"python-lxml-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-4.el7.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1+deb12u1"}]}],"versions":["4.9.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1","6.0.1-1","6.0.2-1","6.1.0-1","6.1.3-1","6.1.3-1.1","7.0.0~a2-1","7.0.0~b1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.3-1"}]}],"versions":["5.4.0-1","6.0.1-1","6.0.2-1","6.1.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.2-1","0.4.3-1","0.4.4-1","0.4.4-1~deb13u1","0.4.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5-1"}]}],"versions":["0.4.2-1","0.4.3-1","0.4.4-1","0.4.4-1~deb13u1"]},{"source":"osv","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-5.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-11.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.1-10.oe2203sp4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"lxml-html-clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5"}]}],"versions":["0.1.0","0.1.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3.12-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"python3.12-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"python3.12-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:15.0.2-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0.22-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-2.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.0.20-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.17::el9","package":"satellite-obsolete-packages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.17.12-1.el9sat"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-foreman_remote_execution-cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.8-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-hammer_cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-dynaconf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.13-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"yggdrasil-worker-forwarder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.0-2.1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el8pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el8","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el8sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-capsule","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-gitpython","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.62-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.2-5.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-pulpcore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.49.39-4.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"python3.11-sqlparse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-1.el9pc"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.0.23-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"rubygem-safemode","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-2.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:satellite:6.16::el9","package":"satellite-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.16.14-1.el9sat"}]}],"bundled":31},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python-lxml-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"python3-lxml-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-4.el8_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python3.12-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.9.3-2.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.6.5-3.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.3-5.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-100002.1.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-100002.1.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-10:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-100002.1.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-100002.1.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-10","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-100002.1.13.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-80002.4.15.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-80002.3.3.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-80002.3.6.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-80002.3.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-80002.5.3.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-80002.3.9.5"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-80002.3.3.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-80002.3.9.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-80002.4.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-80002.4.12.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-80002.3.6.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-8:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-80002.3.12.4"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-80002.3.15.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-8","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-80002.5.22.3"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-90002.4.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-90002.3.6.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-90002.3.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-90002.5.3.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-90002.3.9.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-90002.3.3.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-90002.3.9.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-90002.4.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-90002.4.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-90002.3.6.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:EL-9:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"scap-security-guide","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.80-90002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-90002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools EL-9","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-90002.5.22.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.15-70002.4.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cryptography","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-cssselect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-editables","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-exceptiongroup-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-flit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-fancy-pypi-readme-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatch-vcs-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-hatchling","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-idna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10-70002.3.6.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-iniconfig-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-70002.3.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.6-70002.5.3.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.1-70002.3.3.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.3-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyasn1-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyopenssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.0-70002.3.9.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-pyparsing","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-requests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34.2-70002.4.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-tornado","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.3.2-70002.4.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"saltbundlepy-websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0-70002.3.6.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:RES-7:Update:Products:MultiLinuxManagerTools:Update","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-70002.3.12.2"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-70002.3.15.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-70002.3.12.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools RES-7","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-70002.5.22.1"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-120002.3.15.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-120002.3.12.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-120002.3.18.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-12","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-120002.5.22.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.2-150002.3.19.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.4.10-150002.4.27.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"mgr-push","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.5-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacecmd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.10-150002.3.15.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"spacewalk-client-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.7-150002.3.12.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-15","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"uyuni-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.17-150002.3.20.1"}]}],"bundled":58},{"source":"osv","ecosystem":"SUSE:Multi Linux Manager Tools SLE-Micro-5","package":"venv-salt-minion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3006.0-150002.5.22.1"}]}],"bundled":58},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1ubuntu0.2+esm6"}]}],"versions":["3.2.0-1","3.3.0~beta2-1","3.3.0~beta4-1","3.3.1-1","3.3.2-1","3.3.2-1build1","3.3.3-1","3.3.3-1ubuntu0.1","3.3.3-1ubuntu0.2","3.3.3-1ubuntu0.2+esm1","3.3.3-1ubuntu0.2+esm2","3.3.3-1ubuntu0.2+esm3","3.3.3-1ubuntu0.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.4+esm3"}]}],"versions":["3.4.4-1","3.5.0-1","3.5.0-1build1","3.5.0-1ubuntu0.1","3.5.0-1ubuntu0.2","3.5.0-1ubuntu0.3","3.5.0-1ubuntu0.4","3.5.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu0.6+esm1"}]}],"versions":["4.0.0-1","4.1.0-1","4.2.0-1","4.2.1-1","4.2.1-1ubuntu0.1","4.2.1-1ubuntu0.2","4.2.1-1ubuntu0.3","4.2.1-1ubuntu0.4","4.2.1-1ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1ubuntu0.5+esm1"}]}],"versions":["4.4.1-1","4.4.1-1build1","4.4.2-1","4.5.0-1","4.5.0-1ubuntu0.1","4.5.0-1ubuntu0.2","4.5.0-1ubuntu0.3","4.5.0-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-1ubuntu0.1"}]}],"versions":["4.6.3+dfsg-0.1","4.6.4-1","4.6.4-1ubuntu1","4.7.1-1","4.8.0-1","4.8.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.2"}]}],"versions":["4.9.3-1","4.9.3-1build1","4.9.4-1","5.1.0-1","5.1.0-1build1","5.1.0-1build2","5.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1ubuntu0.1"}]}],"versions":["6.0.1-1","6.0.1-1build1","6.0.2-1","6.0.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-1ubuntu0.2+esm6"}]}],"versions":["3.2.0-1","3.3.0~beta2-1","3.3.0~beta4-1","3.3.1-1","3.3.2-1","3.3.2-1build1","3.3.3-1","3.3.3-1ubuntu0.1","3.3.3-1ubuntu0.2","3.3.3-1ubuntu0.2+esm1","3.3.3-1ubuntu0.2+esm2","3.3.3-1ubuntu0.2+esm3","3.3.3-1ubuntu0.2+esm5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0-1ubuntu0.4+esm3"}]}],"versions":["3.4.4-1","3.5.0-1","3.5.0-1build1","3.5.0-1ubuntu0.1","3.5.0-1ubuntu0.2","3.5.0-1ubuntu0.3","3.5.0-1ubuntu0.4","3.5.0-1ubuntu0.4+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1ubuntu0.6+esm1"}]}],"versions":["4.0.0-1","4.1.0-1","4.2.0-1","4.2.1-1","4.2.1-1ubuntu0.1","4.2.1-1ubuntu0.2","4.2.1-1ubuntu0.3","4.2.1-1ubuntu0.4","4.2.1-1ubuntu0.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-1ubuntu0.5+esm1"}]}],"versions":["4.4.1-1","4.4.1-1build1","4.4.2-1","4.5.0-1","4.5.0-1ubuntu0.1","4.5.0-1ubuntu0.2","4.5.0-1ubuntu0.3","4.5.0-1ubuntu0.5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-1ubuntu0.1"}]}],"versions":["4.6.3+dfsg-0.1","4.6.4-1","4.6.4-1ubuntu1","4.7.1-1","4.8.0-1","4.8.0-1build1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.2"}]}],"versions":["4.9.3-1","4.9.3-1build1","4.9.4-1","5.1.0-1","5.1.0-1build1","5.1.0-1build2","5.2.1-1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1ubuntu0.1"}]}],"versions":["6.0.1-1","6.0.1-1build1","6.0.2-1","6.0.2-1build1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-lxml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-lxml_html_clean","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.5-1.1"}]}]}],"products":[{"vendor":"fedora-python","product":"lxml_html_clean"},{"vendor":"lxml","product":"lxml"}],"references":[{"url":"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f","tags":["x_refsource_CONFIRM","exploit","advisory","web","article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/commit/322357ac61c6cf80fcbaba53b4e92e31f3ded9f2","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/fedora-python/lxml_html_clean/releases/tag/0.4.5","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/lxml/lxml/releases/tag/lxml-6.1.1","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/advisories/GHSA-4jhm-jv67-739f","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66203","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49825","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520368","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-66203.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66204","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-66204.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67943","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-67943.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49825","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-49825","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792809744.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792809858.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49825.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49825","tags":["advisory"]},{"url":"https://github.com/fedora-python/lxml_html_clean","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3217","tags":["advisory"]},{"url":"https://pypi.org/project/lxml-html-clean","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520368","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66203.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49825","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66204.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67324","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67324.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67325","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67325.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67326","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67326.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67943.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74081","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74081.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74082","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74082.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74505","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490542","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515269","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2523348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2530744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2534185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536844","tags":["report"]},{"url":"https://issues.redhat.com/browse/SAT-50544","tags":["article"]},{"url":"https://issues.redhat.com/browse/SAT-50545","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74505.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12405","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12423","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12423","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12423","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12540","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12540","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12541","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12541","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12541","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12542","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12542","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12542","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12544","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-12545","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33154","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33154","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33154","tags":["advisory"]},{"url":"https://github.com/dynaconf/dynaconf/commit/2fbb45ee36b8c0caa5b924fe19f3c1a5e8603fa7","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/releases/tag/3.2.13","tags":["article"]},{"url":"https://github.com/dynaconf/dynaconf/security/advisories/GHSA-pxrr-hq57-q35p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33818","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","tags":["advisory"]},{"url":"https://go.dev/cl/814980","tags":["article"]},{"url":"https://go.dev/issue/80405","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/94pEornpRlI","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5972","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42215","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42504","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","tags":["advisory"]},{"url":"https://go.dev/cl/774481","tags":["article"]},{"url":"https://go.dev/issue/79217","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-5038","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54284","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/939b129e24c0ad5d51368b1aa72fffcaca76f06f","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-pwgv-4x5q-6m9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56097","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56098","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56098","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56853","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","tags":["advisory"]},{"url":"https://go.dev/cl/795540","tags":["article"]},{"url":"https://go.dev/issue/80205","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","tags":["advisory"]},{"url":"https://go.dev/cl/807100","tags":["article"]},{"url":"https://go.dev/issue/80435","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","tags":["advisory"]},{"url":"https://go.dev/cl/803681","tags":["article"]},{"url":"https://go.dev/issue/80494","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","tags":["advisory"]},{"url":"https://go.dev/cl/804261","tags":["article"]},{"url":"https://go.dev/issue/80528","tags":["article"]},{"url":"https://pkg.go.dev/vuln/GO-2026-6090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59893","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59893","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/d1d80602741f77ec78e5a04ce4719244cf32352e","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-prg7-hcfm-mfcr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71491","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-71491","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71491","tags":["advisory"]},{"url":"https://github.com/andialbrecht/sqlparse/commit/ef2012a5eeb491e604dea2b00d516904a3830c87","tags":["article"]},{"url":"https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-f2ff-p2ww-7p4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73620","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73622","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73622","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73622","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2","tags":["article"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73623","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73623","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73623","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73624","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73624","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73624","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73625","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-78679","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-78679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-79654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-79654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79654","tags":["advisory"]},{"url":"https://github.com/Katello/katello/pull/11847","tags":["article"]},{"url":"https://projects.theforeman.org/issues/39701","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87817","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817","tags":["advisory"]},{"url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-96659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-96659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96659","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74506","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_74506.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84592","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84592.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84593","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_84593.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66203","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66204","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67943","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264580-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1218722","tags":["report"]},{"url":"https://bugzilla.suse.com/1252286","tags":["report"]},{"url":"https://bugzilla.suse.com/1254400","tags":["report"]},{"url":"https://bugzilla.suse.com/1257151","tags":["report"]},{"url":"https://bugzilla.suse.com/1257599","tags":["report"]},{"url":"https://bugzilla.suse.com/1259989","tags":["report"]},{"url":"https://bugzilla.suse.com/1261969","tags":["report"]},{"url":"https://bugzilla.suse.com/1261970","tags":["report"]},{"url":"https://bugzilla.suse.com/1262098","tags":["report"]},{"url":"https://bugzilla.suse.com/1262319","tags":["report"]},{"url":"https://bugzilla.suse.com/1262429","tags":["report"]},{"url":"https://bugzilla.suse.com/1262492","tags":["report"]},{"url":"https://bugzilla.suse.com/1262654","tags":["report"]},{"url":"https://bugzilla.suse.com/1262803","tags":["report"]},{"url":"https://bugzilla.suse.com/1263254","tags":["report"]},{"url":"https://bugzilla.suse.com/1263442","tags":["report"]},{"url":"https://bugzilla.suse.com/1263822","tags":["report"]},{"url":"https://bugzilla.suse.com/1263823","tags":["report"]},{"url":"https://bugzilla.suse.com/1264962","tags":["report"]},{"url":"https://bugzilla.suse.com/1265267","tags":["report"]},{"url":"https://bugzilla.suse.com/1265268","tags":["report"]},{"url":"https://bugzilla.suse.com/1265413","tags":["report"]},{"url":"https://bugzilla.suse.com/1266481","tags":["report"]},{"url":"https://bugzilla.suse.com/1266669","tags":["report"]},{"url":"https://bugzilla.suse.com/1267261","tags":["report"]},{"url":"https://bugzilla.suse.com/1267581","tags":["report"]},{"url":"https://bugzilla.suse.com/1267821","tags":["report"]},{"url":"https://bugzilla.suse.com/1267980","tags":["report"]},{"url":"https://bugzilla.suse.com/1268325","tags":["report"]},{"url":"https://bugzilla.suse.com/1268395","tags":["report"]},{"url":"https://bugzilla.suse.com/1268396","tags":["report"]},{"url":"https://bugzilla.suse.com/1268397","tags":["report"]},{"url":"https://bugzilla.suse.com/1268649","tags":["report"]},{"url":"https://bugzilla.suse.com/1268755","tags":["report"]},{"url":"https://bugzilla.suse.com/1268977","tags":["report"]},{"url":"https://bugzilla.suse.com/1269066","tags":["report"]},{"url":"https://bugzilla.suse.com/1269788","tags":["report"]},{"url":"https://bugzilla.suse.com/1269959","tags":["report"]},{"url":"https://bugzilla.suse.com/1270033","tags":["report"]},{"url":"https://bugzilla.suse.com/1270285","tags":["report"]},{"url":"https://bugzilla.suse.com/1270398","tags":["report"]},{"url":"https://bugzilla.suse.com/1270399","tags":["report"]},{"url":"https://bugzilla.suse.com/1271192","tags":["report"]},{"url":"https://bugzilla.suse.com/1271428","tags":["report"]},{"url":"https://bugzilla.suse.com/1271613","tags":["report"]},{"url":"https://bugzilla.suse.com/1273094","tags":["report"]},{"url":"https://bugzilla.suse.com/1273144","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-0864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-3479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-4786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8643","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264581-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264582-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264583-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230949","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264584-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264585-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1262187","tags":["report"]},{"url":"https://bugzilla.suse.com/1263330","tags":["report"]},{"url":"https://bugzilla.suse.com/1265525","tags":["report"]},{"url":"https://bugzilla.suse.com/1265763","tags":["report"]},{"url":"https://bugzilla.suse.com/1266608","tags":["report"]},{"url":"https://bugzilla.suse.com/1267528","tags":["report"]},{"url":"https://bugzilla.suse.com/1267534","tags":["report"]},{"url":"https://bugzilla.suse.com/1267538","tags":["report"]},{"url":"https://bugzilla.suse.com/1268868","tags":["report"]},{"url":"https://bugzilla.suse.com/1269841","tags":["report"]},{"url":"https://bugzilla.suse.com/1269856","tags":["report"]},{"url":"https://bugzilla.suse.com/1269966","tags":["report"]},{"url":"https://bugzilla.suse.com/1270711","tags":["report"]},{"url":"https://bugzilla.suse.com/1271330","tags":["report"]},{"url":"https://bugzilla.suse.com/1271557","tags":["report"]},{"url":"https://bugzilla.suse.com/1272008","tags":["report"]},{"url":"https://bugzilla.suse.com/1272102","tags":["report"]},{"url":"https://bugzilla.suse.com/1272328","tags":["report"]},{"url":"https://bugzilla.suse.com/1272427","tags":["report"]},{"url":"https://bugzilla.suse.com/1274217","tags":["report"]},{"url":"https://bugzilla.suse.com/1274221","tags":["report"]},{"url":"https://bugzilla.suse.com/1275205","tags":["report"]},{"url":"https://bugzilla.suse.com/1275206","tags":["report"]},{"url":"https://bugzilla.suse.com/1275207","tags":["report"]},{"url":"https://bugzilla.suse.com/1275934","tags":["report"]},{"url":"https://bugzilla.suse.com/1276426","tags":["report"]},{"url":"https://bugzilla.suse.com/1276658","tags":["report"]},{"url":"https://bugzilla.suse.com/1276973","tags":["report"]},{"url":"https://bugzilla.suse.com/1277025","tags":["report"]},{"url":"https://bugzilla.suse.com/1278307","tags":["report"]},{"url":"https://bugzilla.suse.com/1278322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-1229","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42342","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8609","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9029","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-49825","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8897-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-41066","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-7424","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-49825","title":"lxml: javascript: URL bypass in Cleaner via xlink:href","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T14:42:30.748Z","modified":"2026-08-21T16:41:54.849Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T13:35:10.963527Z"}],"euvd":[{"id":"EUVD-2026-63390","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T14:42:30Z","modified":"2026-08-21T16:41:54Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:37.198267Z"}],"ghsa":[{"id":"GHSA-4jhm-jv67-739f","title":"`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes","description":"# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e · **Date:** 2026-05-10\n**Affected:** `lxml` ≤ 6.1.0 and `lxml_html_clean` ≤ 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 — bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, …) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` — a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing — `\u003ca xlink:href=\"javascript:…\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 – 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module — bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra — shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    'action', 'archive', 'background', 'cite', 'classid',\n    'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n    'usemap', 'dynsrc', 'lowsrc', 'formaction',\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    '\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e',\n    '\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e',\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print('  iterlinks:', list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable — same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` — typically because the application wants to allow custom data-/aria-/vendor attributes — will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim — the parsed key is the literal string `xlink:href`, not a Clark-notation form — so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     'action', 'archive', 'background', 'cite', 'classid',\n     'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n     'usemap', 'dynsrc', 'lowsrc', 'formaction',\n+    'xlink:href',\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn't depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py — supplements rewrite_links() in __call__\n_NS_URL_ATTRS = ('xlink:href',)  # extend as needed\n_BAD_SCHEME = re.compile(r'^\\s*(javascript|vbscript|data):', re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, …` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** — `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (→ 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire — verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:…\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` → `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** — same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) — `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`'s own README for security-sensitive use) is **not vulnerable** to this primitive — verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` — `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 — private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You're welcome to coordinate with them directly if you'd prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.","status":"published","published":"2026-07-08T20:23:22Z","modified":"2026-07-08T20:23:23Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:40:41.501474Z"}],"nvd":[{"id":"CVE-2026-49825","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T15:17:30.707Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-79","CWE-184"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"BELL-CVE-2026-49825","status":"published","published":"2026-08-22T06:05:48.34275Z","modified":"2026-09-04T07:15:17.045829745Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:24.391068Z"},{"id":"CVE-2026-49825","title":"lxml: javascript: URL bypass in Cleaner via xlink:href","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T14:42:30.748Z","modified":"2026-11-11T10:47:31.433084874Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"DEBIAN-CVE-2026-49825","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T15:17:30.707Z","modified":"2026-10-27T10:01:43.693504861Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"GHSA-4jhm-jv67-739f","title":"`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes","description":"# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e · **Date:** 2026-05-10\n**Affected:** `lxml` ≤ 6.1.0 and `lxml_html_clean` ≤ 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 — bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, …) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` — a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing — `\u003ca xlink:href=\"javascript:…\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 – 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module — bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra — shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    'action', 'archive', 'background', 'cite', 'classid',\n    'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n    'usemap', 'dynsrc', 'lowsrc', 'formaction',\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    '\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e',\n    '\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e',\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print('  iterlinks:', list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable — same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` — typically because the application wants to allow custom data-/aria-/vendor attributes — will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim — the parsed key is the literal string `xlink:href`, not a Clark-notation form — so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     'action', 'archive', 'background', 'cite', 'classid',\n     'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n     'usemap', 'dynsrc', 'lowsrc', 'formaction',\n+    'xlink:href',\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn't depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py — supplements rewrite_links() in __call__\n_NS_URL_ATTRS = ('xlink:href',)  # extend as needed\n_BAD_SCHEME = re.compile(r'^\\s*(javascript|vbscript|data):', re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, …` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** — `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (→ 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire — verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:…\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` → `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** — same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) — `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`'s own README for security-sensitive use) is **not vulnerable** to this primitive — verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` — `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 — private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You're welcome to coordinate with them directly if you'd prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.","status":"published","published":"2026-07-08T20:23:22Z","modified":"2026-07-13T16:42:41.379452174Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-184","CWE-79"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"OESA-2026-3217","title":"python-lxml security update","description":"\\\r\n\r\nSecurity Fix(es):\n\nlxml_html_clean.Cleaner does not strip javascript: URLs from namespaced URL attributes (xlink:href). The vulnerability exists because Cleaner filters URL schemes by walking links via rewrite_links(), which delegates to iterlinks(), which only yields attributes named in lxml.html.defs.link_attrs. That allow-list contains no prefixed names such as xlink:href. As a result, when Cleaner is configured with safe_attrs_only=False, an xlink:href attribute carrying a javascript: URL survives sanitization untouched, and any browser that follows the SVG or MathML anchor specification will execute the JavaScript when the rendered link is clicked, leading to Cross-Site Scripting (XSS) attacks.(CVE-2026-49825)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.010491006Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"PYSEC-2026-2614","title":"`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes","description":"# `lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes (`xlink:href`)\n\n**Reporter:** Guillem Lefait \u003cguillem@datamq.com\u003e · **Date:** 2026-05-10\n**Affected:** `lxml` ≤ 6.1.0 and `lxml_html_clean` ≤ 0.4.4 (latest stable)\n**Confirmed against:** lxml 6.1.0 + lxml_html_clean 0.4.4 on Python 3.13.5, 3.14.4, and 3.15.0a8 (libxml2 2.14.6 / 2.9.14 — bug is in pure-Python sanitizer logic, independent of the libxml2 backend)\n**Root-cause class:** same as CVE-2021-28957 (`formaction` missing from `link_attrs`)\n\n## Summary\n\n`Cleaner` filters URL schemes (`javascript:`, `vbscript:`, …) by walking links via `rewrite_links()`, which delegates to `iterlinks()`, which only yields attributes named in `lxml.html.defs.link_attrs`. That allow-list contains no prefixed names (`xlink:href`) and no `srcset`. As a result, when `Cleaner` is configured with `safe_attrs_only=False` — a documented option for callers that want lenient attribute handling but still expect URL-scheme scrubbing — `\u003ca xlink:href=\"javascript:…\"\u003e` survives sanitization untouched, and any browser that follows the SVG-anchor specification will execute the JavaScript when the rendered link is clicked.\n\n**CWE:** CWE-79 (XSS), with CWE-184 (Incomplete List of Disallowed Inputs) as the underlying defect class.\n\n## Affected components\n\n| Package            | Versions tested        | File / line                      |\n|--------------------|------------------------|----------------------------------|\n| `lxml`             | 4.9.x, 5.2.1, 6.1.0    | `src/lxml/html/defs.py:20`       |\n| `lxml`             | \"                      | `src/lxml/html/__init__.py:485-528` |\n| `lxml_html_clean`  | 0.4.0 – 0.4.4          | `lxml_html_clean/clean.py:348,576` |\n\nThe legacy `lxml.html.clean` module — bundled in `lxml \u003c 5.2.0` and still installable on newer versions via the `lxml[html_clean]` extra — shares the same bug.\n\n## Root cause\n\n`defs.link_attrs` is a flat string set; the literal `xlink:href` is absent:\n\n```python\n# lxml/html/defs.py\nlink_attrs = frozenset([\n    'action', 'archive', 'background', 'cite', 'classid',\n    'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n    'usemap', 'dynsrc', 'lowsrc', 'formaction',\n])\n```\n\n`HtmlMixin.iterlinks()` (`lxml/html/__init__.py:526-528`) only yields attributes whose key is in that set:\n\n```python\nfor attrib in link_attrs:\n    if attrib in attribs:\n        yield (el, attrib, attribs[attrib], 0)\n```\n\n`Cleaner.__call__` registers the URL-scheme filter via `rewrite_links` (`lxml_html_clean/clean.py:348`), which is a thin wrapper around `iterlinks()`. Because `xlink:href` is never yielded, `_remove_javascript_link` (`clean.py:576`) is never invoked for it.\n\n## Minimal reproducer\n\n```python\nfrom lxml import html\nfrom lxml_html_clean import Cleaner\n\nfor payload in (\n    '\u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e',\n    '\u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e',\n):\n    tree = html.fromstring(payload)\n    Cleaner(safe_attrs_only=False)(tree)\n    print(html.tostring(tree).decode())\n    print('  iterlinks:', list(html.fromstring(payload).iterlinks()))\n# \u003csvg\u003e\u003ca xlink:href=\"javascript:alert(1)\"\u003ex\u003c/a\u003e\u003c/svg\u003e     ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n# \u003cmath\u003e\u003ca xlink:href=\"javascript:alert(2)\"\u003ey\u003c/a\u003e\u003c/math\u003e   ← unchanged\n#   iterlinks: []                                          ← link rewriter blind\n```\n\nBoth SVG and MathML scopes are vulnerable — same allow-list gap, both render anchors that browsers treat as navigable. Other lab-confirmed surviving variants (same scope, different scheme encoding): mixed-case (`JaVaScRiPt:`), HTML-entity (`java\u0026#x73;cript:`), embedded tab (`java\\tscript:`).\n\n## Impact\n\nA caller that uses `Cleaner` to neutralise untrusted HTML and chooses `safe_attrs_only=False` — typically because the application wants to allow custom data-/aria-/vendor attributes — will silently pass `javascript:` payloads carried on `xlink:href` through to victim renders. Stored XSS in any application that round-trips user-supplied HTML through this configuration. Reach is conditional on the `safe_attrs_only=False` toggle, but that is a documented public option; consumers reasonably expect URL-scheme scrubbing to be independent of attribute allow-listing.\n\n## Suggested fix\n\n**Extend `link_attrs`** to include `xlink:href`. In HTML mode, `lxml.html` keeps prefixed attribute names verbatim — the parsed key is the literal string `xlink:href`, not a Clark-notation form — so the existing allow-list lookup is a plain string match. Same shape as the CVE-2021-28957 fix:\n\n```diff\n # lxml/html/defs.py\n link_attrs = frozenset([\n     'action', 'archive', 'background', 'cite', 'classid',\n     'codebase', 'data', 'href', 'longdesc', 'profile', 'src',\n     'usemap', 'dynsrc', 'lowsrc', 'formaction',\n+    'xlink:href',\n ])\n```\n\nThis single change closes the reported XSS for both SVG `\u003ca xlink:href\u003e` and MathML `\u003ca xlink:href\u003e`. `lxml_html_clean` is the canonical home of the `Cleaner` code (881 lines); `lxml.html.clean` is a 21-line backward-compat shim (`from lxml_html_clean import *`) that picks up the fix automatically once `link_attrs` is updated upstream. Since the upstream change requires lxml maintainer action, see the alternative below if a self-contained patch in `lxml_html_clean` is preferred.\n\n**Alternative (in-package fix, no lxml coordination needed):** add a namespaced-URL-attribute walk inside `Cleaner.__call__` so the URL-scheme filter doesn't depend on `link_attrs`. Sketch:\n\n```python\n# lxml_html_clean/clean.py — supplements rewrite_links() in __call__\n_NS_URL_ATTRS = ('xlink:href',)  # extend as needed\n_BAD_SCHEME = re.compile(r'^\\s*(javascript|vbscript|data):', re.I)\n\nfor el in doc.iter():\n    for attr in _NS_URL_ATTRS:\n        if attr in el.attrib and _BAD_SCHEME.match(el.attrib[attr]):\n            del el.attrib[attr]\n```\n\nThis decouples the cleaner from the upstream `link_attrs` set and matches the security-ownership boundary established when the cleaner was extracted in lxml 5.2.0.\n\n**Defense in depth (optional, regardless of which fix path is taken):**\n- Also handle `srcset`: the value is a `url 1x, url 2x, …` descriptor list, so split on commas and validate each candidate URL. Not directly executable in current browsers, but closes the same gap.\n- Also accept Clark-notation forms (`{http://www.w3.org/1999/xlink}href`) so XML-mode callers using `lxml.etree` get the same protection. HTML mode never produces this form, so not needed for the reported bug.\n\n## Severity\n\nCVSS 3.1 base score: **8.2 / High** — `AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N` (stored XSS; victim must click the SVG anchor; scope-changed because script executes in the rendering origin). PR:N reflects the common case where untrusted HTML enters the sanitizer from anonymous sources (comments, support tickets); deployments that gate writes behind authentication can score with PR:L (→ 7.6).\n\nSeverity is **CONDITIONAL** on the caller passing `safe_attrs_only=False`. With the class default (`True`), attribute allow-listing strips `xlink:href` before scheme scrubbing runs, and the bug does not fire — verified at HEAD: default-config `Cleaner()(\u003csvg\u003e\u003ca xlink:href=\"javascript:…\"\u003ex\u003c/a\u003e\u003c/svg\u003e)` → `\u003csvg\u003e\u003ca\u003ex\u003c/a\u003e\u003c/svg\u003e`.\n\n## Prior art / novelty\n\n- **CVE-2021-28957 (lxml 4.6.3)** — same root cause, different attribute (`formaction`). Fix was a one-line extension of `link_attrs`. Direct precedent.\n- **CVE-2022-34473** (Mozilla Sanitizer API) — `xlink:href` URL bypass primitive in a different sanitizer.\n- **Bleach (Mozilla, Python)** explicitly handles the `xlink` namespace; `enshrined/svg-sanitize` (PHP) ships `cleanXlinkHrefs()`; DOMPurify scrubs `xlink:href` via `ALLOWED_URI_REGEXP`.\n- **`nh3`** (the alternative recommended in `lxml_html_clean`'s own README for security-sensitive use) is **not vulnerable** to this primitive — verified 2026-05-10 on `nh3==0.3.5`: with `\u003csvg\u003e`/`\u003cmath\u003e`/`\u003ca\u003e` and `xlink:href` explicitly added to `tags`/`attributes`, both SVG and MathML payloads, all four scheme-encoding variants, are stripped (output e.g. `\u003csvg\u003e\u003ca rel=\"noopener noreferrer\"\u003ex\u003c/a\u003e\u003c/svg\u003e`).\n\n\n## Coordination\n\nFiling as a private GHSA at `fedora-python/lxml_html_clean` — `lxml_html_clean` is the canonical maintainer of the `Cleaner` code (881 lines) and the security-responsible team since the lxml 5.2.0 split, where the cleaner was extracted out of lxml precisely so cleaner-security reports could land on the right team. The lxml side cannot be filed via GHSA (`https://github.com/lxml/lxml/security/advisories/new` returns 404 — private reporting is not enabled), so a parallel report has been emailed directly to the lxml maintainer for the upstream `defs.link_attrs` patch path. You're welcome to coordinate with them directly if you'd prefer the upstream fix over the in-package alternative above.\n\nHappy to provide a draft patch or PR on either path. No bounty expected.","status":"published","published":"2026-07-13T15:46:29.614932Z","modified":"2026-07-13T16:32:12.324499114Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:55.961245Z"},{"id":"RHSA-2026:66203","title":"Red Hat Security Advisory: python3.12-lxml security update","status":"published","published":"2026-09-10T10:17:12Z","modified":"2026-10-20T10:13:22Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66204","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-09-10T10:17:12Z","modified":"2026-10-20T10:13:23Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67324","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-09-15T10:17:12Z","modified":"2026-10-20T10:13:52Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67325","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-09-15T10:17:13Z","modified":"2026-10-20T10:13:53Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67326","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-09-15T10:17:13Z","modified":"2026-10-20T10:13:53Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67943","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-09-17T10:18:10Z","modified":"2026-10-20T10:14:07Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:74081","title":"Red Hat Security Advisory: python3.12-lxml security update","status":"published","published":"2026-10-01T10:21:14Z","modified":"2026-10-20T10:15:25Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74082","title":"Red Hat Security Advisory: python3.12-lxml security update","status":"published","published":"2026-10-01T10:21:15Z","modified":"2026-10-20T10:15:25Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74505","title":"Red Hat Security Advisory: Satellite 6.17.12 Async Update","status":"published","published":"2026-10-03T10:16:56Z","modified":"2026-10-20T10:15:36Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:74506","title":"Red Hat Security Advisory: Satellite 6.16.14 Async Update","status":"published","published":"2026-10-02T10:25:58Z","modified":"2026-10-20T10:15:37Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:84592","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-10-19T10:08:05Z","modified":"2026-10-20T10:17:40Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:84593","title":"Red Hat Security Advisory: python-lxml security update","status":"published","published":"2026-10-19T10:08:06Z","modified":"2026-10-20T10:17:41Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:66203","title":"Important: python3.12-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:05:26.835797Z","modified":"2026-09-11T12:30:03.6255354Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:66204","title":"Important: python-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:05:26.835797Z","modified":"2026-09-11T12:30:03.612673913Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67943","title":"Important: python-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-17T12:01:36.359777Z","modified":"2026-09-17T12:30:02.601502862Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-49825","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T15:17:00Z","modified":"2026-10-08T19:47:12.564846338Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"ALSA-2026:66203","title":"Important: python3.12-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:32:37.341142549Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:66204","title":"Important: python-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:31:33.412079621Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67943","title":"Important: python-lxml security update","description":"Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  \n\nSecurity Fix(es):  \n\n  * lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href (CVE-2026-49825)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:02:29.491557207Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-96857","title":"CVE-2026-49825 affecting package python-lxml for versions less than 4.9.3-3","description":"lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. This vulnerability was fixed in lxml 6.1.1 and lxml_html_clean 0.4.5.","status":"published","published":"2026-08-20T15:17:30Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"CLSA-2026-1792809744","title":"python-lxml: Fix of CVE-2026-49825","description":"- CVE-2026-49825: add missing xlink:href to HTML link attributes so the Cleaner sanitizes it","status":"published","published":"2026-10-24T02:42:38Z","modified":"2026-10-26T09:31:57.309730657Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792809858","title":"python-lxml: Fix of CVE-2026-49825","description":"- CVE-2026-49825: add missing xlink:href to HTML link attributes so the Cleaner sanitizes it","status":"published","published":"2026-10-24T02:44:29Z","modified":"2026-10-26T09:32:01.31998393Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:11147-1","title":"python-lxml-doc-6.1.1-1.1 on GA media","description":"These are all security issues fixed in the python-lxml-doc-6.1.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-29T00:00:00Z","modified":"2026-06-30T09:15:06.347602342Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11191-1","title":"python313-lxml_html_clean-0.4.5-1.1 on GA media","description":"These are all security issues fixed in the python313-lxml_html_clean-0.4.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-06T00:00:00Z","modified":"2026-07-07T08:30:08.083872608Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"SUSE-SU-2026:4580-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:17:24Z","modified":"2026-10-08T19:15:04.85537922Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4581-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:18:32Z","modified":"2026-10-08T19:15:03.961471212Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4582-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nscap-security-guide was updated to version 0.1.79:\n\n- Version 0.1.79 (jsc#ECO-3319)\n  * Added SLE16 profiles to the build\n  * Create SLE16 HIPAA profile\n  * Create SLE16 PCI DSS 4 profile\n  * Use Sequoia in RHEL 10 instead of GPG\n  * New Profile for RHEL10: BSI\n  * Move RHEL Control files to product files\n  * Update RHEL 9 CCN profile\n  * Various updates for SLE 12/15\n\nspacecmd was updated to version 5.2.10:\n\n- Version 5.2.10:\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9:\n  * Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481) - fixed in 5.2.17-0\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:20:35Z","modified":"2026-10-08T19:15:03.958892205Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4583-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push:\n\n- Version 5.2.5-0\n  * Remove token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd:\n\n- Version 5.2.10-0\n  * Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Version 5.2.9-0\n  * Update translation strings\n\nspacewalk-client-tools:\n\n- Version 5.2.7-0\n  * Update translation strings\n\nvenv-salt-minion:\n\n- CVE-2026-13346: Arbitrary file installation via malicious package indexes. Remove ensurepip with bundled .whl\n  files. (bsc#1273094)\n- CVE-2026-0864: Normalize all line endings (CR, CRLF, and LF) in configparser (bsc#1269066, gh#python/cpython#143927)\n- CVE-2026-1502: reject CR/LF in HTTP tunnel request headers (bsc#1261969, gh#python/cpython#146211)\n- CVE-2026-3276: Fix O(n^2) canonical ordering in unicodedata.normalize() (bsc#1267581, gh#python/cpython#149079)\n- CVE-2026-4360: Pass filter_function to TarFile._extract_one() during .extract() (bsc#1269959,\n  gh#python/cpython#151987)\n- CVE-2026-4786: fix webbrowser %action substitution bypass of dash-prefix check (bsc#1262319,\n  gh#python/cpython#148169)\n- CVE-2026-6019: protect against HTML injection by Base64-encoding cookie values embedded in JS (bsc#1262654,\n  gh#python/cpython#90309)\n- CVE-2026-6100: prevent dangling pointer, which can end in the use-after-free error (bsc#1262098,\n  gh#python/cpython#148395)\n- CVE-2026-7210: Use XML_SetHashSalt16Bytes in pyexpat/_elementtree when possible (bsc#1264962,\n  gh#python/cpython#149018)\n- CVE-2026-7774: tarfile.data_filter: validate written link target (bsc#1267821, gh#149486)\n- CVE-2026-8328: Make ftplib not trust the PASV response (bsc#1265268)\n- CVE-2026-11940: fix the symlink escape via tarfile hardlink-extraction fallback (bsc#1268977)\n- CVE-2026-11972: Make tarfile._Stream.seek break at EOF (bsc#1269788, gh#python/cpython#151981)\n- CVE-2026-15308: Fix quadratic complexity in incremental parsing in HTMLParser (bsc#1271192,\n  gh#python/cpython#153030)\n- CVE-2026-8643: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file\n  overwrite (bsc#1266669)\n- CVE-2026-6357: pip self-update functionality can import newly installed modules after wheel installation (bsc#1263442)\n- CVE-2026-3219: pip doesn't reject concatenated ZIP (bsc#1262429)\n- CVE-2026-1703: files may be extracted outside the installation directory when installing and extracting maliciously\n  crafted wheel archives (bsc#1257599, gh#pypa/pip#13777)\n- CVE-2024-22195: Fix compiler error when checking if required blocks in parent templates are xmlattr filter does not\n  allow keys with spaces. (bsc#1218722)\n- CVE-2026-45409: Specially crafted inputs to idna.encode() can bypass earlier security fix (bsc#1265413)\n- CVE-2026-44431: sensitive information disclosure due to sensitive headers being forwarded across origins in proxied\n  low-level redirects (bsc#1265267)\n- CVE-2026-49825: The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be\n  used for URL bypass attributes in embedded SVG/MathML/etc. content. (bsc#1270285)\n  https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\n- CVE-2026-41066: This release fixes a possible external entity injection (XXE) vulnerability in ``iterparse()`` and\n  the ``ETCompatXMLParser``. (bsc#1263254)\n- CVE-2026-3446: Preventing ignoring excess Base64 data after the first padded quad in non-strict (default) mode.\n  (bsc#1261970, gh#python/cpython#145264)\n- CVE-2026-3479: pkgutil.get_data() has the same security model as open(). The documented limitations ensure\n  compatibility with non-filesystem loaders; Python doesn't check that. (bsc#1259989, gh#python/cpython#146121)\n- CVE-2026-27459: large cookie value can lead to a buffer overflow (bsc#1271428)\n- CVE-2026-49853: authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (bsc#1268395)\n- CVE-2026-49854: out-of-bounds memory access via C extension (bsc#1268396)\n- CVE-2026-49855: AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (bsc#1268397)\n- CVE-2026-40475: improper input handling of null bytes can lead to silent data truncation and security-state\n  inconsistency (bsc#1262803)\n- CVE-2025-13836: limit http.client response read in NXOS modules (bsc#1254400)\n- Updated bundled python module pip to 25.0.1\n- Updated bundled python module jinja2 to 3.1.6\n- Updated bundled python module lxml to 6.1.1\n- Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n- Remove unused paramiko python module from the bundle.\n- Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n- Support attrlist in ldap.managed (bsc#1257151)\n- Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n- Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:21:47Z","modified":"2026-10-08T19:15:05.005427274Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4584-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7::\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:23:05Z","modified":"2026-10-08T19:15:04.953317343Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"SUSE-SU-2026:4585-1","title":"Security update 5.2.1 for Multi-Linux Manager Client Tools","description":"This update fixes the following issues:\n\ngolang-github-prometheus-prometheus was updated to version 3.13.2:\n\n- Security issues:\n\n  * CVE-2026-39821: Fixed validation bypass and privilege escalation in Punycode label handling (bsc#1266608)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm handling (bsc#1272102)\n  * CVE-2026-44990: Fixed stored XSS in the new React UI by sanitizing disallowed xmp elements (bsc#1275205)\n  * CVE-2026-53606: Fixed incomplete URI scheme validation in sanitize-html that could enable XSS (bsc#1269966)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269856)\n  * CVE-2025-4673: Fixed credential leaks by stopping HTTP client header forwarding on redirects (bsc#1275206)\n  * CVE-2023-45289: Fixed credential leaks by stopping header and cookie forwarding on HTTP redirects (bsc#1275207)\n  * CVE-2025-61686: Fixed unauthorized file access and path traversal in react-router storage (bsc#1270711)\n  * CVE-2026-40181: Fixed open redirect risks to external domains via relative paths in react-router (bsc#1267528)\n  * CVE-2026-42342: Fixed DoS risks via unbounded path expansion in the manifest endpoint (bsc#1267538)\n  * CVE-2026-42211: Fixed remote code execution risks from prototype pollution in react-router (bsc#1267534)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274221)\n  * Fixed potential denial-of-service vulnerabilities by updating the gRPC dependency\n  * Fixed memory exhaustion and DoS by rejecting snappy-compressed requests exceeding 32MB limit\n\n- Bug fixes and changes:\n\n  * Fixed scrape manager failing to reload properly when SD configuration changes rapidly.\n  * Prevent memory leak in remote-write path when the receiving endpoint is unavailable.\n  * Native Histograms are no longer experimental. They are fully supported for production workloads.\n  * Added support for OpenTelemetry traces within the Prometheus UI to correlate metrics and traces.\n  * TSDB compaction speed optimized by improving the block merging algorithm.\n  * Allow scraping of multiple targets using a single HTTP/2 connection to reduce overhead.\n  * Added new metrics to monitor the health of the rule evaluation engine.\n  * Incompatible: This affects scraping, remote read and write, alerting, and SD. Network paths might need adjustments\n    to avoid redirects.\n  * Incompatible: Rule group pagination tokens now use SHA-256 instead of MD5. Custom API consumers must adapt to the\n    new longer token format.\n  * Added 'group_limit' parameter to PromQL aggregations to restrict the number of results.\n  * Incompatible: promtool relative paths in config files now resolve relative to the config directory itself, instead\n    of the current working directory.\n  * Support exporting TSDB blocks directly to cloud storage via the admin API.\n  * Incompatible: Deprecated remote-write metrics like prometheus_remote_storage_samples_total are removed in favor of\n    prometheus_wal_watcher_records_read_total.\n  * Significant query performance boost for high-cardinality regex matchers.\n  * Introduce a new UI interface for safely deleting specific time series data directly.\n  * Added dynamic relabeling actions to extract substrings using regex capture groups.\n  * Fixed UI displaying incorrect time ranges after a timezone change.\n  * Bumped firewalld-prometheus-config to version 0.2 bumping OpenTelemetry to 1.43.0\n\ngrafana was updated to version 12.4.10:\n\n- Security issues:\n\n  * CVE-2026-17183: Fixed exposing data accessible through Grafana's configured datasource credentials (bsc#1275934)\n  * CVE-2026-2303: Fixed heap out-of-bounds read in GSSAPI error handling in mongo-driver (bsc#1269841)\n  * CVE-2026-17033: Fixed stored cross-site scripting risks via malicious Alertmanager generator URLs (bsc#1276426)\n  * CVE-2026-73501: Fixed fail-open authentication bypass in kin-openapi default handlers (bsc#1276973)\n  * CVE-2026-19475: Fixed DoS risks in PostgreSQL Datasource by checking timeGroup macros (bsc#1278307)\n  * CVE-2026-14199: Fixed auth bypass or session takeover via Auth Proxy cache key collision (bsc#1278322)\n  * CVE-2026-19197: Fixed access control and authorization checks in dashboard snapshots (bsc#1277025)\n  * CVE-2026-56852: Fixed infinite loop on truncated or invalid UTF-8 input in unicode/norm (bsc#1272008)\n  * CVE-2026-41178: Fixed denial-of-service risks in OpenTelemetry baggage parsing (bsc#1276658)\n  * CVE-2026-39882: Fixed memory exhaustion via uncapped HTTP response reading in OpenTelemetry (bsc#1274217)\n  * CVE-2026-8595: Fixed stored XSS via malicious dashboard field names in table panels (bsc#1271557)\n  * CVE-2026-42127: Fixed DoS risks in the public dashboard query endpoint (bsc#1268868)\n  * CVE-2026-9029: Fixed arbitrary code execution and script injection in the geomap panel (bsc#1272328)\n  * CVE-2026-33814: Fixed infinite loop in HTTP/2 transport during framesize check (bsc#1265763)\n  * CVE-2026-8609: Fixed pre-authentication denial-of-service risks in OAuth login routes (bsc#1271330)\n  * CVE-2026-1229: Fixed incorrect value calculation in ecc/p384 Package (bsc#1265525, bsc#1262187)\n  * CVE-2025-12141: Fixed information disclosure of secure settings via contact point modification (bsc#1262187)\n  * CVE-2026-21723: Fixed out-of-memory and denial-of-service risks in templates test endpoint (bsc#1272427)\n  * CVE-2026-41606: Fixed denial-of-service risks from nested messages in Apache Thrift parser (bsc#1263330)\n\n- Bug fixes and changes:\n\n  * Dashboards: Fix adhoc and groupby variable datasource on UI import\n  * Dashboards: Fix version dates and user display names in the legacy version history page\n  * Dashboard Import: Labels in v2 schema\n  * Azure Monitor: fix migration for dimension filters\n  * Dashboards: Get annotations and dashboard endpoint performance improvements\n  * DashboardDS: Fix Mixed panels with a time override stuck in permanent loading\n  * Alerting: Add protected fields authorization check to provisioning API\n  * Alerting: Return 403 instead of 500 on contact point provenance mismatch\n  * Jaeger: Handle gzip, deflate, and brotli compressed API responses\n  * Alerting: fix ORM table mapping bug causing SELECT alert_rule columns FROM user on PostgreSQL\n\nmgr-push was updated to version 5.2.5:\n\n- Removed token based authentication mechanism for package_push (bsc#1230949)\n\nspacecmd was updated to version 5.2.10:\n\n- Pre-filter errata in system_applyerrata to avoid using API calls for all existing errata (bsc#1267261)\n- Updated translation strings\n\nspacewalk-client-tools was updated to version 5.2.7:\n\n- Updated translation strings\n\nuyuni-tools was updated to version 5.2.17:\n\nSecurity issues fixed:\n\n- CVE-2026-39821: Drop the direct dependency on golang.org/x/net (bsc#1266481)\n\nBug fixes and changes:\n\n- Version 5.2.17-0:\n\n  * Bump the default image tag to 5.2.1\n  * Reload systemd daemon before restarting services (bsc#1270033)\n  * Check all supported locations for CA file in rotation check script\n  * Detect and fix legacy service file (bsc#1268755)\n  * Use healthcheck cmd from the image (bsc#1273144)\n\n- Version 5.2.16-0:\n\n  * Reverted usage of sdnotify as it causes issues with Podman (bsc#1270399, bsc#1270398)\n\n- Version 5.2.15-0:\n\n  * Added requirement for at least Podman v4.7.2\n  * Send READY notification to systemd only once healthy (bsc#1263823)\n\n- Version 5.2.14-0:\n\n  * Include the server environment file in the backup (bsc#1268649)\n  * Added mgradm commands for SSL CA and certificate rotation\n\n- Version 5.2.13-0:\n\n  * Check and warn if CA certificate isn't marked as critical\n  * Disable SSL on database during split (bsc#1267980)\n  * Do not call uyuni-postgres-config.sh in mgradm (bsc#1267980)\n  * Check backup status only after database is started (bsc#1262492)\n\nvenv-salt-minion:\n\n- Security issues:\n\n  * CVE-2026-13346: Fixed an issue where malicious package indexes could install unauthorized files (bsc#1273094)\n  * CVE-2026-0864: Fixed custom configuration injection risks caused by improper line-ending validation (bsc#1269066)\n  * CVE-2026-1502: Fixed web request header manipulation to bypass proxy security protections (bsc#1261969)\n  * CVE-2026-3276: Fixed potential system slow down or freeze when processing crafted Unicode text (bsc#1267581)\n  * CVE-2026-4360: Fixed directory escape risks during archive extraction (bsc#1269959)\n  * CVE-2026-4786: Fixed command injection risks when processing malicious browser links (bsc#1262319)\n  * CVE-2026-6019: Fixed a flaw where cookies could be manipulated to run malicious script (bsc#1262654)\n  * CVE-2026-6100: Fixed crashes or unauthorized code execution during file decompression (bsc#1262098)\n  * CVE-2026-7210: Fixed system freezes triggered by parsing malicious XML files (bsc#1264962)\n  * CVE-2026-7774: Fixed path traversal risks where malicious archives write files outside targets (bsc#1267821)\n  * CVE-2026-8328: Fixed connections being redirected to unsafe systems by compromised FTP servers (bsc#1265268)\n  * CVE-2026-11940: Fixed a bug where extracting malicious archives could overwrite system files (bsc#1268977)\n  * CVE-2026-11972: Fixed infinite loop and system freeze risks during archive decompression (bsc#1269788)\n  * CVE-2026-15308: Fixed crashes when parsing web pages with repetitive, incomplete structures (bsc#1271192)\n  * CVE-2026-8643: Fixed malicious package installs overwriting arbitrary local files (bsc#1266669)\n  * CVE-2026-6357: Fixed package self-updates loading unauthorized modules during install (bsc#1263442)\n  * CVE-2026-3219: Fixed validation failures where combined ZIP archives were not rejected (bsc#1262429)\n  * CVE-2026-1703: Fixed package installations writing files outside target directories (bsc#1257599)\n  * CVE-2024-22195: Fixed HTML template manipulation allowing unauthorized script execution (bsc#1218722)\n  * CVE-2026-45409: Fixed domain name encoding bypass allowing imitation websites (bsc#1265413)\n  * CVE-2026-44431: Fixed data leaks where sensitive headers were sent to external origins (bsc#1265267)\n  * CVE-2026-49825: Fixed missing script cleanup from namespaces in web content (bsc#1270285)\n  * CVE-2026-41066: Fixed leakage of private system data via malicious XML file parsing (bsc#1263254)\n  * CVE-2026-3446: Fixed validation bypasses where hidden excess Base64 data was ignored (bsc#1261970)\n  * CVE-2026-3479: Fixed path traversal risks when loading packages from insecure locations (bsc#1259989)\n  * CVE-2026-27459: Fixed buffer overflow vulnerabilities caused by large cookie headers (bsc#1271428)\n  * CVE-2026-49853: Fixed credentials leakage during redirects to cross-origin servers (bsc#1268395)\n  * CVE-2026-49854: Fixed crashes or unauthorized memory access in compiled components (bsc#1268396)\n  * CVE-2026-49855: Fixed crashes caused by excessively compressed files exhausting memory (bsc#1268397)\n  * CVE-2026-40475: Fixed silent data truncation where hidden null characters bypass checks (bsc#1262803)\n  * CVE-2025-13836: Fixed memory exhaustion risk by limiting HTTP response reading size (bsc#1254400)\n\n- Bug fixes and changes:\n\n  * Updated bundled python module pip to 25.0.1\n  * Updated bundled python module jinja2 to 3.1.6\n  * Updated bundled python module lxml to 6.1.1\n  * Prevent broken Salt Bundle on Ubuntu due regression in 'tar' package from Ubuntu repositories (bsc#1271613)\n  * Remove unused paramiko python module from the bundle.\n  * Switch apache2ctl to apachectl for SUSE OSes (bsc#1252286)\n  * Support attrlist in ldap.managed (bsc#1257151)\n  * Use AsyncHTTPClient in salt.utils.http (bsc#1268325)\n  * Decode binary pillars for salt-ssh to avoid exceptions (bsc#1263822)\n\n","status":"published","published":"2026-10-08T08:24:34Z","modified":"2026-10-08T19:15:05.011279037Z","updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"USN-8897-1","title":"lxml vulnerabilities","description":"Guillem Lefait discovered that lxml incorrectly handled certain URL\nattributes. A remote attacker could possibly use this issue to bypass\nURL sanitization, leading to a cross-site scripting attack.\n(CVE-2026-49825)\n\nQiu Sihao discovered that lxml incorrectly handled untrusted XML input.\nA remote attacker could possibly use this issue to read local files and\nexpose sensitive information. This issue was only addressed in Ubuntu 24.04\nLTS and Ubuntu 26.04 LTS. (CVE-2026-41066)","status":"published","published":"2026-10-07T16:13:52Z","modified":"2026-10-08T19:58:54.170338661Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}