{"schema_version":"2","view":"grouped","data":[{"id":77229,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-rcpr-vrrj-vvwg","summary":"MINI-rcpr-vrrj-vvwg","evidence":"osv:MINI-rcpr-vrrj-vvwg","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rcpr-vrrj-vvwg","aliases":["MINI-rcpr-vrrj-vvwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}}],"modified":"2026-10-06T03:15:02.977434816Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24ed114f-8afc-490d-95c3-2ac86686d1b6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rcpr-vrrj-vvwg","advisory_id":"24ed114f-8afc-490d-95c3-2ac86686d1b6","event_types":["advisory"],"published_at":"2026-10-27T04:06:43.648413+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/advisories/advisory%3A24ed114f-8afc-490d-95c3-2ac86686d1b6","group":{"id":"advisory:24ed114f-8afc-490d-95c3-2ac86686d1b6","revision":1,"primary_event_id":86007,"change":"published","superseded_by":[],"changed":{"id":86007,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-rcpr-vrrj-vvwg","summary":"MINI-rcpr-vrrj-vvwg","evidence":"osv:MINI-rcpr-vrrj-vvwg","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rcpr-vrrj-vvwg","aliases":["MINI-rcpr-vrrj-vvwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}}],"modified":"2026-10-06T03:15:02.977434816Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24ed114f-8afc-490d-95c3-2ac86686d1b6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rcpr-vrrj-vvwg","advisory_id":"24ed114f-8afc-490d-95c3-2ac86686d1b6","event_types":["advisory"],"published_at":"2026-10-27T04:06:43.648413+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/events/86007"},"members":[{"id":86007,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-rcpr-vrrj-vvwg","summary":"MINI-rcpr-vrrj-vvwg","evidence":"osv:MINI-rcpr-vrrj-vvwg","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rcpr-vrrj-vvwg","aliases":["MINI-rcpr-vrrj-vvwg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rcpr-vrrj-vvwg.json"}}],"modified":"2026-10-06T03:15:02.977434816Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:24ed114f-8afc-490d-95c3-2ac86686d1b6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rcpr-vrrj-vvwg","advisory_id":"24ed114f-8afc-490d-95c3-2ac86686d1b6","event_types":["advisory"],"published_at":"2026-10-27T04:06:43.648413+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/events/86007"}]}},{"id":76339,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-min-2026-15806","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291449906Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","advisory_id":"8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python-min"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.622+00:00","detail_url":"/advisories/advisory%3A8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","group":{"id":"advisory:8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","revision":1,"primary_event_id":84211,"change":"published","superseded_by":[],"changed":{"id":84211,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-min-2026-15806","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291449906Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","advisory_id":"8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python-min"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.622+00:00","detail_url":"/events/84211"},"members":[{"id":84211,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-min-2026-15806","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291449906Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","advisory_id":"8ad5afd6-fc6d-4f9e-aa15-1a9eae80e339","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python-min"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.622+00:00","detail_url":"/events/84211"}]}},{"id":76338,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-libpython-2026-15806","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291922674Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","advisory_id":"5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","event_types":["advisory"],"published_at":"2026-10-26T22:38:31.841017+00:00","technologies":["core-osv","libpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:48:22.08+00:00","detail_url":"/advisories/advisory%3A5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","group":{"id":"advisory:5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","revision":1,"primary_event_id":84212,"change":"published","superseded_by":[],"changed":{"id":84203,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-libpython-2026-15806","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291922674Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","advisory_id":"5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","event_types":["advisory"],"published_at":"2026-10-26T22:38:31.841017+00:00","technologies":["core-osv","libpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:48:22.08+00:00","detail_url":"/events/84203"},"members":[{"id":84212,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-libpython-2026-15806","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-15806.json"}}],"modified":"2026-10-05T14:30:08.291922674Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","advisory_id":"5ee9cfdf-fb28-4205-9caa-26dbacd1f9f4","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","libpython"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-11T05:48:22.08+00:00","detail_url":"/events/84212"}]}},{"id":76309,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:36:23.462915+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/advisories/advisory%3Adca624c8-1a66-435a-aec2-aee958e8a027","group":{"id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","revision":1,"primary_event_id":84213,"change":"published","superseded_by":[],"changed":{"id":84082,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:36:23.462915+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/events/84082"},"members":[{"id":84213,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:BIT-python-2026-15806","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-15806","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-15806.json"}}],"modified":"2026-10-05T14:30:06.074695860Z","provider":"osv","references":["https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://nvd.nist.gov/vuln/detail/CVE-2026-15806","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:dca624c8-1a66-435a-aec2-aee958e8a027","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","advisory_id":"dca624c8-1a66-435a-aec2-aee958e8a027","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-11T05:56:23.9+00:00","detail_url":"/events/84213"}]}},{"id":75085,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"BELL-CVE-2026-15806","summary":"BELL-CVE-2026-15806","evidence":"osv:BELL-CVE-2026-15806","products":[{"name":{"value":"python3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"BELL-CVE-2026-15806","aliases":["BELL-CVE-2026-15806"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=23","ecosystem":"Alpaquita:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=25","ecosystem":"Alpaquita:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=stream","ecosystem":"Alpaquita:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=23","ecosystem":"BellSoft Hardened Containers:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=25","ecosystem":"BellSoft Hardened Containers:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=stream","ecosystem":"BellSoft Hardened Containers:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}}],"modified":"2026-10-04T07:15:02.382920183Z","provider":"osv","upstream":["CVE-2026-15806"],"references":["https://docs.bell-sw.com/security/cves/CVE-2026-15806"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f5196851-8444-4137-9e5b-9427bb3140f8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BELL-CVE-2026-15806","advisory_id":"f5196851-8444-4137-9e5b-9427bb3140f8","event_types":["advisory"],"published_at":"2026-10-26T15:56:07.624661+00:00","technologies":["core-osv","python3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-20T06:06:25.129+00:00","detail_url":"/advisories/advisory%3Af5196851-8444-4137-9e5b-9427bb3140f8","group":{"id":"advisory:f5196851-8444-4137-9e5b-9427bb3140f8","revision":1,"primary_event_id":84218,"change":"published","superseded_by":[],"changed":{"id":81475,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"BELL-CVE-2026-15806","summary":"BELL-CVE-2026-15806","evidence":"osv:BELL-CVE-2026-15806","products":[{"name":{"value":"python3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"BELL-CVE-2026-15806","aliases":["BELL-CVE-2026-15806"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=23","ecosystem":"Alpaquita:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=25","ecosystem":"Alpaquita:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=stream","ecosystem":"Alpaquita:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=23","ecosystem":"BellSoft Hardened Containers:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=25","ecosystem":"BellSoft Hardened Containers:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=stream","ecosystem":"BellSoft Hardened Containers:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}}],"modified":"2026-10-04T07:15:02.382920183Z","provider":"osv","upstream":["CVE-2026-15806"],"references":["https://docs.bell-sw.com/security/cves/CVE-2026-15806"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f5196851-8444-4137-9e5b-9427bb3140f8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BELL-CVE-2026-15806","advisory_id":"f5196851-8444-4137-9e5b-9427bb3140f8","event_types":["advisory"],"published_at":"2026-10-26T15:56:07.624661+00:00","technologies":["core-osv","python3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-20T06:06:25.129+00:00","detail_url":"/events/81475"},"members":[{"id":84218,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"BELL-CVE-2026-15806","summary":"BELL-CVE-2026-15806","evidence":"osv:BELL-CVE-2026-15806","products":[{"name":{"value":"python3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python3","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.8-r3","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"BELL-CVE-2026-15806","aliases":["BELL-CVE-2026-15806"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=23","ecosystem":"Alpaquita:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=25","ecosystem":"Alpaquita:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/alpaquita/python3?arch=source&distro=stream","ecosystem":"Alpaquita:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.3-r0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=23","ecosystem":"BellSoft Hardened Containers:23"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.10-r1"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=25","ecosystem":"BellSoft Hardened Containers:25"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.4-r0"},{"fixed":"3.14.8-r3"}]}],"package":{"name":"python3","purl":"pkg:apk/bellsoft-hardened-containers/python3?arch=source&distro=stream","ecosystem":"BellSoft Hardened Containers:stream"},"database_specific":{"source":"https://github.com/bell-sw/osv-database/blob/master/BELL-CVE/BELL-CVE-2026-15806.json"}}],"modified":"2026-10-04T07:15:02.382920183Z","provider":"osv","upstream":["CVE-2026-15806"],"references":["https://docs.bell-sw.com/security/cves/CVE-2026-15806"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f5196851-8444-4137-9e5b-9427bb3140f8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BELL-CVE-2026-15806","advisory_id":"f5196851-8444-4137-9e5b-9427bb3140f8","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python3"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-20T06:06:25.129+00:00","detail_url":"/events/84218"}]}},{"id":74467,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-xr38-v2q7-rrvg","summary":"MINI-xr38-v2q7-rrvg","evidence":"osv:MINI-xr38-v2q7-rrvg","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-xr38-v2q7-rrvg","aliases":["MINI-xr38-v2q7-rrvg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}}],"modified":"2026-10-03T17:23:25.227068699Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-xr38-v2q7-rrvg","advisory_id":"7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","event_types":["advisory"],"published_at":"2026-10-26T10:52:22.500055+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/advisories/advisory%3A7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","group":{"id":"advisory:7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","revision":1,"primary_event_id":84217,"change":"published","superseded_by":[],"changed":{"id":79622,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-xr38-v2q7-rrvg","summary":"MINI-xr38-v2q7-rrvg","evidence":"osv:MINI-xr38-v2q7-rrvg","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-xr38-v2q7-rrvg","aliases":["MINI-xr38-v2q7-rrvg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}}],"modified":"2026-10-03T17:23:25.227068699Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-xr38-v2q7-rrvg","advisory_id":"7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","event_types":["advisory"],"published_at":"2026-10-26T10:52:22.500055+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/79622"},"members":[{"id":84217,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-xr38-v2q7-rrvg","summary":"MINI-xr38-v2q7-rrvg","evidence":"osv:MINI-xr38-v2q7-rrvg","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-xr38-v2q7-rrvg","aliases":["MINI-xr38-v2q7-rrvg"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-xr38-v2q7-rrvg.json"}}],"modified":"2026-10-03T17:23:25.227068699Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-xr38-v2q7-rrvg","advisory_id":"7dccb1f0-5f1a-4bf7-8ba6-48a5e2e17a90","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/84217"}]}},{"id":74439,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-p84m-j8qx-5xjj","summary":"MINI-p84m-j8qx-5xjj","evidence":"osv:MINI-p84m-j8qx-5xjj","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p84m-j8qx-5xjj","aliases":["MINI-p84m-j8qx-5xjj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}}],"modified":"2026-10-03T17:23:22.664071775Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:10dd2ebc-d998-4939-90b5-d08937971596","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p84m-j8qx-5xjj","advisory_id":"10dd2ebc-d998-4939-90b5-d08937971596","event_types":["advisory"],"published_at":"2026-10-26T10:52:00.241365+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/advisories/advisory%3A10dd2ebc-d998-4939-90b5-d08937971596","group":{"id":"advisory:10dd2ebc-d998-4939-90b5-d08937971596","revision":1,"primary_event_id":84216,"change":"published","superseded_by":[],"changed":{"id":79594,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-p84m-j8qx-5xjj","summary":"MINI-p84m-j8qx-5xjj","evidence":"osv:MINI-p84m-j8qx-5xjj","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p84m-j8qx-5xjj","aliases":["MINI-p84m-j8qx-5xjj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}}],"modified":"2026-10-03T17:23:22.664071775Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:10dd2ebc-d998-4939-90b5-d08937971596","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p84m-j8qx-5xjj","advisory_id":"10dd2ebc-d998-4939-90b5-d08937971596","event_types":["advisory"],"published_at":"2026-10-26T10:52:00.241365+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/79594"},"members":[{"id":84216,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"MINI-p84m-j8qx-5xjj","summary":"MINI-p84m-j8qx-5xjj","evidence":"osv:MINI-p84m-j8qx-5xjj","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p84m-j8qx-5xjj","aliases":["MINI-p84m-j8qx-5xjj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p84m-j8qx-5xjj.json"}}],"modified":"2026-10-03T17:23:22.664071775Z","provider":"osv","upstream":["CVE-2026-15806","GHSA-2v69-2w5x-455j"],"references":[]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:10dd2ebc-d998-4939-90b5-d08937971596","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p84m-j8qx-5xjj","advisory_id":"10dd2ebc-d998-4939-90b5-d08937971596","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/84216"}]}},{"id":67655,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/advisories/advisory%3A38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","group":{"id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","revision":1,"primary_event_id":84219,"change":"published","superseded_by":[],"changed":{"id":68025,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/68025"},"members":[{"id":84219,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python","python-base"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/84219"}]}},{"id":59458,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"PSF-2026-36","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:PSF-2026-36","products":[],"severity":"unknown","structured":{"id":"PSF-2026-36","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"repo":"https://github.com/python/cpython","type":"GIT","events":[{"introduced":"0"},{"fixed":"a0d023fbd23773e24b35d8368789470e22cda5d8"},{"fixed":"a2773a34183b7d94a243bb98fd658926cc5348ce"},{"fixed":"a7bb524fef61f77ede01f660ffbd591e1d5837ce"},{"fixed":"641be42bb07921ba0f8bffe228b1dc706b092ef6"},{"fixed":"851cf9a7142ecbdd39f831055533f58284ad2bcc"},{"fixed":"95355ee3a8e1d3c3d4858d1973aa42a9b91a2801"},{"fixed":"dac88d8615078c55f1304ea4c7a2d822700d4e5a"}]}],"versions":["v3.11.16","v3.10.21","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.10.20","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.10.19","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.10.18","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.10.17","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.10.16","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.10.15","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.10.14","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.10.13","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.10.12","v3.12.0b2","v3.12.0b1","v3.10.11","v3.11.3","v3.12.0a7","v3.12.0a6","v3.10.10","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.10.9","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.10.8","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.10.4","v3.10.3","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.10.0rc2","v3.10.0rc1","v3.10.0b4","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-36.json"}}],"modified":"2026-10-01T03:45:05.884878129Z","provider":"osv","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cwe_ids":[]}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PSF-2026-36","advisory_id":"c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","event_types":["advisory"],"published_at":"2026-10-25T18:15:41.124908+00:00","technologies":["core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/advisories/advisory%3Ac69d88f4-1ba9-4a40-a17b-4e2e324fabdb","group":{"id":"advisory:c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","revision":1,"primary_event_id":84215,"change":"published","superseded_by":[],"changed":{"id":58678,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"PSF-2026-36","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:PSF-2026-36","products":[],"severity":"unknown","structured":{"id":"PSF-2026-36","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"repo":"https://github.com/python/cpython","type":"GIT","events":[{"introduced":"0"},{"fixed":"a0d023fbd23773e24b35d8368789470e22cda5d8"},{"fixed":"a2773a34183b7d94a243bb98fd658926cc5348ce"},{"fixed":"a7bb524fef61f77ede01f660ffbd591e1d5837ce"},{"fixed":"641be42bb07921ba0f8bffe228b1dc706b092ef6"},{"fixed":"851cf9a7142ecbdd39f831055533f58284ad2bcc"},{"fixed":"95355ee3a8e1d3c3d4858d1973aa42a9b91a2801"},{"fixed":"dac88d8615078c55f1304ea4c7a2d822700d4e5a"}]}],"versions":["v3.11.16","v3.10.21","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.10.20","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.10.19","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.10.18","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.10.17","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.10.16","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.10.15","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.10.14","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.10.13","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.10.12","v3.12.0b2","v3.12.0b1","v3.10.11","v3.11.3","v3.12.0a7","v3.12.0a6","v3.10.10","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.10.9","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.10.8","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.10.4","v3.10.3","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.10.0rc2","v3.10.0rc1","v3.10.0b4","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-36.json"}}],"modified":"2026-10-01T03:45:05.884878129Z","provider":"osv","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cwe_ids":[]}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PSF-2026-36","advisory_id":"c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","event_types":["advisory"],"published_at":"2026-10-25T18:15:41.124908+00:00","technologies":["core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/events/58678"},"members":[{"id":84215,"cve_ids":["CVE-2026-15806"],"payload":{"kind":"advisory","title":"PSF-2026-36","summary":"The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.","evidence":"osv:PSF-2026-36","products":[],"severity":"unknown","structured":{"id":"PSF-2026-36","aliases":["BIT-libpython-2026-15806","BIT-python-2026-15806","BIT-python-min-2026-15806","CVE-2026-15806","PSF-2026-36"],"affected":[{"ranges":[{"repo":"https://github.com/python/cpython","type":"GIT","events":[{"introduced":"0"},{"fixed":"a0d023fbd23773e24b35d8368789470e22cda5d8"},{"fixed":"a2773a34183b7d94a243bb98fd658926cc5348ce"},{"fixed":"a7bb524fef61f77ede01f660ffbd591e1d5837ce"},{"fixed":"641be42bb07921ba0f8bffe228b1dc706b092ef6"},{"fixed":"851cf9a7142ecbdd39f831055533f58284ad2bcc"},{"fixed":"95355ee3a8e1d3c3d4858d1973aa42a9b91a2801"},{"fixed":"dac88d8615078c55f1304ea4c7a2d822700d4e5a"}]}],"versions":["v3.11.16","v3.10.21","v3.12.14","v3.13.15","v3.14.7","v3.15.0rc1","v3.15.0b4","v3.15.0b3","v3.13.14","v3.14.6","v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.15.0a8","v3.15.0a7","v3.12.13","v3.10.20","v3.11.15","v3.15.0a6","v3.13.12","v3.14.3","v3.15.0a5","v3.15.0a4","v3.15.0a3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.15.0a2","v3.15.0a1","v3.13.8","v3.11.14","v3.10.19","v3.12.12","v3.14.0","v3.14.0rc3","v3.13.7","v3.14.0rc2","v3.13.6","v3.14.0rc1","v3.14.0b4","v3.14.0b3","v3.13.5","v3.13.4","v3.11.13","v3.10.18","v3.12.11","v3.14.0b2","v3.14.0b1","v3.13.3","v3.11.12","v3.12.10","v3.14.0a7","v3.10.17","v3.14.0a6","v3.14.0a5","v3.13.2","v3.12.9","v3.14.0a4","v3.14.0a3","v3.13.1","v3.12.8","v3.10.16","v3.11.11","v3.14.0a2","v3.14.0a1","v3.13.0","v3.13.0rc3","v3.12.7","v3.11.10","v3.10.15","v3.13.0rc2","v3.12.6","v3.12.5","v3.13.0rc1","v3.13.0b4","v3.13.0b3","v3.12.4","v3.13.0b2","v3.13.0b1","v3.13.0a6","v3.12.3","v3.11.9","v3.10.14","v3.13.0a5","v3.13.0a4","v3.12.2","v3.11.8","v3.13.0a3","v3.12.1","v3.11.7","v3.13.0a2","v3.13.0a1","v3.11.6","v3.12.0","v3.12.0rc3","v3.12.0rc2","v3.11.5","v3.10.13","v3.12.0rc1","v3.12.0b4","v3.12.0b3","v3.11.4","v3.10.12","v3.12.0b2","v3.12.0b1","v3.10.11","v3.11.3","v3.12.0a7","v3.12.0a6","v3.10.10","v3.11.2","v3.12.0a5","v3.12.0a4","v3.12.0a3","v3.10.9","v3.11.1","v3.12.0a2","v3.12.0a1","v3.11.0rc2","v3.10.8","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.10.4","v3.10.3","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.10.0rc2","v3.10.0rc1","v3.10.0b4","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2026-36.json"}}],"modified":"2026-10-01T03:45:05.884878129Z","provider":"osv","references":["https://github.com/python/cpython/issues/155694","https://github.com/python/cpython/pull/155696","https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/","https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8","https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce","https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce","https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6","https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc","https://github.com/python/cpython/commit/95355ee3a8e1d3c3d4858d1973aa42a9b91a2801","https://github.com/python/cpython/commit/dac88d8615078c55f1304ea4c7a2d822700d4e5a"],"provider_metadata":{"cwe_ids":[]}},"related_cves":[{"value":"CVE-2026-15806","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":false,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PSF-2026-36","advisory_id":"c69d88f4-1ba9-4a40-a17b-4e2e324fabdb","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-18T15:50:57.983+00:00","detail_url":"/events/84215"}]}}],"next_after":77229,"next_before":59458}