{"schema_version":"2","view":"grouped","data":[{"id":77228,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-p789-r3r4-8gwh","summary":"MINI-p789-r3r4-8gwh","evidence":"osv:MINI-p789-r3r4-8gwh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p789-r3r4-8gwh","aliases":["MINI-p789-r3r4-8gwh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}}],"modified":"2026-10-06T03:15:02.977409906Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8825a7a3-6259-47a8-b707-937aa8eade65","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p789-r3r4-8gwh","advisory_id":"8825a7a3-6259-47a8-b707-937aa8eade65","event_types":["advisory"],"published_at":"2026-10-27T04:06:42.393445+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/advisories/advisory%3A8825a7a3-6259-47a8-b707-937aa8eade65","group":{"id":"advisory:8825a7a3-6259-47a8-b707-937aa8eade65","revision":1,"primary_event_id":86006,"change":"published","superseded_by":[],"changed":{"id":86006,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-p789-r3r4-8gwh","summary":"MINI-p789-r3r4-8gwh","evidence":"osv:MINI-p789-r3r4-8gwh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p789-r3r4-8gwh","aliases":["MINI-p789-r3r4-8gwh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}}],"modified":"2026-10-06T03:15:02.977409906Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8825a7a3-6259-47a8-b707-937aa8eade65","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p789-r3r4-8gwh","advisory_id":"8825a7a3-6259-47a8-b707-937aa8eade65","event_types":["advisory"],"published_at":"2026-10-27T04:06:42.393445+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/events/86006"},"members":[{"id":86006,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-p789-r3r4-8gwh","summary":"MINI-p789-r3r4-8gwh","evidence":"osv:MINI-p789-r3r4-8gwh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12-tk","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r0","evidence":"/affected/5/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-p789-r3r4-8gwh","aliases":["MINI-p789-r3r4-8gwh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/minimos/python-3.12","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base","purl":"pkg:apk/minimos/python-3.12-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-base-dev","purl":"pkg:apk/minimos/python-3.12-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-dev","purl":"pkg:apk/minimos/python-3.12-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-doc","purl":"pkg:apk/minimos/python-3.12-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r0"}]}],"package":{"name":"python-3.12-tk","purl":"pkg:apk/minimos/python-3.12-tk","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-p789-r3r4-8gwh.json"}}],"modified":"2026-10-06T03:15:02.977409906Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8825a7a3-6259-47a8-b707-937aa8eade65","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-p789-r3r4-8gwh","advisory_id":"8825a7a3-6259-47a8-b707-937aa8eade65","event_types":["advisory"],"published_at":"2026-10-27T04:06:42.393445+00:00","technologies":["core-osv","python-3-12","python-3-12-base","python-3-12-base-dev","python-3-12-dev","python-3-12-doc","python-3-12-tk"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-05T20:12:22+00:00","detail_url":"/events/86006"}]}},{"id":76311,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/advisories/advisory%3A27046a86-b0af-421d-ae8c-92919a385cd5","group":{"id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","revision":1,"primary_event_id":84096,"change":"published","superseded_by":[],"changed":{"id":84096,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/events/84096"},"members":[{"id":84096,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-2026-19672","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python","purl":"pkg:bitnami/python","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python/BIT-python-2026-19672.json"}}],"modified":"2026-10-05T14:30:06.225069321Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:27046a86-b0af-421d-ae8c-92919a385cd5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","advisory_id":"27046a86-b0af-421d-ae8c-92919a385cd5","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.991+00:00","detail_url":"/events/84096"}]}},{"id":76292,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-libpython-2026-19672","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537715560Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","advisory_id":"b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","event_types":["advisory"],"published_at":"2026-10-26T22:36:08.520484+00:00","technologies":["core-osv","libpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:53:36.732+00:00","detail_url":"/advisories/advisory%3Ab4ec97e7-ff81-44ee-b20c-6f9c6406d9df","group":{"id":"advisory:b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","revision":1,"primary_event_id":84097,"change":"published","superseded_by":[],"changed":{"id":83984,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-libpython-2026-19672","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537715560Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","advisory_id":"b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","event_types":["advisory"],"published_at":"2026-10-26T22:36:08.520484+00:00","technologies":["core-osv","libpython"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:53:36.732+00:00","detail_url":"/events/83984"},"members":[{"id":84097,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-libpython-2026-19672","products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-libpython-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"libpython","purl":"pkg:bitnami/libpython","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/libpython/BIT-libpython-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537715560Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","advisory_id":"b4ec97e7-ff81-44ee-b20c-6f9c6406d9df","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","libpython"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T12:53:36.732+00:00","detail_url":"/events/84097"}]}},{"id":76290,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-g5hg-ff68-3vg3","summary":"CGA-g5hg-ff68-3vg3","evidence":"osv:CGA-g5hg-ff68-3vg3","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5hg-ff68-3vg3","aliases":["CGA-g5hg-ff68-3vg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}}],"modified":"2026-10-03T17:25:13.941783176Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3845d27f-b7de-461f-ba6c-03ca6ac34a4c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5hg-ff68-3vg3","advisory_id":"3845d27f-b7de-461f-ba6c-03ca6ac34a4c","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:38:43+00:00","detail_url":"/advisories/advisory%3A3845d27f-b7de-461f-ba6c-03ca6ac34a4c","group":{"id":"advisory:3845d27f-b7de-461f-ba6c-03ca6ac34a4c","revision":2,"primary_event_id":84108,"change":"context","superseded_by":[],"changed":{"id":83982,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-g5hg-ff68-3vg3","summary":"CGA-g5hg-ff68-3vg3","evidence":"osv:CGA-g5hg-ff68-3vg3","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5hg-ff68-3vg3","aliases":["CGA-g5hg-ff68-3vg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}}],"modified":"2026-10-03T17:25:13.941783176Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3845d27f-b7de-461f-ba6c-03ca6ac34a4c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5hg-ff68-3vg3","advisory_id":"3845d27f-b7de-461f-ba6c-03ca6ac34a4c","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:38:43+00:00","detail_url":"/events/83982"},"members":[{"id":84108,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-g5hg-ff68-3vg3","summary":"CGA-g5hg-ff68-3vg3","evidence":"osv:CGA-g5hg-ff68-3vg3","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-g5hg-ff68-3vg3","aliases":["CGA-g5hg-ff68-3vg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g5hg-ff68-3vg3.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T20:11:08Z"}]}}],"modified":"2026-10-03T17:25:13.941783176Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:3845d27f-b7de-461f-ba6c-03ca6ac34a4c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g5hg-ff68-3vg3","advisory_id":"3845d27f-b7de-461f-ba6c-03ca6ac34a4c","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:38:43+00:00","detail_url":"/events/84108"}]}},{"id":76289,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vjqp-xfq4-crqm","summary":"CGA-vjqp-xfq4-crqm","evidence":"osv:CGA-vjqp-xfq4-crqm","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vjqp-xfq4-crqm","aliases":["CGA-vjqp-xfq4-crqm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}}],"modified":"2026-10-03T17:25:01.241808956Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbb7275f-d810-409a-952a-e3e5b4f63294","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vjqp-xfq4-crqm","advisory_id":"dbb7275f-d810-409a-952a-e3e5b4f63294","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:31:13+00:00","detail_url":"/advisories/advisory%3Adbb7275f-d810-409a-952a-e3e5b4f63294","group":{"id":"advisory:dbb7275f-d810-409a-952a-e3e5b4f63294","revision":2,"primary_event_id":84107,"change":"context","superseded_by":[],"changed":{"id":83981,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vjqp-xfq4-crqm","summary":"CGA-vjqp-xfq4-crqm","evidence":"osv:CGA-vjqp-xfq4-crqm","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vjqp-xfq4-crqm","aliases":["CGA-vjqp-xfq4-crqm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}}],"modified":"2026-10-03T17:25:01.241808956Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbb7275f-d810-409a-952a-e3e5b4f63294","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vjqp-xfq4-crqm","advisory_id":"dbb7275f-d810-409a-952a-e3e5b4f63294","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:31:13+00:00","detail_url":"/events/83981"},"members":[{"id":84107,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vjqp-xfq4-crqm","summary":"CGA-vjqp-xfq4-crqm","evidence":"osv:CGA-vjqp-xfq4-crqm","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vjqp-xfq4-crqm","aliases":["CGA-vjqp-xfq4-crqm"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vjqp-xfq4-crqm.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:20:51Z"}]}}],"modified":"2026-10-03T17:25:01.241808956Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:dbb7275f-d810-409a-952a-e3e5b4f63294","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vjqp-xfq4-crqm","advisory_id":"dbb7275f-d810-409a-952a-e3e5b4f63294","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:31:13+00:00","detail_url":"/events/84107"}]}},{"id":76288,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-g45v-4wv4-fjpj","summary":"MINI-g45v-4wv4-fjpj","evidence":"osv:MINI-g45v-4wv4-fjpj","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-g45v-4wv4-fjpj","aliases":["MINI-g45v-4wv4-fjpj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}}],"modified":"2026-10-03T17:23:21.111680342Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d843d008-0995-4b55-bbd9-bd743e2985c2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-g45v-4wv4-fjpj","advisory_id":"d843d008-0995-4b55-bbd9-bd743e2985c2","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/advisories/advisory%3Ad843d008-0995-4b55-bbd9-bd743e2985c2","group":{"id":"advisory:d843d008-0995-4b55-bbd9-bd743e2985c2","revision":2,"primary_event_id":84106,"change":"context","superseded_by":[],"changed":{"id":83980,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-g45v-4wv4-fjpj","summary":"MINI-g45v-4wv4-fjpj","evidence":"osv:MINI-g45v-4wv4-fjpj","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-g45v-4wv4-fjpj","aliases":["MINI-g45v-4wv4-fjpj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}}],"modified":"2026-10-03T17:23:21.111680342Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d843d008-0995-4b55-bbd9-bd743e2985c2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-g45v-4wv4-fjpj","advisory_id":"d843d008-0995-4b55-bbd9-bd743e2985c2","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/83980"},"members":[{"id":84106,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-g45v-4wv4-fjpj","summary":"MINI-g45v-4wv4-fjpj","evidence":"osv:MINI-g45v-4wv4-fjpj","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-g45v-4wv4-fjpj","aliases":["MINI-g45v-4wv4-fjpj"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/minimos/python-3.10","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base","purl":"pkg:apk/minimos/python-3.10-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-base-dev","purl":"pkg:apk/minimos/python-3.10-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-dev","purl":"pkg:apk/minimos/python-3.10-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r0"}]}],"package":{"name":"python-3.10-doc","purl":"pkg:apk/minimos/python-3.10-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-g45v-4wv4-fjpj.json"}}],"modified":"2026-10-03T17:23:21.111680342Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d843d008-0995-4b55-bbd9-bd743e2985c2","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-g45v-4wv4-fjpj","advisory_id":"d843d008-0995-4b55-bbd9-bd743e2985c2","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-10","python-3-10-base","python-3-10-base-dev","python-3-10-dev","python-3-10-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/84106"}]}},{"id":76287,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-4j2f-xmj7-f2pw","summary":"MINI-4j2f-xmj7-f2pw","evidence":"osv:MINI-4j2f-xmj7-f2pw","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-4j2f-xmj7-f2pw","aliases":["MINI-4j2f-xmj7-f2pw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}}],"modified":"2026-10-03T17:23:18.556323491Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e6442d1c-aa1a-4dce-8d20-6cd5820add49","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-4j2f-xmj7-f2pw","advisory_id":"e6442d1c-aa1a-4dce-8d20-6cd5820add49","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/advisories/advisory%3Ae6442d1c-aa1a-4dce-8d20-6cd5820add49","group":{"id":"advisory:e6442d1c-aa1a-4dce-8d20-6cd5820add49","revision":2,"primary_event_id":84105,"change":"context","superseded_by":[],"changed":{"id":83979,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-4j2f-xmj7-f2pw","summary":"MINI-4j2f-xmj7-f2pw","evidence":"osv:MINI-4j2f-xmj7-f2pw","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-4j2f-xmj7-f2pw","aliases":["MINI-4j2f-xmj7-f2pw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}}],"modified":"2026-10-03T17:23:18.556323491Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e6442d1c-aa1a-4dce-8d20-6cd5820add49","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-4j2f-xmj7-f2pw","advisory_id":"e6442d1c-aa1a-4dce-8d20-6cd5820add49","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/83979"},"members":[{"id":84105,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"MINI-4j2f-xmj7-f2pw","summary":"MINI-4j2f-xmj7-f2pw","evidence":"osv:MINI-4j2f-xmj7-f2pw","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-base-dev","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/2/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-dev","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/3/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11-doc","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r0","evidence":"/affected/4/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-4j2f-xmj7-f2pw","aliases":["MINI-4j2f-xmj7-f2pw"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/minimos/python-3.11","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base","purl":"pkg:apk/minimos/python-3.11-base","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-base-dev","purl":"pkg:apk/minimos/python-3.11-base-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-dev","purl":"pkg:apk/minimos/python-3.11-dev","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r0"}]}],"package":{"name":"python-3.11-doc","purl":"pkg:apk/minimos/python-3.11-doc","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-4j2f-xmj7-f2pw.json"}}],"modified":"2026-10-03T17:23:18.556323491Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e6442d1c-aa1a-4dce-8d20-6cd5820add49","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-4j2f-xmj7-f2pw","advisory_id":"e6442d1c-aa1a-4dce-8d20-6cd5820add49","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-11","python-3-11-base","python-3-11-base-dev","python-3-11-dev","python-3-11-doc"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-03T15:33:42+00:00","detail_url":"/events/84105"}]}},{"id":76286,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-hfj2-mp2q-f7xh","summary":"CGA-hfj2-mp2q-f7xh","evidence":"osv:CGA-hfj2-mp2q-f7xh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hfj2-mp2q-f7xh","aliases":["CGA-hfj2-mp2q-f7xh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}}],"modified":"2026-10-03T10:32:42.190413249Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfj2-mp2q-f7xh","advisory_id":"bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T02:03:49+00:00","detail_url":"/advisories/advisory%3Abb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","group":{"id":"advisory:bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","revision":2,"primary_event_id":84104,"change":"context","superseded_by":[],"changed":{"id":83978,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-hfj2-mp2q-f7xh","summary":"CGA-hfj2-mp2q-f7xh","evidence":"osv:CGA-hfj2-mp2q-f7xh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hfj2-mp2q-f7xh","aliases":["CGA-hfj2-mp2q-f7xh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}}],"modified":"2026-10-03T10:32:42.190413249Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfj2-mp2q-f7xh","advisory_id":"bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T02:03:49+00:00","detail_url":"/events/83978"},"members":[{"id":84104,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-hfj2-mp2q-f7xh","summary":"CGA-hfj2-mp2q-f7xh","evidence":"osv:CGA-hfj2-mp2q-f7xh","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-hfj2-mp2q-f7xh","aliases":["CGA-hfj2-mp2q-f7xh"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hfj2-mp2q-f7xh.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T21:33:06Z"}]}}],"modified":"2026-10-03T10:32:42.190413249Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hfj2-mp2q-f7xh","advisory_id":"bb92a9f2-b0f7-4aaa-a1b6-6bdd0df461d6","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T02:03:49+00:00","detail_url":"/events/84104"}]}},{"id":76285,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-886h-2jwh-vv2c","summary":"CGA-886h-2jwh-vv2c","evidence":"osv:CGA-886h-2jwh-vv2c","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-886h-2jwh-vv2c","aliases":["CGA-886h-2jwh-vv2c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}}],"modified":"2026-10-03T10:32:36.372428874Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-886h-2jwh-vv2c","advisory_id":"f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:03:41+00:00","detail_url":"/advisories/advisory%3Af0a0ec3a-b877-4be7-bfcc-bb57eada4e70","group":{"id":"advisory:f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","revision":2,"primary_event_id":84103,"change":"context","superseded_by":[],"changed":{"id":83977,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-886h-2jwh-vv2c","summary":"CGA-886h-2jwh-vv2c","evidence":"osv:CGA-886h-2jwh-vv2c","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-886h-2jwh-vv2c","aliases":["CGA-886h-2jwh-vv2c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}}],"modified":"2026-10-03T10:32:36.372428874Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-886h-2jwh-vv2c","advisory_id":"f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:03:41+00:00","detail_url":"/events/83977"},"members":[{"id":84103,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-886h-2jwh-vv2c","summary":"CGA-886h-2jwh-vv2c","evidence":"osv:CGA-886h-2jwh-vv2c","products":[{"name":{"value":"python-3.11","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.11","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.11.17-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-886h-2jwh-vv2c","aliases":["CGA-886h-2jwh-vv2c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/chainguard/python-3.11?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.17-r1"}]}],"package":{"name":"python-3.11","purl":"pkg:apk/wolfi/python-3.11?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-886h-2jwh-vv2c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.11","component_purl":"pkg:apk/python-3.11@3.11.16-r1","component_type":"apk","component_version":"3.11.16-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T22:13:07Z"}]}}],"modified":"2026-10-03T10:32:36.372428874Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-886h-2jwh-vv2c","advisory_id":"f0a0ec3a-b877-4be7-bfcc-bb57eada4e70","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-11"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:03:41+00:00","detail_url":"/events/84103"}]}},{"id":76284,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-r8pg-rhff-66jc","summary":"CGA-r8pg-rhff-66jc","evidence":"osv:CGA-r8pg-rhff-66jc","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r8pg-rhff-66jc","aliases":["CGA-r8pg-rhff-66jc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}}],"modified":"2026-10-02T23:01:44.950806016Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:97a2a188-3291-490a-b1de-66561d154d01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8pg-rhff-66jc","advisory_id":"97a2a188-3291-490a-b1de-66561d154d01","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:46:29+00:00","detail_url":"/advisories/advisory%3A97a2a188-3291-490a-b1de-66561d154d01","group":{"id":"advisory:97a2a188-3291-490a-b1de-66561d154d01","revision":2,"primary_event_id":84102,"change":"context","superseded_by":[],"changed":{"id":83976,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-r8pg-rhff-66jc","summary":"CGA-r8pg-rhff-66jc","evidence":"osv:CGA-r8pg-rhff-66jc","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r8pg-rhff-66jc","aliases":["CGA-r8pg-rhff-66jc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}}],"modified":"2026-10-02T23:01:44.950806016Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:97a2a188-3291-490a-b1de-66561d154d01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8pg-rhff-66jc","advisory_id":"97a2a188-3291-490a-b1de-66561d154d01","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:46:29+00:00","detail_url":"/events/83976"},"members":[{"id":84102,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-r8pg-rhff-66jc","summary":"CGA-r8pg-rhff-66jc","evidence":"osv:CGA-r8pg-rhff-66jc","products":[{"name":{"value":"python-3.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.12","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.12.15-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-r8pg-rhff-66jc","aliases":["CGA-r8pg-rhff-66jc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/chainguard/python-3.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.15-r1"}]}],"package":{"name":"python-3.12","purl":"pkg:apk/wolfi/python-3.12?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-r8pg-rhff-66jc.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.12","component_purl":"pkg:apk/python-3.12@3.12.14-r2","component_type":"apk","component_version":"3.12.14-r2","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:34:10Z"}]}}],"modified":"2026-10-02T23:01:44.950806016Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:97a2a188-3291-490a-b1de-66561d154d01","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-r8pg-rhff-66jc","advisory_id":"97a2a188-3291-490a-b1de-66561d154d01","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-12"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:46:29+00:00","detail_url":"/events/84102"}]}},{"id":76283,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vrrp-w2qr-mw5c","summary":"CGA-vrrp-w2qr-mw5c","evidence":"osv:CGA-vrrp-w2qr-mw5c","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrrp-w2qr-mw5c","aliases":["CGA-vrrp-w2qr-mw5c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}}],"modified":"2026-10-02T23:00:58.144642416Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1bd87fa2-e706-4bd0-8c81-9885106bd196","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrrp-w2qr-mw5c","advisory_id":"1bd87fa2-e706-4bd0-8c81-9885106bd196","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:58:33+00:00","detail_url":"/advisories/advisory%3A1bd87fa2-e706-4bd0-8c81-9885106bd196","group":{"id":"advisory:1bd87fa2-e706-4bd0-8c81-9885106bd196","revision":2,"primary_event_id":84101,"change":"context","superseded_by":[],"changed":{"id":83975,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vrrp-w2qr-mw5c","summary":"CGA-vrrp-w2qr-mw5c","evidence":"osv:CGA-vrrp-w2qr-mw5c","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrrp-w2qr-mw5c","aliases":["CGA-vrrp-w2qr-mw5c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}}],"modified":"2026-10-02T23:00:58.144642416Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1bd87fa2-e706-4bd0-8c81-9885106bd196","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrrp-w2qr-mw5c","advisory_id":"1bd87fa2-e706-4bd0-8c81-9885106bd196","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:58:33+00:00","detail_url":"/events/83975"},"members":[{"id":84101,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-vrrp-w2qr-mw5c","summary":"CGA-vrrp-w2qr-mw5c","evidence":"osv:CGA-vrrp-w2qr-mw5c","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-vrrp-w2qr-mw5c","aliases":["CGA-vrrp-w2qr-mw5c"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vrrp-w2qr-mw5c.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:27:56Z"}]}}],"modified":"2026-10-02T23:00:58.144642416Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1bd87fa2-e706-4bd0-8c81-9885106bd196","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vrrp-w2qr-mw5c","advisory_id":"1bd87fa2-e706-4bd0-8c81-9885106bd196","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:58:33+00:00","detail_url":"/events/84101"}]}},{"id":76282,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-9wqc-89rg-8gpr","summary":"CGA-9wqc-89rg-8gpr","evidence":"osv:CGA-9wqc-89rg-8gpr","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqc-89rg-8gpr","aliases":["CGA-9wqc-89rg-8gpr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:00:24.758478014Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96f80d59-c581-43b5-8406-30c5c13d6d54","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqc-89rg-8gpr","advisory_id":"96f80d59-c581-43b5-8406-30c5c13d6d54","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:17:14+00:00","detail_url":"/advisories/advisory%3A96f80d59-c581-43b5-8406-30c5c13d6d54","group":{"id":"advisory:96f80d59-c581-43b5-8406-30c5c13d6d54","revision":2,"primary_event_id":84100,"change":"context","superseded_by":[],"changed":{"id":83974,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-9wqc-89rg-8gpr","summary":"CGA-9wqc-89rg-8gpr","evidence":"osv:CGA-9wqc-89rg-8gpr","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqc-89rg-8gpr","aliases":["CGA-9wqc-89rg-8gpr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:00:24.758478014Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96f80d59-c581-43b5-8406-30c5c13d6d54","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqc-89rg-8gpr","advisory_id":"96f80d59-c581-43b5-8406-30c5c13d6d54","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:17:14+00:00","detail_url":"/events/83974"},"members":[{"id":84100,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-9wqc-89rg-8gpr","summary":"CGA-9wqc-89rg-8gpr","evidence":"osv:CGA-9wqc-89rg-8gpr","products":[{"name":{"value":"python-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-9wqc-89rg-8gpr","aliases":["CGA-9wqc-89rg-8gpr"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/chainguard/python-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.22-r1"}]}],"package":{"name":"python-3.10","purl":"pkg:apk/wolfi/python-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wqc-89rg-8gpr.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.10","component_purl":"pkg:apk/python-3.10@3.10.21-r0","component_type":"apk","component_version":"3.10.21-r0","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:00:24.758478014Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:96f80d59-c581-43b5-8406-30c5c13d6d54","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wqc-89rg-8gpr","advisory_id":"96f80d59-c581-43b5-8406-30c5c13d6d54","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-10"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T01:17:14+00:00","detail_url":"/events/84100"}]}},{"id":76281,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-36r3-9m2m-pwvx","summary":"CGA-36r3-9m2m-pwvx","evidence":"osv:CGA-36r3-9m2m-pwvx","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-36r3-9m2m-pwvx","aliases":["CGA-36r3-9m2m-pwvx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:05.449845704Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2ab83f2c-ab58-49b9-89d2-f8037bf134a3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36r3-9m2m-pwvx","advisory_id":"2ab83f2c-ab58-49b9-89d2-f8037bf134a3","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-24T23:57:38+00:00","detail_url":"/advisories/advisory%3A2ab83f2c-ab58-49b9-89d2-f8037bf134a3","group":{"id":"advisory:2ab83f2c-ab58-49b9-89d2-f8037bf134a3","revision":2,"primary_event_id":84099,"change":"context","superseded_by":[],"changed":{"id":83973,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-36r3-9m2m-pwvx","summary":"CGA-36r3-9m2m-pwvx","evidence":"osv:CGA-36r3-9m2m-pwvx","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-36r3-9m2m-pwvx","aliases":["CGA-36r3-9m2m-pwvx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:05.449845704Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2ab83f2c-ab58-49b9-89d2-f8037bf134a3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":2,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36r3-9m2m-pwvx","advisory_id":"2ab83f2c-ab58-49b9-89d2-f8037bf134a3","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-24T23:57:38+00:00","detail_url":"/events/83973"},"members":[{"id":84099,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"CGA-36r3-9m2m-pwvx","summary":"CGA-36r3-9m2m-pwvx","evidence":"osv:CGA-36r3-9m2m-pwvx","products":[{"name":{"value":"python-3.13","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-3.13","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.13.16_git20261002-r0","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CGA-36r3-9m2m-pwvx","aliases":["CGA-36r3-9m2m-pwvx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/chainguard/python-3.13?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.16_git20261002-r0"}]}],"package":{"name":"python-3.13","purl":"pkg:apk/wolfi/python-3.13?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-36r3-9m2m-pwvx.json"},"ecosystem_specific":{"components":[{"component_name":"python-3.13","component_purl":"pkg:apk/python-3.13@3.13.15-r1","component_type":"apk","component_version":"3.13.15-r1","component_location":"/.PKGINFO","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T18:10:44Z"}]}}],"modified":"2026-10-02T23:00:05.449845704Z","provider":"osv","upstream":["CVE-2026-19672","GHSA-prxg-vvhf-mgqq"],"references":[]},"related_cves":[{"value":"CVE-2026-19672","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:2ab83f2c-ab58-49b9-89d2-f8037bf134a3","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":4,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-36r3-9m2m-pwvx","advisory_id":"2ab83f2c-ab58-49b9-89d2-f8037bf134a3","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-3-13"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-24T23:57:38+00:00","detail_url":"/events/84099"}]}},{"id":76280,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-min-2026-19672","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537167570Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7edba35f-9074-46c2-a998-c29fb40ce42f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","advisory_id":"7edba35f-9074-46c2-a998-c29fb40ce42f","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-min"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.866+00:00","detail_url":"/advisories/advisory%3A7edba35f-9074-46c2-a998-c29fb40ce42f","group":{"id":"advisory:7edba35f-9074-46c2-a998-c29fb40ce42f","revision":1,"primary_event_id":84098,"change":"published","superseded_by":[],"changed":{"id":83971,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-min-2026-19672","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537167570Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7edba35f-9074-46c2-a998-c29fb40ce42f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","advisory_id":"7edba35f-9074-46c2-a998-c29fb40ce42f","event_types":["advisory"],"published_at":"2026-10-26T22:36:05.725032+00:00","technologies":["core-osv","python-min"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.866+00:00","detail_url":"/events/83971"},"members":[{"id":84098,"cve_ids":["CVE-2026-19672"],"payload":{"kind":"advisory","title":"tarfile extraction filter bypass allows creation of directories outside the destination","summary":"The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name as given. Only empty directories are created outside the destination. Member contents are still extracted inside it. To return to the destination the member's name must contain the destination directory's own final component, so extraction into a secure randomised directory is not affected. This affects POSIX platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the directories outside the destination are never created.","evidence":"osv:BIT-python-min-2026-19672","products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"BIT-python-min-2026-19672","aliases":["BIT-libpython-2026-19672","BIT-python-2026-19672","BIT-python-min-2026-19672","CVE-2026-19672","PSF-2026-38"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.10.22"},{"introduced":"3.11.0"},{"fixed":"3.11.17"},{"introduced":"3.12.0"},{"fixed":"3.12.15"},{"introduced":"3.13.0"},{"fixed":"3.13.16"},{"introduced":"3.14.0"},{"fixed":"3.14.8"}]}],"package":{"name":"python-min","purl":"pkg:bitnami/python-min","ecosystem":"Bitnami"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/python-min/BIT-python-min-2026-19672.json"}}],"modified":"2026-10-05T14:30:04.537167570Z","provider":"osv","references":["https://github.com/python/cpython/pull/156000","https://mail.python.org/archives/list/security-announce@python.org/thread/J2WT2ALRWEXQJOB3C7Q2HYWUXP3CINWO/","https://nvd.nist.gov/vuln/detail/CVE-2026-19672"],"provider_metadata":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"severity":"Medium"}},"related_cves":[{"value":"CVE-2026-19672","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"advisory:7edba35f-9074-46c2-a998-c29fb40ce42f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":3,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","advisory_id":"7edba35f-9074-46c2-a998-c29fb40ce42f","event_types":["advisory"],"published_at":"2026-10-26T22:36:25.706536+00:00","technologies":["core-osv","python-min"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-08-25T12:57:48.866+00:00","detail_url":"/events/84098"}]}},{"id":67655,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/advisories/advisory%3A38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","group":{"id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","revision":1,"primary_event_id":84219,"change":"published","superseded_by":[],"changed":{"id":68025,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-25T21:20:20.94062+00:00","technologies":["core-osv","python","python-base"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/68025"},"members":[{"id":84219,"cve_ids":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"payload":{"kind":"advisory","title":"Security update for python","summary":"This update for python fixes the following issues: - CVE-2026-6879: quadratic behavior in `xml.etree.ElementPath` index predicates can lead to a denial of service via high CPU usage (bsc#1273148). - CVE-2026-9669: crafted input can cause a stack buffer overflow (bsc#1267974). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-18503: attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU (bsc#1274683). - CVE-2026-19672: The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and retu (bsc#1276227). Changes for python: - Update bundled setuptools wheels to setuptools-40.6.2-py2.py3-none-any.whl (bsc#1276903)","evidence":"osv:SUSE-SU-2026:4411-1","products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"python-base","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.7.18-150000.133.1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"SUSE-SU-2026:4411-1","aliases":["SUSE-SU-2026:4411-1"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python","purl":"pkg:rpm/suse/python&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.18-150000.133.1"}]}],"package":{"name":"python-base","purl":"pkg:rpm/suse/python-base&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7"},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4411-1.json"},"ecosystem_specific":{"binaries":[{"python":"2.7.18-150000.133.1","python-xml":"2.7.18-150000.133.1","python-base":"2.7.18-150000.133.1","python-gdbm":"2.7.18-150000.133.1","python-curses":"2.7.18-150000.133.1","libpython2_7-1_0":"2.7.18-150000.133.1"}]}}],"modified":"2026-10-02T11:30:04.071737814Z","provider":"osv","upstream":["CVE-2026-15806","CVE-2026-17084","CVE-2026-18503","CVE-2026-19672","CVE-2026-6879","CVE-2026-9669"],"references":["https://www.suse.com/support/update/announcement/2026/suse-su-20264411-1/","https://bugzilla.suse.com/1267974","https://bugzilla.suse.com/1273148","https://bugzilla.suse.com/1274683","https://bugzilla.suse.com/1276223","https://bugzilla.suse.com/1276226","https://bugzilla.suse.com/1276227","https://bugzilla.suse.com/1276903","https://www.suse.com/security/cve/CVE-2026-15806","https://www.suse.com/security/cve/CVE-2026-17084","https://www.suse.com/security/cve/CVE-2026-18503","https://www.suse.com/security/cve/CVE-2026-19672","https://www.suse.com/security/cve/CVE-2026-6879","https://www.suse.com/security/cve/CVE-2026-9669"]},"related_cves":[{"value":"CVE-2026-15806","evidence":"/upstream"},{"value":"CVE-2026-17084","evidence":"/upstream"},{"value":"CVE-2026-18503","evidence":"/upstream"},{"value":"CVE-2026-19672","evidence":"/upstream"},{"value":"CVE-2026-6879","evidence":"/upstream"},{"value":"CVE-2026-9669","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-15806","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-15806","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-15806","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":6,"Automatable":"NOT_DEFINED","attackVector":"NETWORK","baseSeverity":"MEDIUM","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-17084","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-17084","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-18503","metrics":[{"format":"CVSS","cvssV4_0":{"Safety":"NOT_DEFINED","version":"4.0","Recovery":"NOT_DEFINED","baseScore":2.4,"Automatable":"NOT_DEFINED","attackVector":"LOCAL","baseSeverity":"LOW","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitMaturity":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"CPython","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"low","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18503","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"libpython","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-libpython-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"},{"cve":"CVE-2026-19672","metrics":[],"products":[{"name":{"value":"python-min","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.10.22","evidence":"/affected/0/ranges"},{"value":"3.11.17","evidence":"/affected/0/ranges"},{"value":"3.12.15","evidence":"/affected/0/ranges"},{"value":"3.13.16","evidence":"/affected/0/ranges"},{"value":"3.14.8","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-python-min-2026-19672","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":10,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/SUSE-SU-2026%3A4411-1","advisory_id":"38d0dc25-9bef-4b79-b1c3-9ca5cd6cc4e5","event_types":["advisory"],"published_at":"2026-10-26T22:38:34.395971+00:00","technologies":["core-osv","python","python-base"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-10-01T15:38:59+00:00","detail_url":"/events/84219"}]}}],"next_after":77228,"next_before":67655}