Matched advisory candidates (shard 39)

advisories/BREW-charmcraft-CVE-2025-43859.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-charmcraft-CVE-2025-43859",
   "published": "2026-08-13T16:39:06Z",
-  "modified": "2026-09-17T19:40:52Z",
+  "modified": "2026-10-27T19:31:38Z",
   "upstream": [
     "GHSA-vqfr-h8mv-ghfj",
     "CVE-2025-43859",
@@ -73,9 +73,17 @@
       "type": "WEB",
       "url": "https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/h11/PYSEC-2026-348.yaml"
+    },
     {
       "type": "PACKAGE",
       "url": "https://github.com/python-hyper/h11"
+    },
+    {
+      "type": "WEB",
+      "url": "https://pypi.org/project/h11"
     }
   ]
 }

advisories/BREW-charmcraft-CVE-2026-49272.json

@@ -0,0 +1,76 @@
+{
+  "schema_version": "1.7.3",
+  "id": "BREW-charmcraft-CVE-2026-49272",
+  "published": "2026-10-27T19:32:53Z",
+  "modified": "2026-10-27T19:32:53Z",
+  "upstream": [
+    "GHSA-3jp2-3mrg-2vxc",
+    "CVE-2026-49272"
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Homebrew",
+        "name": "charmcraft",
+        "purl": "pkg:brew/charmcraft"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.5.1_1"
+            },
+            {
+              "fixed": "4.4.2_1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "fix": "bump",
+        "range_state": "fixed",
+        "upstream_fixed_in": "4.0.0",
+        "resource": "oauthlib",
+        "resource_purl": "pkg:pypi/oauthlib@4.0.0"
+      }
+    }
+  ],
+  "database_specific": {
+    "source": "matched",
+    "strategy": "registry",
+    "confidence": "high",
+    "upstream_evidence": [
+      {
+        "strategy": "registry",
+        "ecosystem": "PyPI",
+        "name": "oauthlib",
+        "subject_version": "4.0.0",
+        "key": "pkg:pypi/oauthlib@4.0.0",
+        "resource": "oauthlib"
+      }
+    ]
+  },
+  "summary": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
+  "details": "### Summary\nA call to the token endpoint with a grant type of `\"urn:ietf:params:oauth:grant-type:device_code\"` and a bogus `device_code` is able to get a bearer token as long as they know a valid client ID enabled for the device workflow.\n\n### Details\n\n[Section 3.4 of the RFC 8628 spec](https://datatracker.ietf.org/doc/html/rfc8628#section-3.4) says that the token endpoint should take in `device_code` as a required parameter.`DeviceCodeGrant.validate_token_request` does not perform any validation of `device_code`. `DeviceCodeGrant.validate_token_request` should be validating that `device_code` was passed in as a parameter and that it is valid, similar to how `AuthorizationCodeGrant.validate_token_request` does the checks [here](https://github.com/oauthlib/oauthlib/blob/a015b446622f2b925517501fe484c10eff7a83c0/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py#L446) and [here](https://github.com/oauthlib/oauthlib/blob/a015b446622f2b925517501fe484c10eff7a83c0/oauthlib/oauth2/rfc6749/grant_types/authorization_code.py#L483).\n\nI would like to propose a new method be added to `RequestValidator` called `validate_device_code` that is similar to the `validate_code` method and is called inside of `DeviceCodeGrant.validate_token_request`.\n\n### PoC\nCreate an implementation of `RequestValidation.authenticate_client` that returns `True` if the client's `client_type` is `\"public\"`. You would find yourself in this scenario because there's another issue with `DeviceCodeGrant.validate_token_request` where it doesn't properly handle public clients (see https://github.com/oauthlib/oauthlib/issues/919).\n\nCreate a client that has a `client_type` of `\"public\"` and set it's `grant_type` to `\"urn:ietf:params:oauth:grant-type:device_code\"`.\n\nWith this implementation of `RequestValidation.authenticate_client` done, use that validator for your token endpoint. Call the token endpoint with a body of \n```\n{\n  \"client_id\": <ID of the public client you made>,\n  \"grant_type\": \"urn:ietf:params:oauth:grant-type:device_code\",\n  \"device_code\": <anything you want since it's not validated>\n}\n```\n\nYou now have a bearer token for the client without a valid `device_code`.\n\n\n### Impact\nAnyone using the RFC 8628 device workflow in oauthlib that doesn't realize the `device_code` parameter is not being validated.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3jp2-3mrg-2vxc"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/oauthlib/oauthlib"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/oauthlib/oauthlib/releases/tag/v4.0.0"
+    }
+  ]
+}

advisories/BREW-pferd-CVE-2026-104874.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-104874",
   "published": "2026-10-06T11:15:19Z",
-  "modified": "2026-10-16T10:42:48Z",
+  "modified": "2026-10-27T20:16:34Z",
   "upstream": [
     "GHSA-54p9-h82j-f925",
     "CVE-2026-104874",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "6.9.1",
         "resource": "multidict",
-        "resource_purl": "pkg:pypi/multidict@7.1.0"
+        "resource_purl": "pkg:pypi/multidict@7.2.1"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "multidict",
-        "subject_version": "7.1.0",
-        "key": "pkg:pypi/multidict@7.1.0",
+        "subject_version": "7.2.1",
+        "key": "pkg:pypi/multidict@7.2.1",
         "resource": "multidict"
       }
     ]

advisories/BREW-pferd-CVE-2026-111063.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111063",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-494j-54xm-rwp3",
     "CVE-2026-111063"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"
@@ -50,11 +53,21 @@
   },
   "summary": "AIOHTTP: Secure attribute not enforced for shared cookie",
   "details": "### Summary\n\nThe Secure attribute was not being enforced for the shared cookie.\n\n### Impact\n\nIt may be possible to send a shared cookie marked Secure through an unencrypted request.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
   "references": [
     {
       "type": "WEB",
       "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111063"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5"

advisories/BREW-pferd-CVE-2026-111064.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111064",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-5wr8-gcqf-gqf3",
     "CVE-2026-111064"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-111065.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111065",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-6cjc-53gc-5rqm",
     "CVE-2026-111065"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-111066.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111066",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-9xw5-w5jj-pvcg",
     "CVE-2026-111066"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-111748.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111748",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-f9xw-jh8m-3mwq",
     "CVE-2026-111748"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-111749.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111749",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:13:04Z",
   "upstream": [
     "GHSA-gx76-c99x-2c96",
     "CVE-2026-111749"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-111750.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-111750",
   "published": "2026-10-21T10:58:34Z",
-  "modified": "2026-10-21T10:58:34Z",
+  "modified": "2026-10-27T20:16:34Z",
   "upstream": [
     "GHSA-pqxq-w44r-73xw",
     "CVE-2026-111750"
@@ -20,13 +20,16 @@
           "events": [
             {
               "introduced": "3.4.2"
+            },
+            {
+              "fixed": "3.10.0"
             }
           ]
         }
       ],
       "ecosystem_specific": {
-        "fix": null,
-        "range_state": "affected",
+        "fix": "bump",
+        "range_state": "fixed",
         "upstream_fixed_in": "3.14.4",
         "resource": "aiohttp",
         "resource_purl": "pkg:pypi/aiohttp@3.14.5"

advisories/BREW-pferd-CVE-2026-49476.json

@@ -2,7 +2,7 @@
   "schema_version": "1.7.3",
   "id": "BREW-pferd-CVE-2026-49476",
   "published": "2026-08-13T17:26:03Z",
-  "modified": "2026-10-06T20:09:02Z",
+  "modified": "2026-10-27T20:16:34Z",
   "upstream": [
     "GHSA-2wc2-fm75-p42x",
     "CVE-2026-49476",
@@ -33,7 +33,7 @@
         "range_state": "fixed",
         "upstream_fixed_in": "2.8.4",
         "resource": "soupsieve",
-        "resource_purl": "pkg:pypi/soupsieve@2.10"
+        "resource_purl": "pkg:pypi/soupsieve@3.0.4"
       }
     }
   ],
@@ -46,8 +46,8 @@
         "strategy": "registry",
         "ecosystem": "PyPI",
         "name": "soupsieve",
-        "subject_version": "2.10",
-        "key": "pkg:pypi/soupsieve@2.10",
+        "subject_version": "3.0.4",
+        "key": "pkg:pypi/soupsieve@3.0.4",
         "resource": "soupsieve"
       }
     ]