github.com/toced/repo-scanner
Submitted 10/26/2026, 3:06:16 PM · Status: ok
Risk grade
D
46 / 100
Findings
12
1 critical0 high11 medium0 low0 info0 on CISA KEV0ATT&CK
Showing 12 of 12 findings
Findings
- AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofinggrypeCVE-2026-63374EPSS 0.3%
- AnyIO process-pool workers can block indefinitely on undrained stderrgrypeCVE-2026-64847EPSS 0.2%
- Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixgrypeCVE-2026-45409EPSS 0.5%
- python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallbackgrypeCVE-2026-28684EPSS 0.2%
- AnyIO process-pool workers can block indefinitely on undrained stderr### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redi…osv-scannerCVE-2026-64847
- AnyIO process-pool workers can block indefinitely on undrained stderr### Impact AnyIO starts process-pool workers with stderr connected to a pipe but never drains that pipe. The worker redirects stdin and stdout to /dev/null to protect its protocol, but does not redirect stderr even though the documentation says all three standard streams are redi…osv-scannerCVE-2026-64847
- AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious serve…osv-scannerCVE-2026-63374
- AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing### Impact Services using internationalized (non-ASCII) domain names are potentially vulnerable to TLS connections made from AnyIO's `connect_tcp()` or directly via `TLSStream.wrap()` where the connection has (through other means) been hijacked and redirected to a malicious serve…osv-scannerCVE-2026-63374
- Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixThis is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fix. Payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time…osv-scannerCVE-2026-45409
- PYSEC-2026-215Internationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `"\u0660" * N` or `"\u30fb" * N + "\u6f22"` utilize t…osv-scannerCVE-2026-45409
- PYSEC-2026-2270python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a c…osv-scannerCVE-2026-28684
- python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback### Summary `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. ### Details The `rewrite()` context man…osv-scannerCVE-2026-28684
This report is public.