Agronholm vulnerabilities
We track 6 vulnerabilities in Agronholm products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Agronholm vulnerabilities
- 9.3 Critical severity
anyio: Improper Certificate Validation
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDN
- 7.0 High severity
anyio: Incorrect Privilege Assignment
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group
- 7.5 High severity
cbor2: Uncontrolled Recursion
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structur
- 7.5 High severity
cbor2: Improper Removal of Sensitive Information Before Storage or Transfer
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with th
- 7.5 High severity
Cbor2: Integer Underflow (Wrap or Wraparound)
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference a
- 7.5 High severity
cbor2: Buffer Copy without Checking Size of Input
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long