Vulnerabilities

 1 via 2 paths

Dependencies

 5

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 1
  • 1
Severity
  • 1
  • 1
Status
  • 2
  • 0
  • 0

critical severity
new

Improper Certificate Validation

  • Vulnerable module: certifi
  • Introduced through: certifi@2026.7.22 and sentry-sdk@2.71.0

Detailed paths

  • Introduced through: QWED-AI/qwed-a2a@QWED-AI/qwed-a2a › certifi@2026.7.22
    Remediation: Upgrade to certifi@2026.10.18.
  • Introduced through: QWED-AI/qwed-a2a@QWED-AI/qwed-a2a › sentry-sdk@2.71.0 › certifi@2026.7.22

Overview

Affected versions of this package are vulnerable to Improper Certificate Validation via the cacert.pem bundle, which includes the emSign ECC Root CA - G3 root certificate. Eight eMudhra intermediate CA certificates chaining to this root have compromised private keys and have been revoked. An attacker holding one of these keys can issue certificates that the bundle accepts for any hostname and, if positioned on-path, intercept or modify TLS traffic from clients that trust the certifi bundle.

Remediation

Upgrade certifi to version 2026.10.18 or higher.

References

Improper Certificate Validation vulnerability report

medium severity

MPL-2.0 license

  • Module: certifi
  • Introduced through: certifi@2026.7.22 and sentry-sdk@2.71.0

Detailed paths

  • Introduced through: QWED-AI/qwed-a2a@QWED-AI/qwed-a2a › certifi@2026.7.22
  • Introduced through: QWED-AI/qwed-a2a@QWED-AI/qwed-a2a › sentry-sdk@2.71.0 › certifi@2026.7.22

MPL-2.0 license

MPL-2.0 license vulnerability report