# stigmem-node (PyPI) vulnerabilities 10 known vulnerabilities (3 critical, 6 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.9.0a12 (Jun 18, 2026): no advisory affects it - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 26 - Dependents: 11 - Releases: 12 since 0.9.0a1 (May 9, 2026) - Registry: https://pypi.org/project/stigmem-node/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-76245: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76244: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76243: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76242: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76241: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76240: 0.9.0a1 (0.9.0a2 is outside it) - CVE-2026-76239: 0.9.0a1 to 0.9.0a10 (0.9.0a11 is outside it) - CVE-2026-76238: 0.9.0a1 to 0.9.0a11 (0.9.0a12 is outside it) - CVE-2026-76237: 0.9.0a1 to 0.9.0a11 (0.9.0a12 is outside it) - CVE-2026-76236: 0.9.0a1 to 0.9.0a11 (0.9.0a12 is outside it) ## Advisories (10) ### [CVE-2026-76245](https://cve.now/CVE-2026-76245): stigmem Federation Peer Token Timestamp Validation Bypass - Severity: High 7.1 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76244](https://cve.now/CVE-2026-76244): stigmem-node Insecure Federation Transport Configuration - Severity: Critical 9.1 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76243](https://cve.now/CVE-2026-76243): stigmem before 0.9.0a2 Authentication Bypass via Disabled Auth - Severity: Critical 9.2 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76242](https://cve.now/CVE-2026-76242): stigmem Federation Peer Registration Authentication Bypass - Severity: Critical 9.1 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76241](https://cve.now/CVE-2026-76241): stigmem Plugin Signature Enforcement Bypass via Configuration - Severity: High 7.3 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76240](https://cve.now/CVE-2026-76240): stigmem Postgres SQL Injection via Schema Identifier - Severity: High 7.5 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a2. - Fixed in 0.9.0a2 (released May 19, 2026, 92 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76239](https://cve.now/CVE-2026-76239): Stigmem before 0.9.0a11 SSRF via unvalidated webhook delivery\_address - Severity: Medium 5.3 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a11. - Fixed in 0.9.0a11 (released Jun 12, 2026, 68 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76238](https://cve.now/CVE-2026-76238): stigmem before 0.9.0a12 Cross-Tenant BOLA via decay sweep - Severity: High 7.2 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a12. - Fixed in 0.9.0a12 (released Jun 18, 2026, 62 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76237](https://cve.now/CVE-2026-76237): stigmem before 0.9.0a12 Cross-Tenant BOLA via quarantine - Severity: High 8.6 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a12. - Fixed in 0.9.0a12 (released Jun 18, 2026, 62 days before disclosure). - The latest release, 0.9.0a12, is not affected. ### [CVE-2026-76236](https://cve.now/CVE-2026-76236): stigmem before 0.9.0a12 Cross-Tenant BOLA via Tombstones - Severity: High 7.2 - Published: Aug 19, 2026 - Affected: fixed in 0.9.0a12. - Fixed in 0.9.0a12 (released Jun 18, 2026, 62 days before disclosure). - The latest release, 0.9.0a12, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/stigmem-node Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.