CVE-2026-31072
2 advisories.
PyPI/apscheduler CVE-2026-31072: critical 9.8, EPSS 1.01%
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0a1 | - | 4.0.0a6 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-9cfw-f3f9-7mm7
- https://nvd.nist.gov/vuln/detail/CVE-2026-31072
- https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6
- https://github.com/agronholm/apscheduler
CVE-2026-31072 · published · modified · JSON
PyPI/apscheduler CVE-2026-31072: critical 9.8, EPSS 1.01%
APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0a1 | - | 4.0.0a6 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2026-282
- https://nvd.nist.gov/vuln/detail/CVE-2026-31072
- https://gist.github.com/nedlir/11fb77f35a59cbba73392a086b02a9c6
- https://github.com/agronholm/apscheduler
- https://pypi.org/project/apscheduler
- https://github.com/advisories/GHSA-9cfw-f3f9-7mm7
CVE-2026-31072 · published · modified · JSON