Watch card · compiled automatically, not analysed
GHSA-6q48-6c7w-9gw2
certifi bundles emSign root CAs with compromised intermediate CA keys
AI summarycertifi, the widely used Python CA bundle, has a critical update that removes the emSign root certificate; users should update.
Our research pipeline compiles this page from public data. It contains no human judgement from PlainCVE; rely on the original advisories for facts.
Our status
Candidate — Not queued for research yet. Below is public data only.
Key numbers
- CVSS
- 9.1 v4.0
- CISA KEV
- Not listed
- EPSS
- —
- Momentum
- 4.1 Steady
Timeline
- 2026-10-20DisclosedGitHub Advisory Database
- 2026-10-20First reportedoss-security
How much time similar vulnerabilities gave
This item is not mapped to a category yet, so here are the overall numbers: of 390 vulnerabilities disclosed since 2025 and added to KEV, the median time from disclosure to KEV was 5 days; 54% were added within 7 days.
This one: not in KEV so far (that does not mean it is not exploited).
Counts only vulnerabilities CISA has confirmed as exploited; disclosure is the NVD publication date, which can differ from the vendor advisory.
Affected packages (OSV)
| Ecosystem | Package | From | Fixed in |
|---|---|---|---|
| PyPI | certifi | 2019.03.09 | 2026.10.19 |
What drives the momentum
- Coverage(mailing lists)+4.1
Coverage
- 2026-10-20 oss-security
Primary sources
Watch cards update with This week every 3 hours. Once we write this up, this URL will point to the write-up.