{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T15:03:09.339Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T15:01:18.334Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:pillow","slug":"pillow-834347dd","identity":"pypi:pillow","ecosystem":"pypi","name":"pillow","label":"pillow","category":null,"aiRelevant":false,"provider":null,"repositoryCount":13,"occurrenceCount":15,"directRepositoryCount":0,"versionCount":8,"licenseExpressions":["HPND","MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-xg8h-j46f-w952","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"advisoryCount":15,"verifiedAttestation":true,"repositories":[{"id":"opencode:10162","slug":"opencode-10162","name":"SmartPlanAI Anwendung","pathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","versions":["11.3.0","12.1.1"],"evidenceCount":2},{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["11.2.1"],"evidenceCount":2},{"id":"opencode:6174","slug":"opencode-6174","name":"Energieautarkes Wohnquartier - Backend","pathWithNamespace":"energieautarkes-wohnquartier/backend","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:3608","slug":"opencode-3608","name":"AI","pathWithNamespace":"iqsh/collaboration-online-board/ai","versions":["10.3.0"],"evidenceCount":1},{"id":"opencode:7674","slug":"opencode-7674","name":"Coding Agent Usage Simulation","pathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","versions":["12.0.0"],"evidenceCount":1},{"id":"opencode:9998","slug":"opencode-9998","name":"density-maps","pathWithNamespace":"uba-ki-lab/density-maps","versions":["12.1.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["11.3.0"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["11.3.0"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["11.1.0"],"evidenceCount":1},{"id":"opencode:5201","slug":"opencode-5201","name":"photovoltaic_systems","pathWithNamespace":"uba-ki-lab/photovoltaic_systems","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["12.1.0"],"evidenceCount":1},{"id":"opencode:7811","slug":"opencode-7811","name":"Retrieval Evaluation","pathWithNamespace":"uba-ki-lab/retrieval-evaluation","versions":["10.4.0"],"evidenceCount":1}],"versions":[{"version":"10.3.0","repositoryCount":1,"occurrenceCount":1,"ageDays":840,"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-04-01T12:18:08Z","deprecated":false,"deprecatedReason":null,"licenses":["HPND"],"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3453"],"links":[{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.org/"},{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"10.4.0","repositoryCount":1,"occurrenceCount":1,"ageDays":749,"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-07-01T09:46:56Z","deprecated":false,"deprecatedReason":null,"licenses":["HPND"],"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3453"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.org/"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"11.1.0","repositoryCount":1,"occurrenceCount":1,"ageDays":564,"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-01-02T08:12:15Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3453"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/11.1.0/pillow-11.1.0-cp313-cp313-manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/11.1.0/pillow-11.1.0-cp313-cp313-manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"4c1aed801e43c6b307e7135279ca1dbc02bbf052"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"11.2.1","repositoryCount":4,"occurrenceCount":5,"ageDays":463,"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-xg8h-j46f-w952","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-04-12T17:48:34Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-xg8h-j46f-w952","PYSEC-2025-61","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2251","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3453"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/11.2.1/pillow-11.2.1-cp313-cp313-manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/11.2.1/pillow-11.2.1-cp313-cp313-manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"339bc5db93bd95decf65a59fab273f300db6594d"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"11.3.0","repositoryCount":3,"occurrenceCount":3,"ageDays":384,"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-07-01T09:15:23Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2251","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3453"],"links":[{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/11.3.0/pillow-11.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/11.3.0/pillow-11.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"89f1f4626a2aaf5f3d5ca6437f41def2998fbe09"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"12.0.0","repositoryCount":1,"occurrenceCount":1,"ageDays":277,"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2025-10-15T18:23:25Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2251","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/12.0.0/pillow-12.0.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/12.0.0/pillow-12.0.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"693df7b42c666f88c719f9973be0ad71607328e0"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"12.1.0","repositoryCount":1,"occurrenceCount":1,"ageDays":199,"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-01-02T09:12:39Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-cfh3-3jmp-rvhc","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2249","PYSEC-2026-2250","PYSEC-2026-2251","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"links":[{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/12.1.0/pillow-12.1.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/12.1.0/pillow-12.1.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"46f45f674d47b5d8bc54230dda8fe9e214598b87"}],"verifiedAttestation":true,"projectStatus":"active"}},{"version":"12.1.1","repositoryCount":2,"occurrenceCount":2,"ageDays":159,"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-02-11T04:22:17Z","deprecated":false,"deprecatedReason":null,"licenses":["MIT-CMU"],"advisoryIds":["GHSA-5xmw-vc9v-4wf2","GHSA-pwv6-vv43-88gr","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","PYSEC-2026-165","PYSEC-2026-2250","PYSEC-2026-2251","PYSEC-2026-2252","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2874","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/python-pillow/Pillow"},{"label":"DOCUMENTATION","url":"https://pillow.readthedocs.io/"},{"label":"HOMEPAGE","url":"https://python-pillow.github.io/"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/pillow/12.1.1/pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance"}],"relatedProjects":[{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/python-pillow/pillow","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/pillow/12.1.1/pillow-12.1.1-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl/provenance","verified":true,"sourceRepository":"https://github.com/python-pillow/Pillow","commit":"5158d98c807e719c5938aa3886913ef0ea6814e9"}],"verifiedAttestation":true,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:891348c4353de3a66c0e5362","repositoryId":"opencode:3608","repositorySlug":"opencode-3608","repositoryName":"AI","repositoryPathWithNamespace":"iqsh/collaboration-online-board/ai","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"10.3.0","versionKey":"pypi:pillow@10.3.0","direct":null,"development":null,"sourceKind":"spdx-yaml","filePath":"SPDX_v2.0.0.yml","blobSha":"e9e46566a2217346214d08f9dede99d8821b3c68","sourceUrl":"https://gitlab.opencode.de/iqsh/collaboration-online-board/ai/-/blob/7cc4cbe5064bc5ede2426caf6981c5e9d0509327/SPDX_v2.0.0.yml","commitSha":"7cc4cbe5064bc5ede2426caf6981c5e9d0509327"},{"id":"component:d888e4f1a78fa80bd49f055d","repositoryId":"opencode:7674","repositorySlug":"opencode-7674","repositoryName":"Coding Agent Usage Simulation","repositoryPathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"12.0.0","versionKey":"pypi:pillow@12.0.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"1b1464cf01496db34285bf91f7841aed50559816","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/coding-agent-usage-simulation/-/blob/fe8ab81af4926a34c6cf1f3a807ffeda2b398f32/uv.lock","commitSha":"fe8ab81af4926a34c6cf1f3a807ffeda2b398f32"},{"id":"component:58e6589199b7bfe1e52d6b2a","repositoryId":"opencode:9998","repositorySlug":"opencode-9998","repositoryName":"density-maps","repositoryPathWithNamespace":"uba-ki-lab/density-maps","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"12.1.1","versionKey":"pypi:pillow@12.1.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fa64e230fe01c25e6d465e090acbed3d4d86a694","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/density-maps/-/blob/1da30304236d86dfb376a429b1ea6e9fddba3a0a/uv.lock","commitSha":"1da30304236d86dfb376a429b1ea6e9fddba3a0a"},{"id":"component:bbf2606e9de4d9f4886334c0","repositoryId":"opencode:6174","repositorySlug":"opencode-6174","repositoryName":"Energieautarkes Wohnquartier - Backend","repositoryPathWithNamespace":"energieautarkes-wohnquartier/backend","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.2.1","versionKey":"pypi:pillow@11.2.1","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"dc5008ef9fba69d70ea9e7b3fea21265fa5ef93d","sourceUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend/-/blob/fc7e24cd546449ac9fdee4ad78aab861e0c89666/poetry.lock","commitSha":"fc7e24cd546449ac9fdee4ad78aab861e0c89666"},{"id":"component:480cb95dc0d09447f071483d","repositoryId":"opencode:5530","repositorySlug":"opencode-5530","repositoryName":"GSA Extraction","repositoryPathWithNamespace":"uba-ki-lab/gsa-extraction","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.3.0","versionKey":"pypi:pillow@11.3.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fbb23733e647554b5678500b3f17f13bac7f77f5","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/gsa-extraction/-/blob/f5161e79d3f8c53877f9b1b0d72e1c10bff775ba/uv.lock","commitSha":"f5161e79d3f8c53877f9b1b0d72e1c10bff775ba"},{"id":"component:93da6acf440ac867badff1b4","repositoryId":"opencode:10787","repositorySlug":"opencode-10787","repositoryName":"LLM Questionnaire Benchmarking Framework","repositoryPathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.3.0","versionKey":"pypi:pillow@11.3.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"1b55661fee93d4733461df8e9c2b491b9205aac2","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-questionnaire-benchmarking-framework/-/blob/4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd/uv.lock","commitSha":"4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd"},{"id":"component:016d920b90907dd9358f43a7","repositoryId":"opencode:5012","repositorySlug":"opencode-5012","repositoryName":"LLM Testframework","repositoryPathWithNamespace":"uba-ki-lab/llm-testframework","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.2.1","versionKey":"pypi:pillow@11.2.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"b4c29eab16a40db016821e4ea567956048a046ea","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-testframework/-/blob/e8d6e99a1fa63b264e727acb553ed9b1499789b1/uv.lock","commitSha":"e8d6e99a1fa63b264e727acb553ed9b1499789b1"},{"id":"component:031cce3ea6abef860356bd3c","repositoryId":"opencode:4112","repositorySlug":"opencode-4112","repositoryName":"Objection management","repositoryPathWithNamespace":"uba-ki-lab/objection-management","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.1.0","versionKey":"pypi:pillow@11.1.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"8515db65670904208e99397a2d7878af759c74f3","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/objection-management/-/blob/5c1425bf9990cf12c5ae8ada47d249710703af18/uv.lock","commitSha":"5c1425bf9990cf12c5ae8ada47d249710703af18"},{"id":"component:9279674557ba5f3d88c6d7c9","repositoryId":"opencode:5201","repositorySlug":"opencode-5201","repositoryName":"photovoltaic_systems","repositoryPathWithNamespace":"uba-ki-lab/photovoltaic_systems","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.2.1","versionKey":"pypi:pillow@11.2.1","direct":null,"development":null,"sourceKind":"sbom-json","filePath":"sbom.json","blobSha":"90b7d669fbf37c00e7bd5bf4e73a60e7eb78927e","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/photovoltaic_systems/-/blob/d0ec9137f2985f323b9aad141d83c47d14c64cce/sbom.json","commitSha":"d0ec9137f2985f323b9aad141d83c47d14c64cce"},{"id":"component:d49988b62a92f5e1055cd63e","repositoryId":"opencode:10775","repositorySlug":"opencode-10775","repositoryName":"Ressource Efficient Computer Vision","repositoryPathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"12.1.0","versionKey":"pypi:pillow@12.1.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"047f47304acd18a48770c101f5a8383cd19bb134","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/ressource-efficient-computer-vision/-/blob/9aa07461b879a6161b7e901ea4c2a382b8f1b4ae/uv.lock","commitSha":"9aa07461b879a6161b7e901ea4c2a382b8f1b4ae"},{"id":"component:174eb6fbcd61b0b04c7ee45f","repositoryId":"opencode:7811","repositorySlug":"opencode-7811","repositoryName":"Retrieval Evaluation","repositoryPathWithNamespace":"uba-ki-lab/retrieval-evaluation","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"10.4.0","versionKey":"pypi:pillow@10.4.0","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"20c0181bf785c3e980512ba2de16e0fe3f207bad","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/retrieval-evaluation/-/blob/f64bf528432908908d92b8263d6933301033bb7f/uv.lock","commitSha":"f64bf528432908908d92b8263d6933301033bb7f"},{"id":"component:de2a3fd2792cea24a965a711","repositoryId":"opencode:10162","repositorySlug":"opencode-10162","repositoryName":"SmartPlanAI Anwendung","repositoryPathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.3.0","versionKey":"pypi:pillow@11.3.0","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock","blobSha":"40fa29ec0b8e6e3bfbf4c2ff77526dd4038e0299","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung/-/blob/1d70807d48a8fae19711b10422c3417ab5d05d0f/blp_streamlit_pipeline/src/ext/streamlit-draw-image-mask/poetry.lock","commitSha":"1d70807d48a8fae19711b10422c3417ab5d05d0f"},{"id":"component:6138d0a8b64aabbbf4155a96","repositoryId":"opencode:10162","repositorySlug":"opencode-10162","repositoryName":"SmartPlanAI Anwendung","repositoryPathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"12.1.1","versionKey":"pypi:pillow@12.1.1","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"6b17710ca48cf83827a909c320d60853c75d7960","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung/-/blob/1d70807d48a8fae19711b10422c3417ab5d05d0f/poetry.lock","commitSha":"1d70807d48a8fae19711b10422c3417ab5d05d0f"},{"id":"component:4cb25e4ae283d8515cc3968e","repositoryId":"opencode:5142","repositorySlug":"opencode-5142","repositoryName":"strahlenexposition","repositoryPathWithNamespace":"uba-ki-lab/strahlenexposition","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.2.1","versionKey":"pypi:pillow@11.2.1","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"681193f56a8b37b97336b2682fc1147ac3bdab1f","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/strahlenexposition/-/blob/1dd9cd8ca823a7998b729adce6957848cf241d54/poetry.lock","commitSha":"1dd9cd8ca823a7998b729adce6957848cf241d54"},{"id":"component:fa2e27569127776d78cbe166","repositoryId":"opencode:5142","repositorySlug":"opencode-5142","repositoryName":"strahlenexposition","repositoryPathWithNamespace":"uba-ki-lab/strahlenexposition","ecosystem":"pypi","name":"pillow","identity":"pypi:pillow","version":"11.2.1","versionKey":"pypi:pillow@11.2.1","direct":null,"development":null,"sourceKind":"sbom-json","filePath":"sbom.json","blobSha":"bce3149701e5462f1af80e9221c0e2967402d606","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/strahlenexposition/-/blob/1dd9cd8ca823a7998b729adce6957848cf241d54/sbom.json","commitSha":"1dd9cd8ca823a7998b729adce6957848cf241d54"}],"occurrenceCount":15},"related":{"repositories":[{"id":"opencode:10162","slug":"opencode-10162","name":"SmartPlanAI Anwendung","pathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/ki-bauleitplaene/smartplanai-anwendung","versions":["11.3.0","12.1.1"],"evidenceCount":2},{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["11.2.1"],"evidenceCount":2},{"id":"opencode:6174","slug":"opencode-6174","name":"Energieautarkes Wohnquartier - Backend","pathWithNamespace":"energieautarkes-wohnquartier/backend","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:3608","slug":"opencode-3608","name":"AI","pathWithNamespace":"iqsh/collaboration-online-board/ai","versions":["10.3.0"],"evidenceCount":1},{"id":"opencode:7674","slug":"opencode-7674","name":"Coding Agent Usage Simulation","pathWithNamespace":"uba-ki-lab/coding-agent-usage-simulation","versions":["12.0.0"],"evidenceCount":1},{"id":"opencode:9998","slug":"opencode-9998","name":"density-maps","pathWithNamespace":"uba-ki-lab/density-maps","versions":["12.1.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["11.3.0"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["11.3.0"],"evidenceCount":1},{"id":"opencode:5012","slug":"opencode-5012","name":"LLM Testframework","pathWithNamespace":"uba-ki-lab/llm-testframework","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:4112","slug":"opencode-4112","name":"Objection management","pathWithNamespace":"uba-ki-lab/objection-management","versions":["11.1.0"],"evidenceCount":1},{"id":"opencode:5201","slug":"opencode-5201","name":"photovoltaic_systems","pathWithNamespace":"uba-ki-lab/photovoltaic_systems","versions":["11.2.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["12.1.0"],"evidenceCount":1},{"id":"opencode:7811","slug":"opencode-7811","name":"Retrieval Evaluation","pathWithNamespace":"uba-ki-lab/retrieval-evaluation","versions":["10.4.0"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-5xmw-vc9v-4wf2","slug":"ghsa-5xmw-vc9v-4wf2-86a8861a","dossier":false,"summary":"Pillow has a heap buffer overflow with nested list coordinates","aliases":["BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"sourceIds":["GHSA-5xmw-vc9v-4wf2","PYSEC-2026-2251"],"published":"2026-05-04T20:18:27Z","modified":"2026-07-13T07:26:28.768890335Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-cfh3-3jmp-rvhc","slug":"ghsa-cfh3-3jmp-rvhc-4e95572c","dossier":false,"summary":"Pillow affected by out-of-bounds write when loading PSD images","aliases":["BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"sourceIds":["GHSA-cfh3-3jmp-rvhc","PYSEC-2026-2249"],"published":"2026-02-11T14:22:50Z","modified":"2026-07-13T07:26:49.514806069Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-25990"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4942"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-pwv6-vv43-88gr","slug":"ghsa-pwv6-vv43-88gr-c5f811d0","dossier":true,"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","aliases":["BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"sourceIds":["GHSA-pwv6-vv43-88gr","PYSEC-2026-2252"],"published":"2026-05-04T20:20:31Z","modified":"2026-07-13T07:26:52.198871129Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-r73j-pqj5-w3x7","slug":"ghsa-r73j-pqj5-w3x7-8d4d543f","dossier":true,"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","aliases":["BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"sourceIds":["GHSA-r73j-pqj5-w3x7","PYSEC-2026-2874"],"published":"2026-05-04T20:19:30Z","modified":"2026-07-13T16:42:37.358429541Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r73j-pqj5-w3x7"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-whj4-6x5x-4v2j","slug":"ghsa-whj4-6x5x-4v2j-eb5fc6a1","dossier":true,"summary":"FITS GZIP decompression bomb in Pillow","aliases":["BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"sourceIds":["GHSA-whj4-6x5x-4v2j","PYSEC-2026-2250"],"published":"2026-04-13T19:22:35Z","modified":"2026-07-13T07:26:24.246094941Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40192"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-wjx4-4jcj-g98j","slug":"ghsa-wjx4-4jcj-g98j-e937161b","dossier":true,"summary":"Pillow has an integer overflow when processing fonts","aliases":["BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"sourceIds":["GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"published":"2026-05-04T20:18:45Z","modified":"2026-06-08T23:45:16.414580348Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-xg8h-j46f-w952","slug":"ghsa-xg8h-j46f-w952-da36a616","dossier":false,"summary":"Pillow vulnerability can cause write buffer overflow on BCn encoding","aliases":["BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61"],"sourceIds":["GHSA-xg8h-j46f-w952","PYSEC-2025-61"],"published":"2025-07-01T17:29:37Z","modified":"2026-02-04T03:49:31.268130Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9041"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/11.3.0"}],"versionKeys":["pypi:pillow@11.2.1"],"packageCount":1,"repositoryCount":4},{"id":"PYSEC-2026-2253","slug":"pysec-2026-2253-e1ccf3df","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-54059","CVE-2026-54059","GHSA-8v84-f9pq-wr9x"],"sourceIds":["PYSEC-2026-2253"],"published":"2026-07-06T19:17:08.127Z","modified":"2026-07-13T07:26:49.281845979Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2254","slug":"pysec-2026-2254-a1ed1fd2","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-54060","CVE-2026-54060","GHSA-5x94-69rx-g8h2"],"sourceIds":["PYSEC-2026-2254"],"published":"2026-07-06T19:17:08.270Z","modified":"2026-07-13T07:26:56.196935469Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2255","slug":"pysec-2026-2255-d0951b98","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55379","CVE-2026-55379","GHSA-45hq-cxwh-f6vc"],"sourceIds":["PYSEC-2026-2255"],"published":"2026-07-06T19:17:08.577Z","modified":"2026-07-13T07:26:26.726353373Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2256","slug":"pysec-2026-2256-0f333f0b","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55380","CVE-2026-55380","GHSA-phj9-mv4w-65pm"],"sourceIds":["PYSEC-2026-2256"],"published":"2026-07-06T19:17:08.703Z","modified":"2026-07-13T07:26:17.085341343Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2257","slug":"pysec-2026-2257-bcbe5d79","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55798","CVE-2026-55798","GHSA-4x4j-2g7c-83w6"],"sourceIds":["PYSEC-2026-2257"],"published":"2026-07-06T19:17:08.830Z","modified":"2026-07-13T07:26:48.229039344Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-3451","slug":"pysec-2026-3451-3e5eac34","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-59199","CVE-2026-59199","GHSA-6r8x-57c9-28j4"],"sourceIds":["PYSEC-2026-3451"],"published":"2026-07-14T16:17:01.937Z","modified":"2026-07-15T20:11:36.266805254Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-3452","slug":"pysec-2026-3452-0999fd2a","dossier":false,"summary":null,"aliases":["BIT-pillow-2026-59203","CVE-2026-59203","GHSA-pg7v-jwj7-p798"],"sourceIds":["PYSEC-2026-3452"],"published":"2026-07-14T16:17:02.063Z","modified":"2026-07-15T20:11:27.953713427Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":4},{"id":"PYSEC-2026-3453","slug":"pysec-2026-3453-83974725","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-59205","CVE-2026-59205","GHSA-9hw9-ch79-4vh6"],"sourceIds":["PYSEC-2026-3453"],"published":"2026-07-14T16:17:02.370Z","modified":"2026-07-15T20:11:15.582336837Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13}]}}