{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T15:03:09.339Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T15:01:18.334Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"paket","entity":{"id":"package:pypi:werkzeug","slug":"werkzeug-b18d5b02","identity":"pypi:werkzeug","ecosystem":"pypi","name":"werkzeug","label":"werkzeug","category":null,"aiRelevant":false,"provider":null,"repositoryCount":6,"occurrenceCount":7,"directRepositoryCount":0,"versionCount":5,"licenseExpressions":["BSD-3-Clause","non-standard"],"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-2g68-c3qc-8985","GHSA-87hc-h4r5-73f7","GHSA-f9vj-2wh5-fj8j","GHSA-hgf8-39gv-g3f2","GHSA-q34m-jh98-gwm2"],"advisoryCount":6,"verifiedAttestation":true,"repositories":[{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["3.0.6"],"evidenceCount":2},{"id":"opencode:6174","slug":"opencode-6174","name":"Energieautarkes Wohnquartier - Backend","pathWithNamespace":"energieautarkes-wohnquartier/backend","versions":["3.1.3"],"evidenceCount":1},{"id":"opencode:3608","slug":"opencode-3608","name":"AI","pathWithNamespace":"iqsh/collaboration-online-board/ai","versions":["3.0.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["3.1.3"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["3.1.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["3.1.5"],"evidenceCount":1}],"versions":[{"version":"3.0.1","repositoryCount":1,"occurrenceCount":1,"ageDays":999,"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-2g68-c3qc-8985","GHSA-87hc-h4r5-73f7","GHSA-f9vj-2wh5-fj8j","GHSA-hgf8-39gv-g3f2","GHSA-q34m-jh98-gwm2"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2023-10-24T20:57:47Z","deprecated":false,"deprecatedReason":null,"licenses":["non-standard"],"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-2g68-c3qc-8985","GHSA-87hc-h4r5-73f7","GHSA-f9vj-2wh5-fj8j","GHSA-hgf8-39gv-g3f2","GHSA-q34m-jh98-gwm2","PYSEC-2026-2043","PYSEC-2026-2044","PYSEC-2026-2045","PYSEC-2026-2046","PYSEC-2026-2320","PYSEC-2026-3417"],"links":[{"label":"DOCUMENTATION","url":"https://werkzeug.palletsprojects.com/"},{"label":"ISSUE_TRACKER","url":"https://github.com/pallets/werkzeug/issues/"},{"label":"SOURCE_REPO","url":"https://github.com/pallets/werkzeug"}],"relatedProjects":[{"id":"github.com/pallets/werkzeug","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"3.0.6","repositoryCount":1,"occurrenceCount":2,"ageDays":632,"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-10-25T18:52:30Z","deprecated":false,"deprecatedReason":null,"licenses":["non-standard"],"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2","PYSEC-2026-2044","PYSEC-2026-2046","PYSEC-2026-2320"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/pallets/werkzeug"},{"label":"DOCUMENTATION","url":"https://werkzeug.palletsprojects.com/"},{"label":"ISSUE_TRACKER","url":"https://github.com/pallets/werkzeug/issues/"}],"relatedProjects":[{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/pallets/werkzeug","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"3.1.1","repositoryCount":1,"occurrenceCount":1,"ageDays":625,"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-11-01T16:40:43Z","deprecated":false,"deprecatedReason":null,"licenses":["non-standard"],"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2","PYSEC-2026-2044","PYSEC-2026-2046","PYSEC-2026-2320"],"links":[{"label":"DOCUMENTATION","url":"https://werkzeug.palletsprojects.com/"},{"label":"ISSUE_TRACKER","url":"https://github.com/pallets/werkzeug/issues/"},{"label":"SOURCE_REPO","url":"https://github.com/pallets/werkzeug"}],"relatedProjects":[{"id":"github.com/pallets/werkzeug","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"3.1.3","repositoryCount":2,"occurrenceCount":2,"ageDays":618,"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2024-11-08T15:52:16Z","deprecated":false,"deprecatedReason":null,"licenses":["non-standard"],"advisoryIds":["GHSA-29vq-49wr-vm6x","GHSA-87hc-h4r5-73f7","GHSA-hgf8-39gv-g3f2","PYSEC-2026-2044","PYSEC-2026-2046","PYSEC-2026-2320"],"links":[{"label":"SOURCE_REPO","url":"https://github.com/pallets/werkzeug"},{"label":"DOCUMENTATION","url":"https://werkzeug.palletsprojects.com/"},{"label":"ISSUE_TRACKER","url":"https://github.com/pallets/werkzeug/issues/"}],"relatedProjects":[{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/pallets/werkzeug","relationType":"ISSUE_TRACKER","relationProvenance":"UNVERIFIED_METADATA"}],"attestations":[],"verifiedAttestation":false,"projectStatus":"active"}},{"version":"3.1.5","repositoryCount":1,"occurrenceCount":1,"ageDays":192,"advisoryIds":["GHSA-29vq-49wr-vm6x"],"metadata":{"state":"resolved","checkedAt":"2026-07-20T03:19:50.101Z","publishedAt":"2026-01-08T17:49:21Z","deprecated":false,"deprecatedReason":null,"licenses":["BSD-3-Clause"],"advisoryIds":["GHSA-29vq-49wr-vm6x","PYSEC-2026-2320"],"links":[{"label":"DOCUMENTATION","url":"https://werkzeug.palletsprojects.com/"},{"label":"SOURCE_REPO","url":"https://github.com/pallets/werkzeug"},{"label":"ATTESTATION","url":"https://pypi.org/integrity/werkzeug/3.1.5/werkzeug-3.1.5-py3-none-any.whl/provenance"}],"relatedProjects":[{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"UNVERIFIED_METADATA"},{"id":"github.com/pallets/werkzeug","relationType":"SOURCE_REPO","relationProvenance":"PYPI_PUBLISH_ATTESTATION"}],"attestations":[{"type":"https://docs.pypi.org/attestations/publish/v1","url":"https://pypi.org/integrity/werkzeug/3.1.5/werkzeug-3.1.5-py3-none-any.whl/provenance","verified":true,"sourceRepository":"https://github.com/pallets/werkzeug","commit":"e3d06f4b1f7ff40a63eba78f81d9cda18f805d6d"}],"verifiedAttestation":true,"projectStatus":"active"}}]},"evidence":{"occurrences":[{"id":"component:74dfd5b7e6a081846a3f6a96","repositoryId":"opencode:3608","repositorySlug":"opencode-3608","repositoryName":"AI","repositoryPathWithNamespace":"iqsh/collaboration-online-board/ai","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.0.1","versionKey":"pypi:werkzeug@3.0.1","direct":null,"development":null,"sourceKind":"spdx-yaml","filePath":"SPDX_v2.0.0.yml","blobSha":"e9e46566a2217346214d08f9dede99d8821b3c68","sourceUrl":"https://gitlab.opencode.de/iqsh/collaboration-online-board/ai/-/blob/7cc4cbe5064bc5ede2426caf6981c5e9d0509327/SPDX_v2.0.0.yml","commitSha":"7cc4cbe5064bc5ede2426caf6981c5e9d0509327"},{"id":"component:110aaaf56f4c012d2b60f7e5","repositoryId":"opencode:6174","repositorySlug":"opencode-6174","repositoryName":"Energieautarkes Wohnquartier - Backend","repositoryPathWithNamespace":"energieautarkes-wohnquartier/backend","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.1.3","versionKey":"pypi:werkzeug@3.1.3","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"dc5008ef9fba69d70ea9e7b3fea21265fa5ef93d","sourceUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend/-/blob/fc7e24cd546449ac9fdee4ad78aab861e0c89666/poetry.lock","commitSha":"fc7e24cd546449ac9fdee4ad78aab861e0c89666"},{"id":"component:4aaedb0bfd22f64db3ba18d5","repositoryId":"opencode:5530","repositorySlug":"opencode-5530","repositoryName":"GSA Extraction","repositoryPathWithNamespace":"uba-ki-lab/gsa-extraction","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.1.3","versionKey":"pypi:werkzeug@3.1.3","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"fbb23733e647554b5678500b3f17f13bac7f77f5","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/gsa-extraction/-/blob/f5161e79d3f8c53877f9b1b0d72e1c10bff775ba/uv.lock","commitSha":"f5161e79d3f8c53877f9b1b0d72e1c10bff775ba"},{"id":"component:9d0a8b1e0cb5d55e8efbaa90","repositoryId":"opencode:10787","repositorySlug":"opencode-10787","repositoryName":"LLM Questionnaire Benchmarking Framework","repositoryPathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.1.1","versionKey":"pypi:werkzeug@3.1.1","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"1b55661fee93d4733461df8e9c2b491b9205aac2","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/llm-questionnaire-benchmarking-framework/-/blob/4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd/uv.lock","commitSha":"4e12ee9f3b0b6fdc77fe21cb89e6cfac17dc6ebd"},{"id":"component:d8521493e43cf52a365c8bbd","repositoryId":"opencode:10775","repositorySlug":"opencode-10775","repositoryName":"Ressource Efficient Computer Vision","repositoryPathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.1.5","versionKey":"pypi:werkzeug@3.1.5","direct":null,"development":null,"sourceKind":"uv-lock","filePath":"uv.lock","blobSha":"047f47304acd18a48770c101f5a8383cd19bb134","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/ressource-efficient-computer-vision/-/blob/9aa07461b879a6161b7e901ea4c2a382b8f1b4ae/uv.lock","commitSha":"9aa07461b879a6161b7e901ea4c2a382b8f1b4ae"},{"id":"component:d99062269858c8d6603cb844","repositoryId":"opencode:5142","repositorySlug":"opencode-5142","repositoryName":"strahlenexposition","repositoryPathWithNamespace":"uba-ki-lab/strahlenexposition","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.0.6","versionKey":"pypi:werkzeug@3.0.6","direct":null,"development":false,"sourceKind":"poetry-lock","filePath":"poetry.lock","blobSha":"681193f56a8b37b97336b2682fc1147ac3bdab1f","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/strahlenexposition/-/blob/1dd9cd8ca823a7998b729adce6957848cf241d54/poetry.lock","commitSha":"1dd9cd8ca823a7998b729adce6957848cf241d54"},{"id":"component:fc8b3a143a06269abdcfbba6","repositoryId":"opencode:5142","repositorySlug":"opencode-5142","repositoryName":"strahlenexposition","repositoryPathWithNamespace":"uba-ki-lab/strahlenexposition","ecosystem":"pypi","name":"werkzeug","identity":"pypi:werkzeug","version":"3.0.6","versionKey":"pypi:werkzeug@3.0.6","direct":null,"development":null,"sourceKind":"sbom-json","filePath":"sbom.json","blobSha":"bce3149701e5462f1af80e9221c0e2967402d606","sourceUrl":"https://gitlab.opencode.de/uba-ki-lab/strahlenexposition/-/blob/1dd9cd8ca823a7998b729adce6957848cf241d54/sbom.json","commitSha":"1dd9cd8ca823a7998b729adce6957848cf241d54"}],"occurrenceCount":7},"related":{"repositories":[{"id":"opencode:5142","slug":"opencode-5142","name":"strahlenexposition","pathWithNamespace":"uba-ki-lab/strahlenexposition","versions":["3.0.6"],"evidenceCount":2},{"id":"opencode:6174","slug":"opencode-6174","name":"Energieautarkes Wohnquartier - Backend","pathWithNamespace":"energieautarkes-wohnquartier/backend","versions":["3.1.3"],"evidenceCount":1},{"id":"opencode:3608","slug":"opencode-3608","name":"AI","pathWithNamespace":"iqsh/collaboration-online-board/ai","versions":["3.0.1"],"evidenceCount":1},{"id":"opencode:5530","slug":"opencode-5530","name":"GSA Extraction","pathWithNamespace":"uba-ki-lab/gsa-extraction","versions":["3.1.3"],"evidenceCount":1},{"id":"opencode:10787","slug":"opencode-10787","name":"LLM Questionnaire Benchmarking Framework","pathWithNamespace":"uba-ki-lab/llm-questionnaire-benchmarking-framework","versions":["3.1.1"],"evidenceCount":1},{"id":"opencode:10775","slug":"opencode-10775","name":"Ressource Efficient Computer Vision","pathWithNamespace":"uba-ki-lab/ressource-efficient-computer-vision","versions":["3.1.5"],"evidenceCount":1}],"vulnerabilities":[{"id":"GHSA-29vq-49wr-vm6x","slug":"ghsa-29vq-49wr-vm6x-7d88633b","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2026-27199","PYSEC-2026-2320"],"sourceIds":["GHSA-29vq-49wr-vm6x","PYSEC-2026-2320"],"published":"2026-02-19T20:32:45Z","modified":"2026-07-13T07:26:55.904978535Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27199"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.6"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3","pypi:werkzeug@3.1.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2g68-c3qc-8985","slug":"ghsa-2g68-c3qc-8985-d6075eca","dossier":false,"summary":"Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain","aliases":["CVE-2024-34069","PYSEC-2026-2043"],"sourceIds":["GHSA-2g68-c3qc-8985","PYSEC-2026-2043"],"published":"2024-05-06T14:21:27Z","modified":"2026-07-07T17:56:15.006571356Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34069"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240614-0004"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g68-c3qc-8985"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-87hc-h4r5-73f7","slug":"ghsa-87hc-h4r5-73f7-c5117ca2","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names with compound extensions","aliases":["CVE-2026-21860","PYSEC-2026-2044"],"sourceIds":["GHSA-87hc-h4r5-73f7","PYSEC-2026-2044"],"published":"2026-01-08T19:51:21Z","modified":"2026-07-07T17:56:19.044748151Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21860"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-87hc-h4r5-73f7"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-f9vj-2wh5-fj8j","slug":"ghsa-f9vj-2wh5-fj8j-f0f29e2a","dossier":false,"summary":"Werkzeug safe_join not safe on Windows","aliases":["CVE-2024-49766","PYSEC-2026-2045"],"sourceIds":["GHSA-f9vj-2wh5-fj8j","PYSEC-2026-2045"],"published":"2024-10-25T19:43:41Z","modified":"2026-07-07T17:56:25.762524663Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49766"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250131-0005"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f9vj-2wh5-fj8j"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hgf8-39gv-g3f2","slug":"ghsa-hgf8-39gv-g3f2-0469b394","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2025-66221","PYSEC-2026-2046"],"sourceIds":["GHSA-hgf8-39gv-g3f2","PYSEC-2026-2046"],"published":"2025-12-02T00:27:38Z","modified":"2026-07-07T17:57:36.044527736Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66221"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.4"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hgf8-39gv-g3f2"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-q34m-jh98-gwm2","slug":"ghsa-q34m-jh98-gwm2-76f8ef0b","dossier":false,"summary":"Werkzeug possible resource exhaustion when parsing file data in forms","aliases":["CVE-2024-49767","PYSEC-2026-1860","PYSEC-2026-3417"],"sourceIds":["GHSA-q34m-jh98-gwm2","PYSEC-2026-3417"],"published":"2024-10-25T19:44:43Z","modified":"2026-07-13T16:43:34.482065524Z","checkedAt":"2026-07-20T15:03:09.339Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49767"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250103-0007"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q34m-jh98-gwm2"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1}]}}