{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-09-16T04:45:26.395Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-09-16T04:44:00.147Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":43,"completeTreeCount":42,"incompleteTreeCount":1,"lockfileRepositoryCount":23,"sbomRepositoryCount":4,"artifactRepositoryCount":26,"resolvedRepositoryCount":40,"resolvedArtifactRepositoryCount":26,"dependencyFileCount":37,"parsedFileCount":36,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4116,"metadataResolvedCount":4105,"metadataNotFoundCount":11,"osvEvaluatedVersionCount":4116,"codeRadarRepositoryCount":43},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":8000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":43,"packageCount":2457,"aiPackageCount":50,"resolvedComponentCount":7121,"resolvedVersionCount":4116,"providerExposureRepositoryCount":9,"licenseExpressionCount":55,"knownLicensePackageCount":2423,"unknownLicensePackageCount":34,"advisoryCount":795,"matchedAdvisoryRepositoryCount":37,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":23,"repositoryShare":0.5348837209302325}},"kind":"repository","entity":{"id":"opencode:11298","slug":"opencode-11298","gitlabProjectId":11298,"name":"URBAN.KI Sovia","pathWithNamespace":"vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-sovia","description":null,"webUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-sovia","commitSha":"b961d043e77a4561b9f77c65c6818627c1f34c22","commitUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-sovia/-/commit/b961d043e77a4561b9f77c65c6818627c1f34c22","lastActivityAt":"2026-09-15T13:10:29.040Z","headCommittedAt":"2026-09-14T08:20:12.000Z","tree":{"complete":true,"entryCount":70,"truncated":false},"files":[{"path":"uv.lock","kind":"uv-lock","blobSha":"ddc57ad0a634363d7ebefcbde0786b734f6f5f81","sourceUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-sovia/-/blob/b961d043e77a4561b9f77c65c6818627c1f34c22/uv.lock","commitSha":"b961d043e77a4561b9f77c65c6818627c1f34c22","contentSha256":"d444dfad7ad27a1821923a1fc11b3ae40b7e686a1c28dd4b750c45fa1cfa35b8","byteCount":270188,"state":"parsed","componentCount":111}],"resolvedComponentCount":111,"artifactResolvedComponentCount":111,"exactManifestPinCount":0,"packageCount":111,"ecosystems":["pypi"],"aiPackageCount":6,"licenseExpressionCount":15,"unknownLicensePackageCount":1,"advisoryIds":["GHSA-248v-346w-9cwc","GHSA-284h-m62q-gf8w","GHSA-29pf-2h5f-8g72","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-45hq-cxwh-f6vc","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-59p9-h35m-wg4g","GHSA-5rjg-fvgr-3xxf","GHSA-5x94-69rx-g8h2","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-6497-prx7-gpmq","GHSA-65pc-fj4g-8rjx","GHSA-69w3-r845-3855","GHSA-6p8h-3wgx-97gf","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-7545-fcxq-7j24","GHSA-768j-98cg-p3fv","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7p48-42j8-8846","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8mcc-hrx5-hvxc","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9wx4-h78v-vm56","GHSA-c678-jfcj-6jmf","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-cpwx-vrp4-4pq7","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f4hp-rmr7-r7v8","GHSA-fgcw-684q-jj6r","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fpwr-67px-3qhx","GHSA-g7vv-2v7x-gj9p","GHSA-gc5v-m9x4-r6x2","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-hxxf-235m-72v3","GHSA-jhmp-mqwm-3gq8","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jm78-9fvv-mhgr","GHSA-jw8x-6495-233v","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mv93-w799-cj2w","GHSA-p538-c434-8v24","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rcv9-qm8p-9p6j","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v87r-6q3f-2j67","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqwp-45wm-r9r5","GHSA-w853-jp5j-5j7f","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wrfc-pvp9-mr9g","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-xg8h-j46f-w952","GHSA-xj96-63gp-2gmr","GHSA-xrqw-3rrv-vx5w","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139","PYSEC-2026-2132","PYSEC-2026-2286"],"advisoryCount":142,"providers":[]},"evidence":{"files":[{"path":"uv.lock","kind":"uv-lock","blobSha":"ddc57ad0a634363d7ebefcbde0786b734f6f5f81","sourceUrl":"https://gitlab.opencode.de/vernetzte-stadt-gelsenkirchen/urban.ki/urban-ki-sovia/-/blob/b961d043e77a4561b9f77c65c6818627c1f34c22/uv.lock","commitSha":"b961d043e77a4561b9f77c65c6818627c1f34c22","contentSha256":"d444dfad7ad27a1821923a1fc11b3ae40b7e686a1c28dd4b750c45fa1cfa35b8","byteCount":270188,"state":"parsed","componentCount":111}],"occurrenceCount":111},"related":{"packages":[{"id":"package:pypi:transformers","slug":"transformers-65289303","identity":"pypi:transformers","label":"Transformers","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"advisoryCount":26,"licenseExpressions":["Apache-2.0"],"versions":["4.51.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torch","slug":"torch-47a5352a","identity":"pypi:torch","label":"PyTorch","aiRelevant":true,"provider":null,"advisoryCount":23,"licenseExpressions":["BSD-3-Clause"],"versions":["2.9.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:scikit-learn","slug":"scikit-learn-ab0941d9","identity":"pypi:scikit-learn","label":"scikit-learn","aiRelevant":true,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["1.6.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sentence-transformers","slug":"sentence-transformers-3f3d7a36","identity":"pypi:sentence-transformers","label":"Sentence Transformers","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["4.0.2"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tokenizers","slug":"tokenizers-7ba00902","identity":"pypi:tokenizers","label":"Hugging Face Tokenizers","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.21.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opencv-python","slug":"opencv-python-bfa06e24","identity":"pypi:opencv-python","label":"OpenCV","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["4.11.0.86"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:gitpython","slug":"gitpython-dcd13009","identity":"pypi:gitpython","label":"gitpython","aiRelevant":false,"provider":null,"advisoryCount":27,"licenseExpressions":["BSD-3-Clause"],"versions":["3.1.45"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pillow","slug":"pillow-834347dd","identity":"pypi:pillow","label":"pillow","aiRelevant":false,"provider":null,"advisoryCount":20,"licenseExpressions":["HPND","MIT-CMU"],"versions":["11.1.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tornado","slug":"tornado-ab0f364e","identity":"pypi:tornado","label":"tornado","aiRelevant":false,"provider":null,"advisoryCount":13,"licenseExpressions":["Apache-2.0"],"versions":["6.5.2"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:urllib3","slug":"urllib3-fa68f32c","identity":"pypi:urllib3","label":"urllib3","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["MIT"],"versions":["2.3.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jinja2","slug":"jinja2-f7d34747","identity":"pypi:jinja2","label":"jinja2","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.6"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:requests","slug":"requests-53653f76","identity":"pypi:requests","label":"requests","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["Apache-2.0"],"versions":["2.32.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:setuptools","slug":"setuptools-fe37c31a","identity":"pypi:setuptools","label":"setuptools","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["78.1.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:filelock","slug":"filelock-b1c63968","identity":"pypi:filelock","label":"filelock","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT","Unlicense"],"versions":["3.18.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:protobuf","slug":"protobuf-6e30009a","identity":"pypi:protobuf","label":"protobuf","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["BSD-3-Clause"],"versions":["6.32.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:streamlit","slug":"streamlit-b61aa01e","identity":"pypi:streamlit","label":"streamlit","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["Apache-2.0"],"versions":["1.49.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:certifi","slug":"certifi-d4f0c37e","identity":"pypi:certifi","label":"certifi","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MPL-2.0"],"versions":["2025.1.31"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:click","slug":"click-ef97f731","identity":"pypi:click","label":"click","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["8.2.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:duckdb","slug":"duckdb-8c0332c9","identity":"pypi:duckdb","label":"duckdb","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["1.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:fonttools","slug":"fonttools-d2488ea8","identity":"pypi:fonttools","label":"fonttools","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.55.8"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:geopandas","slug":"geopandas-968b51b0","identity":"pypi:geopandas","label":"geopandas","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:idna","slug":"idna-994c9929","identity":"pypi:idna","label":"idna","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.10"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyarrow","slug":"pyarrow-facb8516","identity":"pypi:pyarrow","label":"pyarrow","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["21.0.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pygments","slug":"pygments-ad71bc11","identity":"pypi:pygments","label":"pygments","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-2-Clause"],"versions":["2.19.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tqdm","slug":"tqdm-04b01f90","identity":"pypi:tqdm","label":"tqdm","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT AND MPL-2.0"],"versions":["4.67.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:altair","slug":"altair-01b7f976","identity":"pypi:altair","label":"altair","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["5.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:asttokens","slug":"asttokens-c349c5f9","identity":"pypi:asttokens","label":"asttokens","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:attrs","slug":"attrs-2e7954ac","identity":"pypi:attrs","label":"attrs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["25.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:blinker","slug":"blinker-409e1445","identity":"pypi:blinker","label":"blinker","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:branca","slug":"branca-e1a3550c","identity":"pypi:branca","label":"branca","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cachetools","slug":"cachetools-84fe6563","identity":"pypi:cachetools","label":"cachetools","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:charset-normalizer","slug":"charset-normalizer-74ccb20a","identity":"pypi:charset-normalizer","label":"charset-normalizer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:colorama","slug":"colorama-abaf57c3","identity":"pypi:colorama","label":"colorama","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.4.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:contourpy","slug":"contourpy-f86f9e10","identity":"pypi:contourpy","label":"contourpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cycler","slug":"cycler-3e14883d","identity":"pypi:cycler","label":"cycler","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.12.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:decorator","slug":"decorator-500c1fb8","identity":"pypi:decorator","label":"decorator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","non-standard"],"versions":["5.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:executing","slug":"executing-36845a5b","identity":"pypi:executing","label":"executing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:folium","slug":"folium-6e89a148","identity":"pypi:folium","label":"folium","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.20.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:fsspec","slug":"fsspec-b1a7c311","identity":"pypi:fsspec","label":"fsspec","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["2025.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ftfy","slug":"ftfy-b3100e16","identity":"pypi:ftfy","label":"ftfy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["6.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:gitdb","slug":"gitdb-dac4580b","identity":"pypi:gitdb","label":"gitdb","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["4.0.12"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:huggingface-hub","slug":"huggingface-hub-443ec6ef","identity":"pypi:huggingface-hub","label":"huggingface-hub","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["0.30.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ipython","slug":"ipython-7a140323","identity":"pypi:ipython","label":"ipython","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["9.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ipython-pygments-lexers","slug":"ipython-pygments-lexers-6216051e","identity":"pypi:ipython-pygments-lexers","label":"ipython-pygments-lexers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jedi","slug":"jedi-9eb0c211","identity":"pypi:jedi","label":"jedi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.19.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:joblib","slug":"joblib-8cbb7872","identity":"pypi:joblib","label":"joblib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jsonschema","slug":"jsonschema-df23f5cd","identity":"pypi:jsonschema","label":"jsonschema","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.25.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jsonschema-specifications","slug":"jsonschema-specifications-5d87863a","identity":"pypi:jsonschema-specifications","label":"jsonschema-specifications","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2025.9.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:kiwisolver","slug":"kiwisolver-41b47c33","identity":"pypi:kiwisolver","label":"kiwisolver","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.4.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:markupsafe","slug":"markupsafe-1bdd4c7f","identity":"pypi:markupsafe","label":"markupsafe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:matplotlib","slug":"matplotlib-9dc72309","identity":"pypi:matplotlib","label":"matplotlib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["3.10.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:matplotlib-inline","slug":"matplotlib-inline-50f95e0d","identity":"pypi:matplotlib-inline","label":"matplotlib-inline","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["0.1.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mpmath","slug":"mpmath-4ccb7a41","identity":"pypi:mpmath","label":"mpmath","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:narwhals","slug":"narwhals-24e2f721","identity":"pypi:narwhals","label":"narwhals","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","non-standard"],"versions":["2.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:networkx","slug":"networkx-c2336a8d","identity":"pypi:networkx","label":"networkx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:numpy","slug":"numpy-ba79b98d","identity":"pypi:numpy","label":"numpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib","non-standard"],"versions":["2.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cublas-cu12","slug":"nvidia-cublas-cu12-1d052261","identity":"pypi:nvidia-cublas-cu12","label":"nvidia-cublas-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.3.14"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-cupti-cu12","slug":"nvidia-cuda-cupti-cu12-973480f1","identity":"pypi:nvidia-cuda-cupti-cu12","label":"nvidia-cuda-cupti-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.57"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-nvrtc-cu12","slug":"nvidia-cuda-nvrtc-cu12-e32b7f38","identity":"pypi:nvidia-cuda-nvrtc-cu12","label":"nvidia-cuda-nvrtc-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.61"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-runtime-cu12","slug":"nvidia-cuda-runtime-cu12-2b875d2a","identity":"pypi:nvidia-cuda-runtime-cu12","label":"nvidia-cuda-runtime-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.57"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cudnn-cu12","slug":"nvidia-cudnn-cu12-a21dce6d","identity":"pypi:nvidia-cudnn-cu12","label":"nvidia-cudnn-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["9.7.1.26"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cufft-cu12","slug":"nvidia-cufft-cu12-21ff54dd","identity":"pypi:nvidia-cufft-cu12","label":"nvidia-cufft-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.3.3.41"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cufile-cu12","slug":"nvidia-cufile-cu12-14048140","identity":"pypi:nvidia-cufile-cu12","label":"nvidia-cufile-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.13.0.11"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-curand-cu12","slug":"nvidia-curand-cu12-2fed778b","identity":"pypi:nvidia-curand-cu12","label":"nvidia-curand-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["10.3.9.55"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusolver-cu12","slug":"nvidia-cusolver-cu12-7db0a33a","identity":"pypi:nvidia-cusolver-cu12","label":"nvidia-cusolver-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.7.2.55"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusparse-cu12","slug":"nvidia-cusparse-cu12-d7e6a309","identity":"pypi:nvidia-cusparse-cu12","label":"nvidia-cusparse-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.7.53"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusparselt-cu12","slug":"nvidia-cusparselt-cu12-97587f50","identity":"pypi:nvidia-cusparselt-cu12","label":"nvidia-cusparselt-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.6.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nccl-cu12","slug":"nvidia-nccl-cu12-90361558","identity":"pypi:nvidia-nccl-cu12","label":"nvidia-nccl-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["2.26.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nvjitlink-cu12","slug":"nvidia-nvjitlink-cu12-6d08af75","identity":"pypi:nvidia-nvjitlink-cu12","label":"nvidia-nvjitlink-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.61"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nvtx-cu12","slug":"nvidia-nvtx-cu12-9a2d0378","identity":"pypi:nvidia-nvtx-cu12","label":"nvidia-nvtx-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["12.8.55"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:open-clip-torch","slug":"open-clip-torch-1f82ec28","identity":"pypi:open-clip-torch","label":"open-clip-torch","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.32.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:packaging","slug":"packaging-78ee1f47","identity":"pypi:packaging","label":"packaging","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 OR BSD-2-Clause","non-standard"],"versions":["24.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pandas","slug":"pandas-e8d52445","identity":"pypi:pandas","label":"pandas","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.2.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pandas-stubs","slug":"pandas-stubs-b4eaabf3","identity":"pypi:pandas-stubs","label":"pandas-stubs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2.3.2.250827"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:parso","slug":"parso-fa59fdde","identity":"pypi:parso","label":"parso","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pexpect","slug":"pexpect-9ad65a0c","identity":"pypi:pexpect","label":"pexpect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["4.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:prompt-toolkit","slug":"prompt-toolkit-e6f4118a","identity":"pypi:prompt-toolkit","label":"prompt-toolkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.0.51"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ptyprocess","slug":"ptyprocess-ec2650c7","identity":"pypi:ptyprocess","label":"ptyprocess","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["0.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pure-eval","slug":"pure-eval-24d2bc1c","identity":"pypi:pure-eval","label":"pure-eval","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pydeck","slug":"pydeck-75380c92","identity":"pypi:pydeck","label":"pydeck","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.9.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyogrio","slug":"pyogrio-ff34272a","identity":"pypi:pyogrio","label":"pyogrio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.10.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyparsing","slug":"pyparsing-a28b9b62","identity":"pypi:pyparsing","label":"pyparsing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyproj","slug":"pyproj-cd69d38f","identity":"pypi:pyproj","label":"pyproj","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-dateutil","slug":"python-dateutil-8eac96b7","identity":"pypi:python-dateutil","label":"python-dateutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.9.0.post0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytz","slug":"pytz-cbf1d95c","identity":"pypi:pytz","label":"pytz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2025.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyyaml","slug":"pyyaml-16000901","identity":"pypi:pyyaml","label":"pyyaml","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:referencing","slug":"referencing-b8d98ce1","identity":"pypi:referencing","label":"referencing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.36.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:regex","slug":"regex-5e8be65e","identity":"pypi:regex","label":"regex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 AND CNRI-Python","non-standard"],"versions":["2024.11.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:rpds-py","slug":"rpds-py-67c64be8","identity":"pypi:rpds-py","label":"rpds-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.27.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:safetensors","slug":"safetensors-2a32c77a","identity":"pypi:safetensors","label":"safetensors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.5.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:scipy","slug":"scipy-215f884d","identity":"pypi:scipy","label":"scipy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.15.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:seaborn","slug":"seaborn-1018de9a","identity":"pypi:seaborn","label":"seaborn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.13.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:shapely","slug":"shapely-1cd2f2ba","identity":"pypi:shapely","label":"shapely","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2.0.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:six","slug":"six-3c3888bd","identity":"pypi:six","label":"six","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.17.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:smmap","slug":"smmap-943fc5aa","identity":"pypi:smmap","label":"smmap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["5.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:stack-data","slug":"stack-data-d640fe0e","identity":"pypi:stack-data","label":"stack-data","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.6.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:streamlit-folium","slug":"streamlit-folium-e76fb4ea","identity":"pypi:streamlit-folium","label":"streamlit-folium","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["0.25.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sympy","slug":"sympy-b30cb89e","identity":"pypi:sympy","label":"sympy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.14.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tenacity","slug":"tenacity-415454f8","identity":"pypi:tenacity","label":"tenacity","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["9.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:threadpoolctl","slug":"threadpoolctl-e94f6300","identity":"pypi:threadpoolctl","label":"threadpoolctl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:timm","slug":"timm-4594fb75","identity":"pypi:timm","label":"timm","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.0.15"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:toml","slug":"toml-490ac3c8","identity":"pypi:toml","label":"toml","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.10.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torchvision","slug":"torchvision-7f85cafa","identity":"pypi:torchvision","label":"torchvision","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.24.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:traitlets","slug":"traitlets-52bd6ddb","identity":"pypi:traitlets","label":"traitlets","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["5.14.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:triton","slug":"triton-601ea838","identity":"pypi:triton","label":"triton","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:types-pytz","slug":"types-pytz-327ed57f","identity":"pypi:types-pytz","label":"types-pytz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2025.2.0.20250809"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","identity":"pypi:typing-extensions","label":"typing-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0","non-standard"],"versions":["4.13.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tzdata","slug":"tzdata-f80b3bb7","identity":"pypi:tzdata","label":"tzdata","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2025.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:watchdog","slug":"watchdog-55ddb444","identity":"pypi:watchdog","label":"watchdog","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["6.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:wcwidth","slug":"wcwidth-038a8957","identity":"pypi:wcwidth","label":"wcwidth","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.13"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:xyzservices","slug":"xyzservices-a1955a18","identity":"pypi:xyzservices","label":"xyzservices","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2025.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]}],"vulnerabilities":[{"id":"GHSA-248v-346w-9cwc","slug":"ghsa-248v-346w-9cwc-8a7dbdf1","dossier":false,"summary":"Certifi removes GLOBALTRUST root certificate","aliases":["CVE-2024-39689","PYSEC-2024-230"],"sourceIds":["GHSA-248v-346w-9cwc","PYSEC-2024-230"],"published":"2024-07-05T19:15:10Z","modified":"2026-09-10T03:50:15.994602411Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39689"},{"type":"FIX","url":"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"},{"type":"ARTICLE","url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241206-0001"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241206-0001/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-248v-346w-9cwc"}],"versionKeys":["pypi:certifi@2024.6.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-284h-m62q-gf8w","slug":"ghsa-284h-m62q-gf8w-da9acb0c","dossier":false,"summary":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","aliases":["CVE-2026-78676","PYSEC-2026-3786"],"sourceIds":["GHSA-284h-m62q-gf8w","PYSEC-2026-3786"],"published":"2026-08-25T02:16:52.030Z","modified":"2026-09-08T19:00:06.885837775Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-29pf-2h5f-8g72","slug":"ghsa-29pf-2h5f-8g72-1d83ebb4","dossier":false,"summary":"HuggingFace transformers vulnerable to remote code execution","aliases":["CVE-2026-4372","PYSEC-2026-2289"],"sourceIds":["GHSA-29pf-2h5f-8g72","PYSEC-2026-2289"],"published":"2026-05-24T14:16:16.917Z","modified":"2026-09-10T03:50:45.254378086Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4372"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-29pf-2h5f-8g72"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-2f96-g7mh-g2hx","slug":"ghsa-2f96-g7mh-g2hx-dd7ec02d","dossier":false,"summary":"GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","aliases":["CVE-2026-67325","PYSEC-2026-3836"],"sourceIds":["GHSA-2f96-g7mh-g2hx","PYSEC-2026-3836"],"published":"2026-07-21T19:43:43Z","modified":"2026-09-10T12:25:28.694037561Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2161"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2f96-g7mh-g2hx"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2xpw-w6gg-jr37","slug":"ghsa-2xpw-w6gg-jr37-91cead57","dossier":true,"summary":"urllib3 streaming API improperly handles highly compressed data","aliases":["CVE-2025-66471","PYSEC-2026-1994"],"sourceIds":["GHSA-2xpw-w6gg-jr37","PYSEC-2026-1994"],"published":"2025-12-05T18:15:54Z","modified":"2026-09-10T03:50:31.327173527Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-3749-ghw9-m3mg","slug":"ghsa-3749-ghw9-m3mg-fadf4a32","dossier":false,"summary":"PyTorch susceptible to local Denial of Service","aliases":["BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191"],"sourceIds":["GHSA-3749-ghw9-m3mg","PYSEC-2025-191"],"published":"2025-03-30T16:15:14.380Z","modified":"2026-09-10T03:50:22.781448235Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2953"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274#issue-2923122269"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-191.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?id.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.521279"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3749-ghw9-m3mg"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-37mw-44qp-f5jm","slug":"ghsa-37mw-44qp-f5jm-fb05555e","dossier":false,"summary":"Transformers is vulnerable to ReDoS attack through its DonutProcessor class","aliases":["CVE-2025-3933","PYSEC-2026-1977"],"sourceIds":["GHSA-37mw-44qp-f5jm","PYSEC-2026-1977"],"published":"2025-07-11T12:30:32Z","modified":"2026-09-10T03:50:57.888142744Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3933"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/37788"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-37mw-44qp-f5jm"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-38jv-5279-wg99","slug":"ghsa-38jv-5279-wg99-c9df8f7b","dossier":true,"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","aliases":["CVE-2026-21441","PYSEC-2026-1996"],"sourceIds":["GHSA-38jv-5279-wg99","PYSEC-2026-1996"],"published":"2026-01-07T19:18:14Z","modified":"2026-09-10T03:50:32.562010895Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38jv-5279-wg99"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-3f7w-8rr8-f37f","slug":"ghsa-3f7w-8rr8-f37f-9cab61a6","dossier":false,"summary":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","aliases":["CVE-2026-73620","PYSEC-2026-3949"],"sourceIds":["GHSA-3f7w-8rr8-f37f","PYSEC-2026-3949"],"published":"2026-08-03T20:09:56Z","modified":"2026-09-10T13:10:44.075529324Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3rp5-jjmw-4wv2","slug":"ghsa-3rp5-jjmw-4wv2-6d7352e6","dossier":false,"summary":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","aliases":["CVE-2026-69097"],"sourceIds":["GHSA-3rp5-jjmw-4wv2"],"published":"2026-07-24T16:22:02Z","modified":"2026-09-10T03:51:10.099586625Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3wxw-xv34-2frg","slug":"ghsa-3wxw-xv34-2frg-c013ae2d","dossier":false,"summary":"GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","aliases":["CVE-2026-78679","PYSEC-2026-3837"],"sourceIds":["GHSA-3wxw-xv34-2frg","PYSEC-2026-3837"],"published":"2026-09-08T19:42:22Z","modified":"2026-09-10T12:25:33.369776672Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2208"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3wxw-xv34-2frg"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3x9g-8vmp-wqvf","slug":"ghsa-3x9g-8vmp-wqvf-6d03bf5f","dossier":false,"summary":"Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient","aliases":["CVE-2026-49853","PYSEC-2026-3387"],"sourceIds":["GHSA-3x9g-8vmp-wqvf","PYSEC-2026-3387"],"published":"2026-06-15T20:20:00Z","modified":"2026-09-10T03:50:55.306087854Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3x9g-8vmp-wqvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49853"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-45hq-cxwh-f6vc","slug":"ghsa-45hq-cxwh-f6vc-d18d2872","dossier":true,"summary":"Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading","aliases":["BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255"],"sourceIds":["GHSA-45hq-cxwh-f6vc","PYSEC-2026-2255"],"published":"2026-07-06T19:17:08.577Z","modified":"2026-09-10T03:50:51.372929814Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-48p4-8xcf-vxj5","slug":"ghsa-48p4-8xcf-vxj5-13f12656","dossier":false,"summary":"urllib3 does not control redirects in browsers and Node.js","aliases":["CVE-2025-50182","PYSEC-2026-1997"],"sourceIds":["GHSA-48p4-8xcf-vxj5","PYSEC-2026-1997"],"published":"2025-06-18T17:50:11Z","modified":"2026-09-10T03:50:24.821170285Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-48p4-8xcf-vxj5"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-4gmw-gg2m-w46p","slug":"ghsa-4gmw-gg2m-w46p-58f27cb8","dossier":false,"summary":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","aliases":["CVE-2026-76219","PYSEC-2026-3838"],"sourceIds":["GHSA-4gmw-gg2m-w46p","PYSEC-2026-3838"],"published":"2026-08-07T15:33:57Z","modified":"2026-09-10T12:25:42.767166279Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4gmw-gg2m-w46p"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-4w7r-h757-3r74","slug":"ghsa-4w7r-h757-3r74-ca8973bc","dossier":false,"summary":"Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer","aliases":["CVE-2025-6921","PYSEC-2026-1980"],"sourceIds":["GHSA-4w7r-h757-3r74","PYSEC-2026-1980"],"published":"2025-09-23T15:31:09Z","modified":"2026-09-10T03:50:27.867584538Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6921"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4w7r-h757-3r74"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-4x4j-2g7c-83w6","slug":"ghsa-4x4j-2g7c-83w6-326c14d2","dossier":true,"summary":"Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path","aliases":["BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257"],"sourceIds":["GHSA-4x4j-2g7c-83w6","PYSEC-2026-2257"],"published":"2026-07-06T19:17:08.830Z","modified":"2026-09-10T03:51:10.324377232Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55798"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2257.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-5239-wwwm-4pmq","slug":"ghsa-5239-wwwm-4pmq-228840e4","dossier":false,"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","aliases":["CVE-2026-4539","PYSEC-2026-2987"],"sourceIds":["GHSA-5239-wwwm-4pmq","PYSEC-2026-2987"],"published":"2026-03-22T06:30:15Z","modified":"2026-09-10T03:50:59.780634752Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"},{"type":"PACKAGE","url":"https://pypi.org/project/pygments"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5239-wwwm-4pmq"}],"versionKeys":["pypi:pygments@2.19.1","pypi:pygments@2.19.2"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-539m-9xh6-q6rr","slug":"ghsa-539m-9xh6-q6rr-c4575e3c","dossier":false,"summary":"GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()","aliases":["CVE-2026-73619","PYSEC-2026-3948"],"sourceIds":["GHSA-539m-9xh6-q6rr","PYSEC-2026-3948"],"published":"2026-08-03T20:14:28Z","modified":"2026-09-10T13:11:01.695990206Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-53q9-r3pm-6pq6","slug":"ghsa-53q9-r3pm-6pq6-6fbb0149","dossier":false,"summary":"PyTorch: `torch.load` with `weights_only=True` leads to remote code execution","aliases":["BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41"],"sourceIds":["GHSA-53q9-r3pm-6pq6","PYSEC-2025-41"],"published":"2025-04-18T15:19:28Z","modified":"2026-08-07T08:12:20.395044060Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32434"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"}],"versionKeys":["pypi:torch@2.5.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-59p9-h35m-wg4g","slug":"ghsa-59p9-h35m-wg4g-68657c65","dossier":false,"summary":"Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer","aliases":["CVE-2025-6638","PYSEC-2026-1981"],"sourceIds":["GHSA-59p9-h35m-wg4g","PYSEC-2026-1981"],"published":"2025-09-12T12:30:23Z","modified":"2026-09-10T03:50:58.113501288Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6638"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59p9-h35m-wg4g"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-5rjg-fvgr-3xxf","slug":"ghsa-5rjg-fvgr-3xxf-79d39e6b","dossier":false,"summary":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write","aliases":["BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49"],"sourceIds":["GHSA-5rjg-fvgr-3xxf","PYSEC-2025-49"],"published":"2025-05-17T16:15:19Z","modified":"2026-09-10T03:50:24.253527717Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273"},{"type":"REPORT","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-5x94-69rx-g8h2","slug":"ghsa-5x94-69rx-g8h2-0bc05f88","dossier":true,"summary":"Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254"],"sourceIds":["GHSA-5x94-69rx-g8h2","PYSEC-2026-2254"],"published":"2026-07-06T19:17:08.270Z","modified":"2026-09-10T03:51:10.514604451Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-5xmw-vc9v-4wf2","slug":"ghsa-5xmw-vc9v-4wf2-86a8861a","dossier":false,"summary":"Pillow has a heap buffer overflow with nested list coordinates","aliases":["BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"sourceIds":["GHSA-5xmw-vc9v-4wf2","PYSEC-2026-2251"],"published":"2026-05-04T20:18:27Z","modified":"2026-09-10T03:51:04.701007027Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-5xxx-qhh7-9287","slug":"ghsa-5xxx-qhh7-9287-87d91b3e","dossier":false,"summary":"GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","aliases":["CVE-2026-78678","PYSEC-2026-3788"],"sourceIds":["GHSA-5xxx-qhh7-9287","PYSEC-2026-3788"],"published":"2026-08-25T02:16:52.313Z","modified":"2026-09-08T19:00:06.904435463Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78678"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-62p4-gmf7-7g93","slug":"ghsa-62p4-gmf7-7g93-cb81341c","dossier":true,"summary":"Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)","aliases":["BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493"],"sourceIds":["GHSA-62p4-gmf7-7g93","PYSEC-2026-3493"],"published":"2026-07-20T21:08:13Z","modified":"2026-09-10T03:51:10.632149522Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9719"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-62p4-gmf7-7g93"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-6497-prx7-gpmq","slug":"ghsa-6497-prx7-gpmq-2b8ee85d","dossier":false,"summary":"geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure","aliases":["CVE-2025-69662","PYSEC-2026-62"],"sourceIds":["GHSA-6497-prx7-gpmq","PYSEC-2026-62"],"published":"2026-01-30T19:16:11.967Z","modified":"2026-06-10T17:01:18.172032507Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69662"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/issues/3679"},{"type":"FIX","url":"https://github.com/geopandas/geopandas/pull/3681"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/commit/6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419"},{"type":"WEB","url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas"},{"type":"PACKAGE","url":"https://github.com/geopandas/geopandas"},{"type":"WEB","url":"https://github.com/geopandas/geopandas/releases/tag/v1.1.2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/geopandas/PYSEC-2026-62.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00025.html"},{"type":"EVIDENCE","url":"https://aydinnyunus.github.io/2025/12/27/sql-injection-geopandas/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6497-prx7-gpmq"}],"versionKeys":["pypi:geopandas@1.0.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-65pc-fj4g-8rjx","slug":"ghsa-65pc-fj4g-8rjx-9fe9e88a","dossier":true,"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","aliases":["CVE-2026-45409","PYSEC-2026-215"],"sourceIds":["GHSA-65pc-fj4g-8rjx","PYSEC-2026-215"],"published":"2026-05-19T14:34:32Z","modified":"2026-09-10T03:50:45.700124422Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}],"versionKeys":["pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7"],"packageCount":1,"repositoryCount":21},{"id":"GHSA-69w3-r845-3855","slug":"ghsa-69w3-r845-3855-1b4edc28","dossier":false,"summary":"HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class","aliases":["CVE-2026-1839","PYSEC-2026-2288"],"sourceIds":["GHSA-69w3-r845-3855","PYSEC-2026-2288"],"published":"2026-04-07T06:16:41.490Z","modified":"2026-09-10T03:50:43.300048881Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1839"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69w3-r845-3855"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-6p8h-3wgx-97gf","slug":"ghsa-6p8h-3wgx-97gf-635a010c","dossier":false,"summary":"GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks","aliases":["CVE-2026-73623","PYSEC-2026-3952"],"sourceIds":["GHSA-6p8h-3wgx-97gf","PYSEC-2026-3952"],"published":"2026-07-24T16:42:09Z","modified":"2026-09-10T13:11:03.995690741Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-6r8x-57c9-28j4","slug":"ghsa-6r8x-57c9-28j4-3a620dbf","dossier":true,"summary":"Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow","aliases":["BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451"],"sourceIds":["GHSA-6r8x-57c9-28j4","PYSEC-2026-3451"],"published":"2026-07-14T16:17:01.937Z","modified":"2026-09-10T03:51:10.822199342Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59199"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-6rvg-6v2m-4j46","slug":"ghsa-6rvg-6v2m-4j46-e04ee614","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2024-12720","PYSEC-2026-1982"],"sourceIds":["GHSA-6rvg-6v2m-4j46","PYSEC-2026-1982"],"published":"2025-03-20T12:32:43Z","modified":"2026-08-13T20:11:58.209202163Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12720"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6rvg-6v2m-4j46"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-7545-fcxq-7j24","slug":"ghsa-7545-fcxq-7j24-84dd19fd","dossier":false,"summary":"GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository","aliases":["CVE-2026-44243","PYSEC-2026-2162"],"sourceIds":["GHSA-7545-fcxq-7j24","PYSEC-2026-2162"],"published":"2026-05-06T19:38:48Z","modified":"2026-09-10T03:50:45.903378498Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44243"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-768j-98cg-p3fv","slug":"ghsa-768j-98cg-p3fv-0815ff07","dossier":false,"summary":"fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib","aliases":["CVE-2025-66034","PYSEC-2026-1389"],"sourceIds":["GHSA-768j-98cg-p3fv","PYSEC-2026-1389"],"published":"2025-12-01T19:07:00Z","modified":"2026-09-10T03:50:31.754255627Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66034"},{"type":"WEB","url":"https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"},{"type":"PACKAGE","url":"https://github.com/fonttools/fonttools"},{"type":"PACKAGE","url":"https://pypi.org/project/fonttools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-768j-98cg-p3fv"}],"versionKeys":["pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-7833-fr7j-v32q","slug":"ghsa-7833-fr7j-v32q-fd003872","dossier":false,"summary":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","aliases":["CVE-2026-78675","PYSEC-2026-3785"],"sourceIds":["GHSA-7833-fr7j-v32q","PYSEC-2026-3785"],"published":"2026-08-25T02:16:51.887Z","modified":"2026-09-08T18:45:10.860686865Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2211"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-78cv-mqj4-43f7","slug":"ghsa-78cv-mqj4-43f7-2021f695","dossier":false,"summary":"Tornado has incomplete validation of cookie attributes","aliases":["CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287"],"sourceIds":["GHSA-78cv-mqj4-43f7","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287"],"published":"2026-03-11T22:17:00Z","modified":"2026-09-10T03:50:44.255695398Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-78cv-mqj4-43f7"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/24a2d96ea115f663b223887deb0060f13974c104"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35536"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fqwm-6jpj-5wxc"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-7cx3-6m66-7c5m","slug":"ghsa-7cx3-6m66-7c5m-cde5125c","dossier":false,"summary":"Tornado vulnerable to excessive logging caused by malformed multipart form data","aliases":["CVE-2025-47287","PYSEC-2026-1974"],"sourceIds":["GHSA-7cx3-6m66-7c5m","PYSEC-2026-1974"],"published":"2025-05-16T14:12:40Z","modified":"2026-09-10T03:50:24.284224963Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47287"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7cx3-6m66-7c5m"}],"versionKeys":["pypi:tornado@6.4.2"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-7gcm-g887-7qv7","slug":"ghsa-7gcm-g887-7qv7-55bb9ff1","dossier":false,"summary":"protobuf affected by a JSON recursion depth bypass","aliases":["CVE-2026-0994","PYSEC-2026-1805"],"sourceIds":["GHSA-7gcm-g887-7qv7","PYSEC-2026-1805"],"published":"2026-01-23T15:31:35Z","modified":"2026-09-10T03:50:32.795512159Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0994"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/issues/25070"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/pull/25239"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gcm-g887-7qv7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-7p48-42j8-8846","slug":"ghsa-7p48-42j8-8846-584b0522","dossier":false,"summary":"Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)","aliases":["CVE-2026-33682","PYSEC-2026-2285"],"sourceIds":["GHSA-7p48-42j8-8846","PYSEC-2026-2285"],"published":"2026-03-25T21:20:52Z","modified":"2026-07-13T07:26:25.253864212Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/streamlit/streamlit/security/advisories/GHSA-7p48-42j8-8846"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33682"},{"type":"FIX","url":"https://github.com/streamlit/streamlit/commit/23692ca70b2f2ac720c72d1feb4f190c9d6eed76"},{"type":"PACKAGE","url":"https://github.com/streamlit/streamlit"},{"type":"ADVISORY","url":"https://github.com/streamlit/streamlit/releases/tag/1.54.0"}],"versionKeys":["pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-8423-8fgw-73vq","slug":"ghsa-8423-8fgw-73vq-142b238e","dossier":false,"summary":"tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)","aliases":["CVE-2026-91990"],"sourceIds":["GHSA-8423-8fgw-73vq"],"published":"2026-09-01T20:17:38Z","modified":"2026-09-16T03:56:01.992806508Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-8423-8fgw-73vq"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/pull/3704"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/de85b3f87446e323e881bbaa3d5a74f4b76e5f05"},{"type":"WEB","url":"https://gist.github.com/afldl/649861f25d39b53b7edbe0298e171617"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-887c-mr87-cxwp","slug":"ghsa-887c-mr87-cxwp-233a2961","dossier":false,"summary":"PyTorch Improper Resource Shutdown or Release vulnerability","aliases":["BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970"],"sourceIds":["GHSA-887c-mr87-cxwp","PYSEC-2026-1970"],"published":"2025-04-16T21:30:59Z","modified":"2026-09-10T03:50:23.660138570Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3730"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/150835"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/pull/150981"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af"},{"type":"WEB","url":"https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.305076"},{"type":"WEB","url":"https://vuldb.com/?id.305076"},{"type":"WEB","url":"https://vuldb.com/?submit.553645"},{"type":"PACKAGE","url":"https://pypi.org/project/torch"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-887c-mr87-cxwp"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-8mcc-hrx5-hvxc","slug":"ghsa-8mcc-hrx5-hvxc-9da62a9f","dossier":false,"summary":"GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","aliases":["CVE-2026-78677","PYSEC-2026-3787"],"sourceIds":["GHSA-8mcc-hrx5-hvxc","PYSEC-2026-3787"],"published":"2026-08-25T02:16:52.173Z","modified":"2026-09-08T19:00:06.914140693Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2210"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-8qvm-5x2c-j2w7","slug":"ghsa-8qvm-5x2c-j2w7-8a075519","dossier":false,"summary":"protobuf-python has a potential Denial of Service issue","aliases":["CVE-2025-4565","PYSEC-2026-1806"],"sourceIds":["GHSA-8qvm-5x2c-j2w7","PYSEC-2026-1806"],"published":"2025-06-16T16:02:58Z","modified":"2026-09-10T03:50:25.255076549Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8qvm-5x2c-j2w7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-8v84-f9pq-wr9x","slug":"ghsa-8v84-f9pq-wr9x-6c1b185f","dossier":true,"summary":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","aliases":["BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253"],"sourceIds":["GHSA-8v84-f9pq-wr9x","PYSEC-2026-2253"],"published":"2026-07-06T19:17:08.127Z","modified":"2026-09-10T03:51:11.229114807Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-9356-575x-2w9m","slug":"ghsa-9356-575x-2w9m-908a1f8c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-5197","PYSEC-2026-1983"],"sourceIds":["GHSA-9356-575x-2w9m","PYSEC-2026-1983"],"published":"2025-08-06T12:31:20Z","modified":"2026-09-10T03:50:26.988216861Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5197"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9356-575x-2w9m"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-94p4-4cq8-9g67","slug":"ghsa-94p4-4cq8-9g67-9a288a09","dossier":false,"summary":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","aliases":["CVE-2026-73622","PYSEC-2026-3951"],"sourceIds":["GHSA-94p4-4cq8-9g67","PYSEC-2026-3951"],"published":"2026-07-24T21:45:16Z","modified":"2026-09-10T13:10:44.445262446Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-956x-8gvw-wg5v","slug":"ghsa-956x-8gvw-wg5v-f5d32b2d","dossier":false,"summary":"GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","aliases":["CVE-2026-67323","PYSEC-2026-3839"],"sourceIds":["GHSA-956x-8gvw-wg5v","PYSEC-2026-3839"],"published":"2026-07-21T20:10:06Z","modified":"2026-09-10T12:25:39.217544351Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2163"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-956x-8gvw-wg5v"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-9hjg-9r4m-mvj7","slug":"ghsa-9hjg-9r4m-mvj7-32d7b63e","dossier":false,"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","aliases":["CVE-2024-47081","PYSEC-2026-1872"],"sourceIds":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"published":"2025-06-09T19:06:08Z","modified":"2026-09-10T03:50:25.139398550Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"FIX","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-9hw9-ch79-4vh6","slug":"ghsa-9hw9-ch79-4vh6-1ebda54f","dossier":true,"summary":"Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch","aliases":["BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453"],"sourceIds":["GHSA-9hw9-ch79-4vh6","PYSEC-2026-3453"],"published":"2026-07-14T16:17:02.370Z","modified":"2026-09-10T03:51:11.334365483Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59205"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-9rj7-rf2p-w77r","slug":"ghsa-9rj7-rf2p-w77r-996a0359","dossier":false,"summary":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","aliases":["CVE-2026-76218","PYSEC-2026-3840"],"sourceIds":["GHSA-9rj7-rf2p-w77r","PYSEC-2026-3840"],"published":"2026-08-07T15:36:43Z","modified":"2026-09-10T12:25:55.324487522Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9rj7-rf2p-w77r"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-9wx4-h78v-vm56","slug":"ghsa-9wx4-h78v-vm56-6a334c57","dossier":false,"summary":"Requests `Session` object does not verify requests after making first request with verify=False","aliases":["CVE-2024-35195","PYSEC-2026-1873"],"sourceIds":["GHSA-9wx4-h78v-vm56","PYSEC-2026-1873"],"published":"2024-05-20T20:15:00Z","modified":"2026-09-10T03:50:13.740879755Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"FIX","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wx4-h78v-vm56"}],"versionKeys":["pypi:requests@2.31.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-c678-jfcj-6jmf","slug":"ghsa-c678-jfcj-6jmf-cd9a8774","dossier":false,"summary":"PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument","aliases":["BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189"],"sourceIds":["GHSA-c678-jfcj-6jmf"],"published":"2025-03-10T12:30:55Z","modified":"2026-06-09T21:26:06.844649427Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2148"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147722"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-189.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/b0a67c7495bb11ecb23e556058db059ba48354af/torch/autograd/profiler.py#L990"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299059"},{"type":"WEB","url":"https://vuldb.com/?id.299059"},{"type":"WEB","url":"https://vuldb.com/?submit.505959"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-c98p-7wgm-6p64","slug":"ghsa-c98p-7wgm-6p64-ef7ac7e3","dossier":false,"summary":"Tornado: Quadratic DoS via Repeated Header Coalescing","aliases":["CVE-2025-67725","PYSEC-2025-266"],"sourceIds":["GHSA-c98p-7wgm-6p64","PYSEC-2025-266"],"published":"2025-12-12T06:15:41.380Z","modified":"2026-07-20T19:15:27.567094965Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c98p-7wgm-6p64"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67725"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-266.yaml"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-cfh3-3jmp-rvhc","slug":"ghsa-cfh3-3jmp-rvhc-4e95572c","dossier":false,"summary":"Pillow affected by out-of-bounds write when loading PSD images","aliases":["BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"sourceIds":["GHSA-cfh3-3jmp-rvhc","PYSEC-2026-2249"],"published":"2026-02-11T14:22:50Z","modified":"2026-09-10T03:50:59.393816085Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-25990"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4942"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-cpwx-vrp4-4pq7","slug":"ghsa-cpwx-vrp4-4pq7-799bdc98","dossier":false,"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","aliases":["CVE-2025-27516","PYSEC-2026-1471"],"sourceIds":["GHSA-cpwx-vrp4-4pq7","PYSEC-2026-1471"],"published":"2025-03-05T20:40:14Z","modified":"2026-09-10T03:49:48.526758681Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cpwx-vrp4-4pq7"}],"versionKeys":["pypi:jinja2@3.1.3","pypi:jinja2@3.1.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-cx3h-4qpv-8hc9","slug":"ghsa-cx3h-4qpv-8hc9-3078b6fa","dossier":false,"summary":"Tornado has out-of-bounds memory access via C extension","aliases":["CVE-2026-49854","PYSEC-2026-3388"],"sourceIds":["GHSA-cx3h-4qpv-8hc9","PYSEC-2026-3388"],"published":"2026-06-12T18:30:19Z","modified":"2026-09-10T03:50:49.232529305Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-cx3h-4qpv-8hc9"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.6"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cx3h-4qpv-8hc9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49854"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-cx63-2mw6-8hw5","slug":"ghsa-cx63-2mw6-8hw5-1754ad59","dossier":false,"summary":"setuptools vulnerable to Command Injection via package URL","aliases":["BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918"],"sourceIds":["GHSA-cx63-2mw6-8hw5","PYSEC-2026-1918"],"published":"2024-07-15T03:30:57Z","modified":"2026-09-10T03:50:16.663495061Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345"},{"type":"WEB","url":"https://github.com/pypa/setuptools/pull/4332"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"},{"type":"PACKAGE","url":"https://pypi.org/project/setuptools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cx63-2mw6-8hw5"}],"versionKeys":["pypi:setuptools@69.2.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f4hp-rmr7-r7v8","slug":"ghsa-f4hp-rmr7-r7v8-fe038cb7","dossier":false,"summary":"PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function","aliases":["BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192"],"sourceIds":["GHSA-f4hp-rmr7-r7v8"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-09T22:11:09.050788278Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2998"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-192.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302047"},{"type":"WEB","url":"https://vuldb.com/?id.302047"},{"type":"WEB","url":"https://vuldb.com/?submit.524151"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-fgcw-684q-jj6r","slug":"ghsa-fgcw-684q-jj6r-9fe55ba1","dossier":false,"summary":"huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path","aliases":["CVE-2026-5241","PYSEC-2026-2290"],"sourceIds":["GHSA-fgcw-684q-jj6r","PYSEC-2026-2290"],"published":"2026-06-03T14:16:46.337Z","modified":"2026-09-10T03:50:49.345942449Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5241"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-5241"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484384"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fgcw-684q-jj6r"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-fj7v-r99m-22gq","slug":"ghsa-fj7v-r99m-22gq-e36cfebd","dossier":true,"summary":"Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images","aliases":["BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494"],"sourceIds":["GHSA-fj7v-r99m-22gq","PYSEC-2026-3494"],"published":"2026-07-20T23:09:36Z","modified":"2026-09-10T03:50:51.891240357Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59198"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9709"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fj7v-r99m-22gq"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-fjr4-x663-mwxc","slug":"ghsa-fjr4-x663-mwxc-324b7aa5","dossier":false,"summary":"GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)","aliases":["CVE-2026-73624"],"sourceIds":["GHSA-fjr4-x663-mwxc"],"published":"2026-07-24T16:41:20Z","modified":"2026-09-10T03:50:51.919825118Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-fpwr-67px-3qhx","slug":"ghsa-fpwr-67px-3qhx-94f30126","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-1194","PYSEC-2026-1984"],"sourceIds":["GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"published":"2025-04-29T12:30:21Z","modified":"2026-08-13T20:11:58.399313771Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1194"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fpwr-67px-3qhx"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-g7vv-2v7x-gj9p","slug":"ghsa-g7vv-2v7x-gj9p-5ef970c3","dossier":false,"summary":"tqdm CLI arguments injection attack","aliases":["CVE-2024-34062","PYSEC-2026-1976"],"sourceIds":["GHSA-g7vv-2v7x-gj9p","PYSEC-2026-1976"],"published":"2024-05-03T19:33:28Z","modified":"2026-09-10T03:50:13.776534451Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"type":"WEB","url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"type":"PACKAGE","url":"https://github.com/tqdm/tqdm"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"},{"type":"PACKAGE","url":"https://pypi.org/project/tqdm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g7vv-2v7x-gj9p"}],"versionKeys":["pypi:tqdm@4.66.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gc5v-m9x4-r6x2","slug":"ghsa-gc5v-m9x4-r6x2-b9828ad8","dossier":true,"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","aliases":["CVE-2026-25645","PYSEC-2026-2275"],"sourceIds":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"published":"2026-03-25T16:56:28Z","modified":"2026-09-10T03:50:39.207922076Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"FIX","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"ADVISORY","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3","pypi:requests@2.32.4","pypi:requests@2.32.5"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-gm62-xv2j-4w53","slug":"ghsa-gm62-xv2j-4w53-5befa184","dossier":true,"summary":"urllib3 allows an unbounded number of links in the decompression chain","aliases":["CVE-2025-66418","PYSEC-2026-1998"],"sourceIds":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"published":"2025-12-05T18:15:19Z","modified":"2026-09-10T03:50:58.741847479Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gm62-xv2j-4w53"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-gmj6-6f8f-6699","slug":"ghsa-gmj6-6f8f-6699-e3e02f35","dossier":false,"summary":"Jinja has a sandbox breakout through malicious filenames","aliases":["CVE-2024-56201","PYSEC-2026-1472"],"sourceIds":["GHSA-gmj6-6f8f-6699","PYSEC-2026-1472"],"published":"2024-12-23T17:54:12Z","modified":"2026-09-10T03:50:56.152882717Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gmj6-6f8f-6699"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-h35f-9h28-mq5c","slug":"ghsa-h35f-9h28-mq5c-f3238ba1","dossier":true,"summary":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","aliases":["BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447"],"sourceIds":["GHSA-h35f-9h28-mq5c","PYSEC-2026-3447"],"published":"2026-07-08T17:17:27.020Z","modified":"2026-09-10T03:50:52.323347787Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"ADVISORY","url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0","pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-h75v-3vvj-5mfj","slug":"ghsa-h75v-3vvj-5mfj-d8fc6bb7","dossier":false,"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","aliases":["CVE-2024-34064","PYSEC-2026-1474"],"sourceIds":["GHSA-h75v-3vvj-5mfj","PYSEC-2026-1474"],"published":"2024-05-06T14:20:59Z","modified":"2026-09-10T03:50:13.786450101Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h75v-3vvj-5mfj"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hh9p-6wh2-4mfc","slug":"ghsa-hh9p-6wh2-4mfc-8e33cff1","dossier":false,"summary":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","aliases":["CVE-2026-76217","PYSEC-2026-3841"],"sourceIds":["GHSA-hh9p-6wh2-4mfc","PYSEC-2026-3841"],"published":"2026-08-07T15:43:56Z","modified":"2026-09-10T12:26:07.095223621Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hh9p-6wh2-4mfc"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-hmq2-w58f-27jc","slug":"ghsa-hmq2-w58f-27jc-f0b0fe70","dossier":false,"summary":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","aliases":["CVE-2026-76222","PYSEC-2026-3784"],"sourceIds":["GHSA-hmq2-w58f-27jc","PYSEC-2026-3784"],"published":"2026-08-07T15:45:39Z","modified":"2026-09-08T21:00:05.149418166Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2202"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-hxxf-235m-72v3","slug":"ghsa-hxxf-235m-72v3-21da19b0","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11394","PYSEC-2024-229"],"sourceIds":["GHSA-hxxf-235m-72v3","PYSEC-2024-229"],"published":"2024-11-22T22:15:07Z","modified":"2026-09-10T03:50:20.811665084Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11394"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-229.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxxf-235m-72v3"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jhmp-mqwm-3gq8","slug":"ghsa-jhmp-mqwm-3gq8-3b1c10a9","dossier":false,"summary":"Tornado: Quadratic DoS via Crafted Multipart Parameters","aliases":["CVE-2025-67726","PYSEC-2025-267"],"sourceIds":["GHSA-jhmp-mqwm-3gq8","PYSEC-2025-267"],"published":"2025-12-12T07:15:44.920Z","modified":"2026-07-20T19:15:27.583657512Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-jhmp-mqwm-3gq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67726"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/771472cfdaeebc0d89a9cc46e249f8891a6b29cd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-267.yaml"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-jjj6-mw9f-p565","slug":"ghsa-jjj6-mw9f-p565-ed2d1f46","dossier":true,"summary":"Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()","aliases":["BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495"],"sourceIds":["GHSA-jjj6-mw9f-p565","PYSEC-2026-3495"],"published":"2026-07-20T23:11:29Z","modified":"2026-09-10T03:50:12.341825852Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59200"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9718"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjj6-mw9f-p565"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-jjph-296x-mrcr","slug":"ghsa-jjph-296x-mrcr-0f661d67","dossier":false,"summary":"Transformers vulnerable to ReDoS attack through its get_imports() function","aliases":["CVE-2025-3264","PYSEC-2026-1985"],"sourceIds":["GHSA-jjph-296x-mrcr","PYSEC-2026-1985"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:51.899728258Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3264"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjph-296x-mrcr"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jm78-9fvv-mhgr","slug":"ghsa-jm78-9fvv-mhgr-2c167ddc","dossier":false,"summary":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)","aliases":["CVE-2026-76221","PYSEC-2026-3783"],"sourceIds":["GHSA-jm78-9fvv-mhgr","PYSEC-2026-3783"],"published":"2026-08-07T15:46:35Z","modified":"2026-09-10T03:51:14.296736368Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-jw8x-6495-233v","slug":"ghsa-jw8x-6495-233v-cb32b711","dossier":false,"summary":"scikit-learn sensitive data leakage vulnerability","aliases":["CVE-2024-5206","PYSEC-2024-110"],"sourceIds":["GHSA-jw8x-6495-233v","PYSEC-2024-110"],"published":"2024-06-06T19:16:00Z","modified":"2026-09-10T03:50:15.628224747Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5206"},{"type":"FIX","url":"https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/scikit-learn/PYSEC-2024-110.yaml"},{"type":"PACKAGE","url":"https://github.com/scikit-learn/scikit-learn"},{"type":"WEB","url":"https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jw8x-6495-233v"}],"versionKeys":["pypi:scikit-learn@1.3.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mf9v-mfxr-j63j","slug":"ghsa-mf9v-mfxr-j63j-1a7db6d4","dossier":false,"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","aliases":["CVE-2026-44432","PYSEC-2026-142"],"sourceIds":["GHSA-mf9v-mfxr-j63j","PYSEC-2026-142"],"published":"2026-05-11T14:51:45Z","modified":"2026-09-10T03:51:06.409994465Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-mgf9-4vpg-hj56","slug":"ghsa-mgf9-4vpg-hj56-00729355","dossier":false,"summary":"tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)","aliases":["CVE-2026-49855","PYSEC-2026-3389"],"sourceIds":["GHSA-mgf9-4vpg-hj56","PYSEC-2026-3389"],"published":"2026-06-15T20:19:28Z","modified":"2026-09-10T03:51:09.080081033Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-mgf9-4vpg-hj56"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mgf9-4vpg-hj56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49855"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-mpf4-983q-p7j4","slug":"ghsa-mpf4-983q-p7j4-9fb72bc8","dossier":false,"summary":"Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop","aliases":["CVE-2026-82397","PYSEC-2026-3928"],"sourceIds":["GHSA-mpf4-983q-p7j4","PYSEC-2026-3928"],"published":"2026-09-02T14:38:43Z","modified":"2026-09-10T12:25:33.492830390Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82397"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/pull/3704"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"},{"type":"PACKAGE","url":"https://pypi.org/project/tornado"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mpf4-983q-p7j4"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-mv93-w799-cj2w","slug":"ghsa-mv93-w799-cj2w-4413137a","dossier":false,"summary":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","aliases":["CVE-2026-67326"],"sourceIds":["GHSA-mv93-w799-cj2w"],"published":"2026-05-08T23:19:02Z","modified":"2026-09-10T03:51:06.521467170Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-p538-c434-8v24","slug":"ghsa-p538-c434-8v24-c303e516","dossier":false,"summary":"GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count","aliases":["CVE-2026-73621","PYSEC-2026-3950"],"sourceIds":["GHSA-p538-c434-8v24","PYSEC-2026-3950"],"published":"2026-08-03T20:23:17Z","modified":"2026-09-10T13:10:55.177009469Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2184"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-truncation-via-commit-count"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-pg7v-jwj7-p798","slug":"ghsa-pg7v-jwj7-p798-7c77aab5","dossier":false,"summary":"Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service","aliases":["BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452"],"sourceIds":["GHSA-pg7v-jwj7-p798","PYSEC-2026-3452"],"published":"2026-07-14T16:17:02.063Z","modified":"2026-09-10T03:50:52.876709782Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59203"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-phhr-52qp-3mj4","slug":"ghsa-phhr-52qp-3mj4-6f5d82e3","dossier":false,"summary":"Transformers's Improper Input Validation vulnerability can be exploited through username injection","aliases":["CVE-2025-3777","PYSEC-2026-1986"],"sourceIds":["GHSA-phhr-52qp-3mj4","PYSEC-2026-1986"],"published":"2025-07-07T12:30:22Z","modified":"2026-09-10T03:50:26.198077196Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3777"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py"},{"type":"WEB","url":"https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phhr-52qp-3mj4"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-phj9-mv4w-65pm","slug":"ghsa-phj9-mv4w-65pm-481e7dc3","dossier":true,"summary":"Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256"],"sourceIds":["GHSA-phj9-mv4w-65pm","PYSEC-2026-2256"],"published":"2026-07-06T19:17:08.703Z","modified":"2026-09-10T03:51:11.734605509Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-pq67-6m6q-mj2v","slug":"ghsa-pq67-6m6q-mj2v-3522d1d4","dossier":false,"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","aliases":["CVE-2025-50181","PYSEC-2026-1999"],"sourceIds":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"published":"2025-06-18T17:50:00Z","modified":"2026-09-10T03:50:25.299291456Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-pr2v-jx2c-wg9f","slug":"ghsa-pr2v-jx2c-wg9f-1ca6d67c","dossier":false,"summary":"Tornado vulnerable to Header Injection and XSS via reason argument","aliases":["CVE-2025-67724","PYSEC-2025-265"],"sourceIds":["GHSA-pr2v-jx2c-wg9f","PYSEC-2025-265"],"published":"2025-12-12T06:15:41.213Z","modified":"2026-07-20T19:00:24.953994999Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pr2v-jx2c-wg9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67724"},{"type":"FIX","url":"https://github.com/tornadoweb/tornado/commit/9c163aebeaad9e6e7d28bac1f33580eb00b0e421"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2025-265.yaml"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.3"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-pw6j-qg29-8w7f","slug":"ghsa-pw6j-qg29-8w7f-fb4d7ed6","dossier":false,"summary":"Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse","aliases":["CVE-2026-91992"],"sourceIds":["GHSA-pw6j-qg29-8w7f"],"published":"2026-06-15T20:37:24Z","modified":"2026-09-16T03:56:01.290461498Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-pwv6-vv43-88gr","slug":"ghsa-pwv6-vv43-88gr-c5f811d0","dossier":false,"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","aliases":["BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"sourceIds":["GHSA-pwv6-vv43-88gr","PYSEC-2026-2252"],"published":"2026-05-04T20:20:31Z","modified":"2026-09-10T03:50:47.242104143Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-q2wp-rjmx-x6x9","slug":"ghsa-q2wp-rjmx-x6x9-43135d3d","dossier":false,"summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","aliases":["CVE-2025-3263","PYSEC-2026-1987"],"sourceIds":["GHSA-q2wp-rjmx-x6x9","PYSEC-2026-1987"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:57.889099913Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3263"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q2x7-8rv6-6q7h","slug":"ghsa-q2x7-8rv6-6q7h-1113a288","dossier":false,"summary":"Jinja has a sandbox breakout through indirect reference to format method","aliases":["CVE-2024-56326","PYSEC-2026-1475"],"sourceIds":["GHSA-q2x7-8rv6-6q7h","PYSEC-2026-1475"],"published":"2024-12-23T17:56:08Z","modified":"2026-09-10T03:50:21.662855250Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2x7-8rv6-6q7h"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qccp-gfcp-xxvc","slug":"ghsa-qccp-gfcp-xxvc-0d988969","dossier":true,"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","aliases":["CVE-2026-44431","PYSEC-2026-141"],"sourceIds":["GHSA-qccp-gfcp-xxvc","PYSEC-2026-141"],"published":"2026-05-11T14:51:20Z","modified":"2026-09-10T03:50:47.272765640Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-qfhq-4f3w-5fph","slug":"ghsa-qfhq-4f3w-5fph-33bc3f14","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.lstm_cell function","aliases":["BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195"],"sourceIds":["GHSA-qfhq-4f3w-5fph"],"published":"2025-03-31T18:31:08Z","modified":"2026-06-10T18:26:26.736808954Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3001"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626#issue-2935860995"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/999d94b5ede5f4ec111ba7dd144129e2c2725b03"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-195.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302050"},{"type":"WEB","url":"https://vuldb.com/?id.302050"},{"type":"WEB","url":"https://vuldb.com/?submit.524212"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-qjxf-f2mg-c6mc","slug":"ghsa-qjxf-f2mg-c6mc-58d52008","dossier":false,"summary":"Tornado is vulnerable to DoS due to too many multipart parts","aliases":["CVE-2026-31958","PYSEC-2026-140"],"sourceIds":["GHSA-qjxf-f2mg-c6mc","PYSEC-2026-140"],"published":"2026-03-11T20:16:16.617Z","modified":"2026-09-10T03:50:40.522968763Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-qjxf-f2mg-c6mc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31958"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/119a195e290c43ad2d63a2cf012c29d43d6ed839"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2026-140.yaml"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00000.html"}],"versionKeys":["pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4"],"packageCount":1,"repositoryCount":9},{"id":"GHSA-qmgc-5h2g-mvrw","slug":"ghsa-qmgc-5h2g-mvrw-199eacc8","dossier":false,"summary":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","aliases":["CVE-2026-22701","PYSEC-2026-1374"],"sourceIds":["GHSA-qmgc-5h2g-mvrw","PYSEC-2026-1374"],"published":"2026-01-13T18:44:55Z","modified":"2026-09-10T03:50:33.702580779Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qmgc-5h2g-mvrw"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-qq3j-4f4f-9583","slug":"ghsa-qq3j-4f4f-9583-cd76c72c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service","aliases":["CVE-2025-2099","PYSEC-2025-40"],"sourceIds":["GHSA-qq3j-4f4f-9583","PYSEC-2025-40"],"published":"2025-05-19T12:15:19Z","modified":"2026-06-10T17:02:48.111891265Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2099"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/36648"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qq3j-4f4f-9583"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qxrp-vhvm-j765","slug":"ghsa-qxrp-vhvm-j765-63c6e9a2","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11392","PYSEC-2024-227"],"sourceIds":["GHSA-qxrp-vhvm-j765","PYSEC-2024-227"],"published":"2024-11-22T22:15:06Z","modified":"2026-09-10T03:50:21.016710762Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11392"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-227.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qxrp-vhvm-j765"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r73j-pqj5-w3x7","slug":"ghsa-r73j-pqj5-w3x7-8d4d543f","dossier":false,"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","aliases":["BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"sourceIds":["GHSA-r73j-pqj5-w3x7","PYSEC-2026-2874"],"published":"2026-05-04T20:19:30Z","modified":"2026-09-10T03:50:55.309086884Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r73j-pqj5-w3x7"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-r9mr-m37c-5fr3","slug":"ghsa-r9mr-m37c-5fr3-d43000fc","dossier":false,"summary":"GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution","aliases":["CVE-2026-73625","PYSEC-2026-3953"],"sourceIds":["GHSA-r9mr-m37c-5fr3","PYSEC-2026-3953"],"published":"2026-07-24T16:42:57Z","modified":"2026-09-10T13:10:47.448946391Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-rcv9-qm8p-9p6j","slug":"ghsa-rcv9-qm8p-9p6j-edc1db04","dossier":false,"summary":"Hugging Face Transformers library has Regular Expression Denial of Service","aliases":["CVE-2025-6051","PYSEC-2026-1988"],"sourceIds":["GHSA-rcv9-qm8p-9p6j","PYSEC-2026-1988"],"published":"2025-09-14T18:30:26Z","modified":"2026-09-10T03:50:28.694224028Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6051"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/38844"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rcv9-qm8p-9p6j"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-rgxp-2hwp-jwgg","slug":"ghsa-rgxp-2hwp-jwgg-76cdda06","dossier":false,"summary":"Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering","aliases":["CVE-2026-25087","PYSEC-2026-113"],"sourceIds":["GHSA-rgxp-2hwp-jwgg","PYSEC-2026-113"],"published":"2026-02-17T14:16:01.947Z","modified":"2026-09-10T03:50:35.750182003Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25087"},{"type":"FIX","url":"https://github.com/apache/arrow/pull/48925"},{"type":"PACKAGE","url":"https://github.com/apache/arrow"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyarrow/PYSEC-2026-113.yaml"},{"type":"ADVISORY","url":"https://lists.apache.org/thread/mpm4ld1qony30tchfpjtk5b11tcyvmwh"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rgxp-2hwp-jwgg"}],"versionKeys":["pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-rpm5-65cw-6hj4","slug":"ghsa-rpm5-65cw-6hj4-6c97dd77","dossier":false,"summary":"GitPython has Command Injection via Git options bypass","aliases":["CVE-2026-42215","PYSEC-2026-2160"],"sourceIds":["GHSA-rpm5-65cw-6hj4","PYSEC-2026-2160"],"published":"2026-04-25T23:42:16Z","modified":"2026-09-10T03:51:03.167884784Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-rrmf-rvhw-rf47","slug":"ghsa-rrmf-rvhw-rf47-389d8330","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.jit.script function","aliases":["BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194"],"sourceIds":["GHSA-rrmf-rvhw-rf47"],"published":"2025-03-31T15:30:48Z","modified":"2026-09-10T03:49:48.419046410Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3000"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623#issue-2935703015"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302049"},{"type":"WEB","url":"https://vuldb.com/?id.302049"},{"type":"WEB","url":"https://vuldb.com/?submit.524197"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-rwj8-pgh3-r573","slug":"ghsa-rwj8-pgh3-r573-0bf779f8","dossier":false,"summary":"GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL","aliases":["CVE-2026-67322","PYSEC-2026-3842"],"sourceIds":["GHSA-rwj8-pgh3-r573","PYSEC-2026-3842"],"published":"2026-07-21T22:06:09Z","modified":"2026-09-10T12:25:44.904800513Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2172"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rwj8-pgh3-r573"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-v87r-6q3f-2j67","slug":"ghsa-v87r-6q3f-2j67-81913ca6","dossier":false,"summary":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","aliases":["CVE-2026-44244","PYSEC-2026-2163"],"sourceIds":["GHSA-v87r-6q3f-2j67","PYSEC-2026-2163"],"published":"2026-05-06T21:58:00Z","modified":"2026-09-10T03:50:47.691444343Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-vgrw-7cvw-pwgx","slug":"ghsa-vgrw-7cvw-pwgx-766c6098","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its unpack_sequence function","aliases":["BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193"],"sourceIds":["GHSA-vgrw-7cvw-pwgx"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-10T17:41:15.774477397Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2999"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-193.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302048"},{"type":"WEB","url":"https://vuldb.com/?id.302048"},{"type":"WEB","url":"https://vuldb.com/?submit.524198"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-vjc4-5qp5-m44j","slug":"ghsa-vjc4-5qp5-m44j-08063b19","dossier":true,"summary":"Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service","aliases":["BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496"],"sourceIds":["GHSA-vjc4-5qp5-m44j","PYSEC-2026-3496"],"published":"2026-07-20T23:18:32Z","modified":"2026-09-10T03:50:53.107920034Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59204"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9704"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vjc4-5qp5-m44j"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-vqwp-45wm-r9r5","slug":"ghsa-vqwp-45wm-r9r5-eaa960a2","dossier":false,"summary":"Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission","aliases":["CVE-2026-10804","PYSEC-2026-212"],"sourceIds":["GHSA-vqwp-45wm-r9r5","PYSEC-2026-212"],"published":"2026-06-04T12:16:24.620Z","modified":"2026-07-23T15:00:23.893493649Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10804"},{"type":"FIX","url":"https://github.com/streamlit/streamlit/issues/14622"},{"type":"FIX","url":"https://github.com/streamlit/streamlit/pull/14635"},{"type":"WEB","url":"https://github.com/streamlit/streamlit/pull/15397"},{"type":"WEB","url":"https://github.com/streamlit/streamlit/commit/fec0f584dae9261abed16cad35b32922104bb933"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/streamlit/PYSEC-2026-212.yaml"},{"type":"PACKAGE","url":"https://github.com/streamlit/streamlit"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-10804"},{"type":"ADVISORY","url":"https://vuldb.com/submit/831508"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/368253"},{"type":"REPORT","url":"https://vuldb.com/vuln/368253/cti"},{"type":"WEB","url":"https://github.com/streamlit/streamlit/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vqwp-45wm-r9r5"}],"versionKeys":["pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-w853-jp5j-5j7f","slug":"ghsa-w853-jp5j-5j7f-2786386f","dossier":false,"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","aliases":["CVE-2025-68146","PYSEC-2026-1375"],"sourceIds":["GHSA-w853-jp5j-5j7f","PYSEC-2026-1375"],"published":"2025-12-16T20:52:55Z","modified":"2026-09-10T03:50:32.252960082Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/3.20.1"},{"type":"WEB","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants"},{"type":"WEB","url":"https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w853-jp5j-5j7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68146"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-whj4-6x5x-4v2j","slug":"ghsa-whj4-6x5x-4v2j-eb5fc6a1","dossier":false,"summary":"FITS GZIP decompression bomb in Pillow","aliases":["BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"sourceIds":["GHSA-whj4-6x5x-4v2j","PYSEC-2026-2250"],"published":"2026-04-13T19:22:35Z","modified":"2026-09-10T03:51:03.847830288Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40192"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-wjx4-4jcj-g98j","slug":"ghsa-wjx4-4jcj-g98j-e937161b","dossier":false,"summary":"Pillow has an integer overflow when processing fonts","aliases":["BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"sourceIds":["GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"published":"2026-05-04T20:18:45Z","modified":"2026-09-10T03:50:47.950262681Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-wrfc-pvp9-mr9g","slug":"ghsa-wrfc-pvp9-mr9g-c6b03ddf","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11393","PYSEC-2024-228"],"sourceIds":["GHSA-wrfc-pvp9-mr9g","PYSEC-2024-228"],"published":"2024-11-22T22:15:07Z","modified":"2026-09-10T03:50:55.987633957Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11393"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-228.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrfc-pvp9-mr9g"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-wvpp-8hx9-p66j","slug":"ghsa-wvpp-8hx9-p66j-188b3951","dossier":false,"summary":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","aliases":["CVE-2026-76220","PYSEC-2026-3843"],"sourceIds":["GHSA-wvpp-8hx9-p66j","PYSEC-2026-3843"],"published":"2026-08-07T15:49:07Z","modified":"2026-09-10T12:26:01.792035310Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wvpp-8hx9-p66j"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-wwv5-g3v4-889x","slug":"ghsa-wwv5-g3v4-889x-b37c7c95","dossier":false,"summary":"Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`","aliases":[],"sourceIds":["GHSA-wwv5-g3v4-889x"],"published":"2026-09-01T20:17:23Z","modified":"2026-09-10T03:50:54.582059531Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/pull/3704"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/pull/3706"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/6ef836e43e1278530041376adb32504daa977b91"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/commit/da284767eae8e1f0484f123b8c3225f6465b09c7"},{"type":"PACKAGE","url":"https://github.com/tornadoweb/tornado"},{"type":"WEB","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.8"}],"versionKeys":["pypi:tornado@6.5.5","pypi:tornado@6.5.7"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-x2qx-6953-8485","slug":"ghsa-x2qx-6953-8485-107f8fe2","dossier":false,"summary":"GitPython: Unsafe option check validates multi_options before shlex.split transformation","aliases":["CVE-2026-42284","PYSEC-2026-2161"],"sourceIds":["GHSA-x2qx-6953-8485","PYSEC-2026-2161"],"published":"2026-04-25T23:41:49Z","modified":"2026-09-10T03:51:03.787491179Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"},{"type":"WEB","url":"https://www.tenable.com/cve/CVE-2026-32686"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-x3gm-94wq-g975","slug":"ghsa-x3gm-94wq-g975-a197ba31","dossier":false,"summary":"PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module","aliases":["BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190"],"sourceIds":["GHSA-x3gm-94wq-g975"],"published":"2025-03-10T15:30:47Z","modified":"2026-06-09T22:11:08.734544854Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2149"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818#issue-2877301660"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-190.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299060"},{"type":"WEB","url":"https://vuldb.com/?id.299060"},{"type":"WEB","url":"https://vuldb.com/?submit.506563"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-xg8h-j46f-w952","slug":"ghsa-xg8h-j46f-w952-da36a616","dossier":false,"summary":"Pillow vulnerability can cause write buffer overflow on BCn encoding","aliases":["BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61"],"sourceIds":["GHSA-xg8h-j46f-w952","PYSEC-2025-61"],"published":"2025-07-01T17:29:37Z","modified":"2026-09-10T03:50:26.431657121Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9041"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/11.3.0"}],"versionKeys":["pypi:pillow@11.2.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-xj96-63gp-2gmr","slug":"ghsa-xj96-63gp-2gmr-85e1cf15","dossier":true,"summary":"Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`","aliases":["BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454"],"sourceIds":["GHSA-xj96-63gp-2gmr","PYSEC-2026-3454"],"published":"2026-07-14T17:17:14.487Z","modified":"2026-09-10T03:50:53.192759645Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9695"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-xrqw-3rrv-vx5w","slug":"ghsa-xrqw-3rrv-vx5w-3d985837","dossier":false,"summary":"Transformers save_pretrained path traversal allows arbitrary file writes through chat template names","aliases":["CVE-2026-9856","PYSEC-2026-3929"],"sourceIds":["GHSA-xrqw-3rrv-vx5w","PYSEC-2026-3929"],"published":"2026-08-02T18:30:20Z","modified":"2026-09-10T12:25:36.528730268Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9856"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/46191"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/eaaaf8494dd5386634ae37d1d122212fdc315be5"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/362824d5-fe18-40e8-a6cf-62277f97a170"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xrqw-3rrv-vx5w"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6","pypi:transformers@5.8.0"],"packageCount":1,"repositoryCount":12},{"id":"PYSEC-2025-112","slug":"pysec-2025-112-653e8a7c","dossier":false,"summary":null,"aliases":["CVE-2025-64429","GHSA-vmp8-hg63-v2hp"],"sourceIds":["PYSEC-2025-112"],"published":"2025-11-12T22:15:49.813Z","modified":"2026-05-20T09:18:59.601738Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/duckdb/duckdb/blob/029a5b87ff5b1cd22f7f9717d48cd8830d00807c/src/common/random_engine.cpp#L20"},{"type":"ADVISORY","url":"https://duckdb.org/2025/09/16/announcing-duckdb-140.html"},{"type":"ADVISORY","url":"https://github.com/duckdb/duckdb/security/advisories/GHSA-vmp8-hg63-v2hp"},{"type":"FIX","url":"https://github.com/duckdb/duckdb/pull/17275"}],"versionKeys":["pypi:duckdb@1.4.1"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-198","slug":"pysec-2025-198-62b25ed4","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46148","CVE-2025-46148"],"sourceIds":["PYSEC-2025-198"],"published":"2025-09-25T15:16:12.007Z","modified":"2026-05-20T09:19:19.437232Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151198"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/152993"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"PYSEC-2025-199","slug":"pysec-2025-199-c528cb5a","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46149","CVE-2025-46149"],"sourceIds":["PYSEC-2025-199"],"published":"2025-09-25T15:16:12.153Z","modified":"2026-05-20T09:19:19.498677Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147848"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/147961"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-200","slug":"pysec-2025-200-d11172cd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46150","CVE-2025-46150"],"sourceIds":["PYSEC-2025-200"],"published":"2025-09-25T15:16:12.303Z","modified":"2026-05-20T09:19:19.559970Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/144395"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-201","slug":"pysec-2025-201-c002b022","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46152","CVE-2025-46152"],"sourceIds":["PYSEC-2025-201"],"published":"2025-09-25T15:16:12.470Z","modified":"2026-05-20T09:19:19.618679Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/143555"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143635"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-202","slug":"pysec-2025-202-f0ff1751","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46153","CVE-2025-46153"],"sourceIds":["PYSEC-2025-202"],"published":"2025-09-25T15:16:12.603Z","modified":"2026-05-20T09:19:19.678555Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/142853"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143460"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-203","slug":"pysec-2025-203-2febb201","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55551","CVE-2025-55551"],"sourceIds":["PYSEC-2025-203"],"published":"2025-09-25T15:16:12.887Z","modified":"2026-05-20T09:19:19.739357Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151401"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-204","slug":"pysec-2025-204-cdae47da","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55552","CVE-2025-55552"],"sourceIds":["PYSEC-2025-204"],"published":"2025-09-25T16:15:34.320Z","modified":"2026-05-20T09:19:19.802802Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147847"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-205","slug":"pysec-2025-205-fd5e58fd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55553","CVE-2025-55553"],"sourceIds":["PYSEC-2025-205"],"published":"2025-09-25T16:15:34.460Z","modified":"2026-05-20T09:19:19.866970Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151432"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/154645"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-206","slug":"pysec-2025-206-58322476","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55554","CVE-2025-55554"],"sourceIds":["PYSEC-2025-206"],"published":"2025-09-25T16:15:34.593Z","modified":"2026-05-20T09:19:19.928295Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151510"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-207","slug":"pysec-2025-207-2abef3fc","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55557","CVE-2025-55557"],"sourceIds":["PYSEC-2025-207"],"published":"2025-09-25T16:15:34.833Z","modified":"2026-05-20T09:19:19.989717Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151738"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151931"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-208","slug":"pysec-2025-208-6e93fe9d","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55558","CVE-2025-55558"],"sourceIds":["PYSEC-2025-208"],"published":"2025-09-25T16:15:34.960Z","modified":"2026-05-20T09:19:20.054109Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151523"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151887"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-209","slug":"pysec-2025-209-e6f352b0","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55560","CVE-2025-55560"],"sourceIds":["PYSEC-2025-209"],"published":"2025-09-25T16:15:35.197Z","modified":"2026-05-20T09:19:20.117285Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151522"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151897"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-211","slug":"pysec-2025-211-d8bd15de","dossier":false,"summary":null,"aliases":["CVE-2025-14920"],"sourceIds":["PYSEC-2025-211"],"published":"2025-12-23T21:15:47.183Z","modified":"2026-05-21T15:00:32.080516132Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1150/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-212","slug":"pysec-2025-212-a011b97d","dossier":false,"summary":null,"aliases":["CVE-2025-14921"],"sourceIds":["PYSEC-2025-212"],"published":"2025-12-23T21:15:47.340Z","modified":"2026-05-21T15:00:32.052313357Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1149/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-213","slug":"pysec-2025-213-9043dc9b","dossier":false,"summary":null,"aliases":["CVE-2025-14924"],"sourceIds":["PYSEC-2025-213"],"published":"2025-12-23T21:15:47.600Z","modified":"2026-05-21T15:00:32.048516839Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1141/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-214","slug":"pysec-2025-214-eb241255","dossier":false,"summary":null,"aliases":["CVE-2025-14926"],"sourceIds":["PYSEC-2025-214"],"published":"2025-12-23T21:15:47.857Z","modified":"2026-05-21T15:00:32.929011749Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-215","slug":"pysec-2025-215-6064f491","dossier":false,"summary":null,"aliases":["CVE-2025-14927"],"sourceIds":["PYSEC-2025-215"],"published":"2025-12-23T21:15:47.987Z","modified":"2026-05-21T15:00:32.888290877Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-216","slug":"pysec-2025-216-5708ed01","dossier":false,"summary":null,"aliases":["CVE-2025-14928"],"sourceIds":["PYSEC-2025-216"],"published":"2025-12-23T21:15:48.110Z","modified":"2026-05-21T15:00:32.939311939Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-217","slug":"pysec-2025-217-2c1ad388","dossier":false,"summary":null,"aliases":["CVE-2025-14929"],"sourceIds":["PYSEC-2025-217"],"published":"2025-12-23T21:15:48.240Z","modified":"2026-05-21T15:00:24.271970226Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1144/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"PYSEC-2025-218","slug":"pysec-2025-218-39811fc3","dossier":false,"summary":null,"aliases":["CVE-2025-14930"],"sourceIds":["PYSEC-2025-218"],"published":"2025-12-23T21:15:48.367Z","modified":"2026-05-21T15:00:33.791364554Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2026-139","slug":"pysec-2026-139-96951ff6","dossier":false,"summary":null,"aliases":["BIT-pytorch-2026-4538","CVE-2026-4538"],"sourceIds":["PYSEC-2026-139"],"published":"2026-03-22T05:16:20.273Z","modified":"2026-05-21T15:00:31.962442644Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/"},{"type":"ADVISORY","url":"https://vuldb.com/?id.352326"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.774681"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.352326"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/176791"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":14},{"id":"PYSEC-2026-2132","slug":"pysec-2026-2132-627bf7c7","dossier":true,"summary":null,"aliases":["CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"sourceIds":["PYSEC-2026-2132"],"published":"2026-04-30T14:16:36.433Z","modified":"2026-07-13T07:15:21.899333658Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}],"versionKeys":["pypi:click@8.1.7","pypi:click@8.1.8","pypi:click@8.2.0","pypi:click@8.2.1","pypi:click@8.3.0","pypi:click@8.3.1"],"packageCount":1,"repositoryCount":17},{"id":"PYSEC-2026-2286","slug":"pysec-2026-2286-8795b007","dossier":false,"summary":null,"aliases":["BIT-pytorch-2026-24747","CVE-2026-24747","GHSA-63cw-57p8-fm3p","PYSEC-2026-1856"],"sourceIds":["PYSEC-2026-2286"],"published":"2026-01-27T22:15:56.470Z","modified":"2026-07-13T07:26:23.701611780Z","checkedAt":"2026-09-16T04:45:26.395Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-24747"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/releases/tag/v2.10.0"},{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433612"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/163105"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu"],"packageCount":1,"repositoryCount":13}]}}