{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-11-12T08:58:58.139Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-11-12T08:57:16.613Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.29.0","releaseDate":"2026-09-16T00:00:00Z"}},"coverage":{"repositoryCount":49,"completeTreeCount":48,"incompleteTreeCount":1,"lockfileRepositoryCount":29,"sbomRepositoryCount":6,"artifactRepositoryCount":33,"resolvedRepositoryCount":45,"resolvedArtifactRepositoryCount":33,"dependencyFileCount":47,"parsedFileCount":46,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":5071,"metadataResolvedCount":5059,"metadataNotFoundCount":12,"osvEvaluatedVersionCount":5071,"codeRadarRepositoryCount":49},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":8000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":49,"packageCount":2865,"aiPackageCount":51,"resolvedComponentCount":9911,"resolvedVersionCount":5071,"providerExposureRepositoryCount":12,"licenseExpressionCount":63,"knownLicensePackageCount":2827,"unknownLicensePackageCount":38,"advisoryCount":1097,"matchedAdvisoryRepositoryCount":43,"topPackage":{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","label":"typing-extensions","repositoryCount":29,"repositoryShare":0.5918367346938775}},"kind":"repository","entity":{"id":"opencode:11332","slug":"opencode-11332","gitlabProjectId":11332,"name":"sprachbuchung-erzmobil","pathWithNamespace":"erzmobil/ai-voicebot/sprachbuchung-erzmobil","description":null,"webUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","commitUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/commit/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","lastActivityAt":"2026-10-27T12:05:13.998Z","headCommittedAt":"2026-10-27T12:05:12.000Z","tree":{"complete":true,"entryCount":490,"truncated":false},"files":[{"path":"dashboard/package-lock.json","kind":"npm-lock","blobSha":"3953686d66a918f77e6a34d09ae6bbdc69d186b2","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/dashboard/package-lock.json","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"b6bb9f6359bbea5da66f8bbd840794270f5e5e08a6099742a59d53ef3494aeca","byteCount":419338,"state":"parsed","componentCount":759},{"path":"sbom.cdx.json","kind":"cyclonedx-json","blobSha":"3349aa5ad7f9ceb0d1bae546f292be001343662a","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/sbom.cdx.json","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"75dcc620214a3fcc98f4e8798b8b4f9d9db47c47c4da5074833e4dddddef01b0","byteCount":266969,"state":"parsed","componentCount":781},{"path":"uv.lock","kind":"uv-lock","blobSha":"d586704dfa97d255af772ed32d3278fe3ecd5c3b","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/uv.lock","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"3756746b4a4032cb0c77482692f2914d91928e9d92d8fc835b28e466623b7d1e","byteCount":488931,"state":"parsed","componentCount":206}],"resolvedComponentCount":1746,"artifactResolvedComponentCount":1746,"exactManifestPinCount":0,"packageCount":927,"ecosystems":["npm","pypi"],"aiPackageCount":1,"licenseExpressionCount":33,"unknownLicensePackageCount":1,"advisoryIds":["GHSA-22hg-r758-rrw9","GHSA-239g-whfq-7xj9","GHSA-23c5-xmqv-rm74","GHSA-23mf-xhv8-69c2","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-25h7-pfq9-p65f","GHSA-27h8-gf7j-v5hc","GHSA-27r3-jxmh-p828","GHSA-284h-m62q-gf8w","GHSA-2883-xcg3-v3hh","GHSA-28wg-ghj8-5hjv","GHSA-2c2j-9gv5-cj73","GHSA-2f96-g7mh-g2hx","GHSA-2fqr-mr3j-6wp8","GHSA-2g4f-4pwh-qvx6","GHSA-2g87-pp6c-29x5","GHSA-2gqq-gqf2-x968","GHSA-2gx3-rcp4-g85q","GHSA-2h4p-vjrc-8xpq","GHSA-2jfj-6hjv-fm6j","GHSA-2m5v-pch6-74hx","GHSA-2mjp-6q6p-2qxm","GHSA-2qfp-q593-8484","GHSA-2v37-7h3g-55p8","GHSA-2vrm-gr82-f7m5","GHSA-2wc2-fm75-p42x","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-333x-w4r6-6crp","GHSA-35jp-ww65-95wh","GHSA-35p6-xmwp-9g52","GHSA-37ch-88jc-xwx2","GHSA-38jv-5279-wg99","GHSA-394h-qwmc-48pf","GHSA-3f7w-8rr8-f37f","GHSA-3g43-6gmg-66jw","GHSA-3j72-p6qg-6xp7","GHSA-3jxr-9vmj-r5cp","GHSA-3p68-rc4w-qgx5","GHSA-3ppc-4f35-3m26","GHSA-3pq3-5fj3-cg6v","GHSA-3rp5-jjmw-4wv2","GHSA-3v7f-55p6-f55p","GHSA-3w6x-2g7m-8v23","GHSA-3wq7-rqq7-wx6j","GHSA-3wxw-xv34-2frg","GHSA-3xpg-4rpp-hhhm","GHSA-42h9-826w-cgv3","GHSA-42vr-xj54-vc7v","GHSA-43fc-jf86-j433","GHSA-43mp-35q3-x3fq","GHSA-445q-vr5w-6q77","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-494j-54xm-rwp3","GHSA-494p-63j8-28p3","GHSA-4992-7rv2-5pvq","GHSA-4cwx-7wf7-3272","GHSA-4fh9-h7wg-q85m","GHSA-4fvr-rgm6-gqmc","GHSA-4gmw-gg2m-w46p","GHSA-4hjh-wcwx-xvwj","GHSA-4hqw-qxg8-jxx2","GHSA-4m7w-qmgq-4wj5","GHSA-4mjr-xmp4-gh2g","GHSA-4qv8-2p9j-2685","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7w-5xrc-9h26","GHSA-4w7w-66w2-5vf9","GHSA-4x4j-2g7c-83w6","GHSA-4x5r-pxfx-6jf8","GHSA-4xgf-cpjx-pc3j","GHSA-5239-wwwm-4pmq","GHSA-52cp-r559-cp3m","GHSA-537c-gmf6-5ccf","GHSA-539m-9xh6-q6rr","GHSA-542g-h47m-68v8","GHSA-54jq-c3m8-4m76","GHSA-54p9-h82j-f925","GHSA-558c-9hv2-4prj","GHSA-55wc-3pg8-jfw6","GHSA-5639-2j2p-m4mx","GHSA-567q-5qvw-pf92","GHSA-587h-7wmj-h5pm","GHSA-58r4-6rv3-gfh8","GHSA-597g-3phw-6986","GHSA-59cr-6r3x-644w","GHSA-59g5-xgcq-4qw3","GHSA-5c9x-8gcm-mpgx","GHSA-5h93-6whr-6q8j","GHSA-5p39-cfhj-2xmp","GHSA-5p4m-2wfm-xmqj","GHSA-5rvq-cxj2-64vf","GHSA-5vjq-rrrf-7h2q","GHSA-5wmx-573v-2qwq","GHSA-5wr8-gcqf-gqf3","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62hf-57xw-28j9","GHSA-62p4-gmf7-7g93","GHSA-62q4-447f-wv8h","GHSA-63hf-3vf5-4wqf","GHSA-63hw-fmq6-xxg2","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-68fv-2mgg-jv7q","GHSA-698v-4r3x-3vcv","GHSA-69f9-5gxw-wvc2","GHSA-69hj-f68j-2879","GHSA-6chq-wfr3-2hj9","GHSA-6cjc-53gc-5rqm","GHSA-6g55-p6wh-862q","GHSA-6hr6-w5qg-qmwg","GHSA-6j4f-fj2g-mc7p","GHSA-6jhg-hg63-jvvf","GHSA-6jv3-5f52-599m","GHSA-6mq8-rvhq-8wgg","GHSA-6p8h-3wgx-97gf","GHSA-6pq8-jhm2-2vcw","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rw7-vpxm-498p","GHSA-6w3r-xr62-4xcp","GHSA-6w46-j5rx-g56g","GHSA-73rr-hh4g-fpgx","GHSA-73wf-gq98-2v4g","GHSA-74r2-7ff9-mjj2","GHSA-752w-5fwx-jx9f","GHSA-7545-fcxq-7j24","GHSA-768j-98cg-p3fv","GHSA-777c-7fjr-54vf","GHSA-7833-fr7j-v32q","GHSA-78g4-xqwv-q3g8","GHSA-79v4-65xg-pq4g","GHSA-7f5h-v6xp-fcq8","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-7q8q-rj6j-mhjq","GHSA-7r86-cg39-jmmj","GHSA-7rv5-mrxv-xcr9","GHSA-82r6-8w77-94w6","GHSA-82w8-qh3p-5jfq","GHSA-836r-79rf-4m37","GHSA-83vg-56qc-22m7","GHSA-8436-99hf-9mmv","GHSA-847f-9342-265h","GHSA-84m7-p3x7-pcfv","GHSA-86qp-5c8j-p5mr","GHSA-8988-9cw3-xx77","GHSA-898c-q2cr-xwhg","GHSA-8g5g-8vmr-9782","GHSA-8mcc-hrx5-hvxc","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8rjx-v5ww-45pp","GHSA-8v84-f9pq-wr9x","GHSA-8v8h-hg4w-mvq2","GHSA-8wjv-2p76-3863","GHSA-8xcm-r25x-g524","GHSA-93m4-6634-74q7","GHSA-94p4-4cq8-9g67","GHSA-94p9-xgh2-xp45","GHSA-9548-qrrj-x5pj","GHSA-956x-8gvw-wg5v","GHSA-966j-vmvw-g2g9","GHSA-97r2-qh9m-474h","GHSA-983w-rhvv-gwmv","GHSA-993g-76c3-p5m4","GHSA-9fm3-97px-rjf6","GHSA-9fr6-4gfg-395g","GHSA-9h52-p55h-vw2f","GHSA-9h9j-4vrj-gf7g","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9j54-fg26-wv3r","GHSA-9jrq-w75r-8gcw","GHSA-9rj7-rf2p-w77r","GHSA-9v7f-9g4p-ffgj","GHSA-9v8h-qqgm-4m35","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-9wx9-5pv9-3349","GHSA-9x8q-7h8h-wcw9","GHSA-9xw5-w5jj-pvcg","GHSA-9xwg-3r6f-jcx2","GHSA-c2c7-rcm5-vvqj","GHSA-c427-h43c-vf67","GHSA-c6hw-5grf-ff96","GHSA-c83g-rgw3-j3cx","GHSA-c947-3pg5-gm8q","GHSA-c978-59m8-c77v","GHSA-cfh3-3jmp-rvhc","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cq5v-8q36-5273","GHSA-cw65-gx24-rc82","GHSA-cwqr-hh33-gh44","GHSA-cx28-75q4-x26q","GHSA-f269-vfmq-vjvj","GHSA-f2g6-542v-9j58","GHSA-f72v-6w45-q472","GHSA-f86p-h4j2-7qgj","GHSA-f886-m6hf-6m8v","GHSA-f96h-pmfr-66vw","GHSA-f9j4-qggq-h239","GHSA-f9xw-jh8m-3mwq","GHSA-fc2g-4w5p-6whm","GHSA-fc9g-5qg7-mf45","GHSA-ffc3-869f-jxw9","GHSA-fh55-r93g-j68g","GHSA-fhv5-28vv-h8m8","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fq56-3cx3-fjxp","GHSA-fvcv-3m26-pcqx","GHSA-fx2h-pf6j-xcff","GHSA-fx3j-rwgx-fr94","GHSA-fxqj-rqcc-2cmp","GHSA-g3cq-j2xw-wf74","GHSA-g3hv-75wg-m249","GHSA-g4jq-h2w9-997c","GHSA-g4qv-2jxx-769h","GHSA-g5vv-9gxw-82hx","GHSA-g6cj-pr64-35w5","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-g84x-mcqj-x9qq","GHSA-g8m3-5g58-fq7m","GHSA-g9mf-h72j-4rw9","GHSA-gc5v-m9x4-r6x2","GHSA-gcqx-w48m-w2h4","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gjv8-xp57-g29c","GHSA-gm37-52c6-37mw","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gq48-pqfc-9p58","GHSA-gvp8-978c-rx2q","GHSA-gx76-c99x-2c96","GHSA-h4gh-qq45-vh27","GHSA-h67p-54hq-rp68","GHSA-h75v-3vvj-5mfj","GHSA-hcc4-c3v8-rx92","GHSA-hfxv-24rg-xrqf","GHSA-hg6j-4rv6-33pg","GHSA-hh9p-6wh2-4mfc","GHSA-hhxq-47xx-j5xx","GHSA-hmq2-w58f-27jc","GHSA-hmw2-7cc7-3qxx","GHSA-hpj7-wq8m-9hgp","GHSA-hxm8-2xgr-2p9m","GHSA-j4m9-6w36-pw47","GHSA-j5f8-grm9-p9fc","GHSA-j8f7-rjxc-mr56","GHSA-j8rh-479h-cp32","GHSA-j934-xhv5-fg8f","GHSA-jf6q-chmf-3h3v","GHSA-jg22-mg44-37j8","GHSA-jg86-v3jv-hrpm","GHSA-jhhc-3hcp-qhm5","GHSA-jj3x-wxrx-4x23","GHSA-jjj6-mw9f-p565","GHSA-jm66-cg57-jjv5","GHSA-jm78-9fvv-mhgr","GHSA-jp82-jpqv-5vv3","GHSA-jpw9-pfvf-9f58","GHSA-jq35-7prp-9v3f","GHSA-jqcg-44mw-7w3h","GHSA-jqfw-vq24-v9c3","GHSA-jqh4-m9w3-8hp9","GHSA-jr45-8vmc-qm54","GHSA-jwrc-g2q2-pq5p","GHSA-jwv3-5hgf-82ww","GHSA-m2h6-j472-rp4c","GHSA-m5qp-6w8w-w647","GHSA-m64x-33q8-m5h7","GHSA-m6qw-4cw2-hm4m","GHSA-m7pr-hjqh-92cm","GHSA-m8rv-5g2x-5cg5","GHSA-m959-cc7f-wv43","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mfx4-hv73-q22v","GHSA-mh29-5h37-fv8m","GHSA-mh99-v99m-4gvg","GHSA-mj87-hwqh-73pj","GHSA-mmx7-hfxf-jppx","GHSA-mq44-7p77-q5h7","GHSA-mqqc-3gqh-h2x8","GHSA-mrfp-p49p-3hf2","GHSA-mrhx-c7xc-m3w5","GHSA-mrwp-f3q8-3g9p","GHSA-mv93-w799-cj2w","GHSA-mwf2-3pr3-8698","GHSA-mwh4-6h8g-pg8w","GHSA-p423-j2cm-9vmq","GHSA-p498-v437-472g","GHSA-p4g4-x82p-q773","GHSA-p4wg-p73j-c528","GHSA-p538-c434-8v24","GHSA-p58f-9548-mpm2","GHSA-p88m-4jfj-68fv","GHSA-p8hx-v2p6-rp84","GHSA-p92q-9vqr-4j8v","GHSA-p998-jp59-783m","GHSA-p9ff-h696-f583","GHSA-pchr-8j38-3x4p","GHSA-pf86-5x62-jrwf","GHSA-pg7v-jwj7-p798","GHSA-phc3-fgpg-7m6h","GHSA-phj9-mv4w-65pm","GHSA-pmjh-fq2x-6v4x","GHSA-pmv8-rq9r-6j72","GHSA-pmwg-cvhr-8vh7","GHSA-pp6c-gr5w-3c5g","GHSA-pq67-6m6q-mj2v","GHSA-pqxq-w44r-73xw","GHSA-pr7r-676h-xcf6","GHSA-pwv6-vv43-88gr","GHSA-pxh4-856f-4h89","GHSA-q2hr-2g5m-vwhr","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-q8mj-m7cp-5q26","GHSA-q8qp-cvcw-x6jj","GHSA-qccp-gfcp-xxvc","GHSA-qhr7-859c-m2p7","GHSA-qmgc-5h2g-mvrw","GHSA-qmx5-4p3x-wvqf","GHSA-qrxm-fqhp-jwvm","GHSA-qx2v-qp2m-jg93","GHSA-r28c-9q8g-f849","GHSA-r4q5-vmmm-2653","GHSA-r53p-7pc4-xj5r","GHSA-r543-q48m-4c9j","GHSA-r6ph-v2qm-q3c2","GHSA-r6x4-923q-g947","GHSA-r73j-pqj5-w3x7","GHSA-r825-w8mm-5pxw","GHSA-r9mr-m37c-5fr3","GHSA-rf6f-7fwh-wjgh","GHSA-rfgq-q3w2-pmv2","GHSA-rfgv-xxqx-mfg5","GHSA-rfpc-qcw5-3pc4","GHSA-rgw5-rvv9-x895","GHSA-rmxm-3fg6-px4f","GHSA-rpm5-65cw-6hj4","GHSA-rq7h-c2jc-7f22","GHSA-rwj8-pgh3-r573","GHSA-rwrf-2pqf-9j8j","GHSA-rx4f-c7p8-82vq","GHSA-rxp7-6hxx-x8q5","GHSA-v3r7-h72x-cjcm","GHSA-v422-hmwv-36x6","GHSA-v4x8-3wr5-3wq8","GHSA-v6wh-96g9-6wx3","GHSA-v87r-6q3f-2j67","GHSA-v92g-xgxw-vvmm","GHSA-v9p9-hfj2-hcw8","GHSA-v9pg-7xvm-68hf","GHSA-v9pv-5gc8-w2m6","GHSA-vf2m-468p-8v99","GHSA-vffw-93wf-4j4q","GHSA-vh66-26gq-q6x8","GHSA-vj7q-gjh5-988w","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vrm6-8vpv-qv8q","GHSA-vx6w-vv9f-6gvg","GHSA-vxj4-q4g9-crj7","GHSA-vxpw-j846-p89q","GHSA-vxq7-64xx-v4gw","GHSA-w2cx-738m-mc7w","GHSA-w2fm-2cpv-w7v5","GHSA-w4fh-qvv9-3v23","GHSA-w6j9-cwv2-h6wq","GHSA-w74x-v6f9-j3xg","GHSA-w7fw-mjwx-w883","GHSA-w7vc-732c-9m39","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-w8jc-g24h-crhw","GHSA-w9j2-pvgh-6h63","GHSA-whj4-6x5x-4v2j","GHSA-wjr9-j795-jxcr","GHSA-wjx4-4jcj-g98j","GHSA-wp53-j4wj-2cfg","GHSA-wp97-x4hv-qvhp","GHSA-wqp7-x3pw-xc5r","GHSA-wvpp-8hx9-p66j","GHSA-x2qx-6953-8485","GHSA-x33g-cr3x-6449","GHSA-x746-7m8f-x49c","GHSA-x78j-v8h9-3j2q","GHSA-xcgm-r5h9-7989","GHSA-xcq7-p3pf-p88h","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xgmm-8j9v-c9wx","GHSA-xhjh-pmcv-23jw","GHSA-xhq7-xmqj-769h","GHSA-xj96-63gp-2gmr","GHSA-xjj6-f33q-929c","GHSA-xvh5-g6gv-559v","GHSA-xwg4-73v4-xw9w","GHSA-xx6v-rp6x-q39c","PYSEC-2025-183"],"advisoryCount":419,"providers":[{"id":"openai","label":"OpenAI"}]},"evidence":{"files":[{"path":"dashboard/package-lock.json","kind":"npm-lock","blobSha":"3953686d66a918f77e6a34d09ae6bbdc69d186b2","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/dashboard/package-lock.json","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"b6bb9f6359bbea5da66f8bbd840794270f5e5e08a6099742a59d53ef3494aeca","byteCount":419338,"state":"parsed","componentCount":759},{"path":"sbom.cdx.json","kind":"cyclonedx-json","blobSha":"3349aa5ad7f9ceb0d1bae546f292be001343662a","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/sbom.cdx.json","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"75dcc620214a3fcc98f4e8798b8b4f9d9db47c47c4da5074833e4dddddef01b0","byteCount":266969,"state":"parsed","componentCount":781},{"path":"uv.lock","kind":"uv-lock","blobSha":"d586704dfa97d255af772ed32d3278fe3ecd5c3b","sourceUrl":"https://gitlab.opencode.de/erzmobil/ai-voicebot/sprachbuchung-erzmobil/-/blob/b89e10e2d7dc3fe7766c171353dd4e15df8f3e07/uv.lock","commitSha":"b89e10e2d7dc3fe7766c171353dd4e15df8f3e07","contentSha256":"3756746b4a4032cb0c77482692f2914d91928e9d92d8fc835b28e466623b7d1e","byteCount":488931,"state":"parsed","componentCount":206}],"occurrenceCount":1746},"related":{"packages":[{"id":"package:pypi:openai","slug":"openai-0dd26ac5","identity":"pypi:openai","label":"OpenAI SDK","aiRelevant":true,"provider":{"id":"openai","label":"OpenAI"},"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.54.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pillow","slug":"pillow-834347dd","identity":"pypi:pillow","label":"pillow","aiRelevant":false,"provider":null,"advisoryCount":61,"licenseExpressions":["HPND","MIT-CMU"],"versions":["13.0.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiohttp","slug":"aiohttp-5a806a63","identity":"pypi:aiohttp","label":"aiohttp","aiRelevant":false,"provider":null,"advisoryCount":41,"licenseExpressions":["Apache-2.0","Apache-2.0 AND MIT"],"versions":["3.14.5"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:gitpython","slug":"gitpython-dcd13009","identity":"pypi:gitpython","label":"gitpython","aiRelevant":false,"provider":null,"advisoryCount":37,"licenseExpressions":["BSD-3-Clause"],"versions":["3.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:axios","slug":"axios-9a6bcef0","identity":"npm:axios","label":"axios","aiRelevant":false,"provider":null,"advisoryCount":36,"licenseExpressions":["MIT"],"versions":["1.20.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:undici","slug":"undici-9dcd4f20","identity":"npm:undici","label":"undici","aiRelevant":false,"provider":null,"advisoryCount":33,"licenseExpressions":["MIT"],"versions":["7.29.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:pyjwt","slug":"pyjwt-b1ea166e","identity":"pypi:pyjwt","label":"pyjwt","aiRelevant":false,"provider":null,"advisoryCount":22,"licenseExpressions":["MIT"],"versions":["2.15.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:virtualenv","slug":"virtualenv-aeb2a546","identity":"pypi:virtualenv","label":"virtualenv","aiRelevant":false,"provider":null,"advisoryCount":20,"licenseExpressions":["MIT"],"versions":["21.14.13"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:vite","slug":"vite-d48e852f","identity":"npm:vite","label":"vite","aiRelevant":false,"provider":null,"advisoryCount":12,"licenseExpressions":["MIT"],"versions":["8.3.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:filelock","slug":"filelock-b1c63968","identity":"pypi:filelock","label":"filelock","aiRelevant":false,"provider":null,"advisoryCount":11,"licenseExpressions":["MIT","Unlicense"],"versions":["4.2.4"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:urllib3","slug":"urllib3-fa68f32c","identity":"pypi:urllib3","label":"urllib3","aiRelevant":false,"provider":null,"advisoryCount":10,"licenseExpressions":["MIT"],"versions":["2.8.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:cryptography","slug":"cryptography-de36c9c8","identity":"pypi:cryptography","label":"cryptography","aiRelevant":false,"provider":null,"advisoryCount":9,"licenseExpressions":["Apache-2.0 OR BSD-3-Clause"],"versions":["50.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:python-multipart","slug":"python-multipart-7d2a810e","identity":"pypi:python-multipart","label":"python-multipart","aiRelevant":false,"provider":null,"advisoryCount":8,"licenseExpressions":["Apache-2.0"],"versions":["0.0.32"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:starlette","slug":"starlette-beb9e527","identity":"pypi:starlette","label":"starlette","aiRelevant":false,"provider":null,"advisoryCount":8,"licenseExpressions":["BSD-3-Clause"],"versions":["1.9.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:brace-expansion","slug":"brace-expansion-b42dfb29","identity":"npm:brace-expansion","label":"brace-expansion","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["MIT"],"versions":["5.0.12"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:mcp","slug":"mcp-ef053766","identity":"pypi:mcp","label":"mcp","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["MIT"],"versions":["1.30.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:js-yaml","slug":"js-yaml-a53d8d92","identity":"npm:js-yaml","label":"js-yaml","aiRelevant":false,"provider":null,"advisoryCount":5,"licenseExpressions":["MIT"],"versions":["4.3.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:qs","slug":"qs-d2ee785a","identity":"npm:qs","label":"qs","aiRelevant":false,"provider":null,"advisoryCount":5,"licenseExpressions":["BSD-3-Clause"],"versions":["6.16.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:seroval","slug":"seroval-dd986b83","identity":"npm:seroval","label":"seroval","aiRelevant":false,"provider":null,"advisoryCount":5,"licenseExpressions":["MIT"],"versions":["1.6.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fast-uri","slug":"fast-uri-130fc36a","identity":"npm:fast-uri","label":"fast-uri","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BSD-3-Clause"],"versions":["3.1.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:jinja2","slug":"jinja2-f7d34747","identity":"pypi:jinja2","label":"jinja2","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.6"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:minimatch","slug":"minimatch-91a6ff84","identity":"npm:minimatch","label":"minimatch","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BlueOak-1.0.0","ISC"],"versions":["10.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:postcss","slug":"postcss-6e1650ce","identity":"npm:postcss","label":"postcss","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["MIT"],"versions":["8.5.31"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:soupsieve","slug":"soupsieve-91552d8b","identity":"pypi:soupsieve","label":"soupsieve","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["MIT"],"versions":["3.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:weasyprint","slug":"weasyprint-637c63f5","identity":"pypi:weasyprint","label":"weasyprint","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["non-standard"],"versions":["70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mako","slug":"mako-ed406373","identity":"pypi:mako","label":"mako","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["1.4.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:nanoid","slug":"nanoid-93076b34","identity":"npm:nanoid","label":"nanoid","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["3.3.20"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:pymdown-extensions","slug":"pymdown-extensions-74c5b54c","identity":"pypi:pymdown-extensions","label":"pymdown-extensions","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["12.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:requests","slug":"requests-53653f76","identity":"pypi:requests","label":"requests","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["Apache-2.0"],"versions":["2.34.2"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:anyio","slug":"anyio-399e5280","identity":"pypi:anyio","label":"anyio","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["4.15.1"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:body-parser","slug":"body-parser-5bf85abf","identity":"npm:body-parser","label":"body-parser","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["2.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:brotli","slug":"brotli-9f215eb0","identity":"pypi:brotli","label":"brotli","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:browserslist","slug":"browserslist-09335db7","identity":"npm:browserslist","label":"browserslist","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["4.29.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:certifi","slug":"certifi-d4f0c37e","identity":"pypi:certifi","label":"certifi","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MPL-2.0"],"versions":["2026.10.19"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:flatted","slug":"flatted-bf8d419e","identity":"npm:flatted","label":"flatted","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["ISC"],"versions":["3.4.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:follow-redirects","slug":"follow-redirects-d49b3d60","identity":"npm:follow-redirects","label":"follow-redirects","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["1.16.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:h2","slug":"h2-d3161986","identity":"pypi:h2","label":"h2","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["4.4.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:picomatch","slug":"picomatch-a3008e9b","identity":"npm:picomatch","label":"picomatch","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["2.3.2","4.0.7"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:protobuf","slug":"protobuf-6e30009a","identity":"pypi:protobuf","label":"protobuf","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["BSD-3-Clause"],"versions":["6.33.6"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:@babel/core","slug":"babel-core-632b3ee7","identity":"npm:@babel/core","label":"@babel/core","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@hono/node-server","slug":"hono-node-server-b6d77065","identity":"npm:@hono/node-server","label":"@hono/node-server","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["1.19.17"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@humanfs/node","slug":"humanfs-node-63ca4f78","identity":"npm:@humanfs/node","label":"@humanfs/node","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["0.16.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:ajv","slug":"ajv-dd73454f","identity":"npm:ajv","label":"ajv","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["6.15.0","8.20.0"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:azure-core","slug":"azure-core-999f329c","identity":"pypi:azure-core","label":"azure-core","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["1.41.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:brotlicffi","slug":"brotlicffi-2b85a746","identity":"pypi:brotlicffi","label":"brotlicffi","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["1.2.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:deepmerge","slug":"deepmerge-33ca4e59","identity":"npm:deepmerge","label":"deepmerge","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:diff","slug":"diff-c3901306","identity":"npm:diff","label":"diff","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["8.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:fonttools","slug":"fonttools-d2488ea8","identity":"pypi:fonttools","label":"fonttools","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.67.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:form-data","slug":"form-data-19f364b7","identity":"npm:form-data","label":"form-data","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.0.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:h11","slug":"h11-48165ab1","identity":"pypi:h11","label":"h11","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["0.16.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:hpack","slug":"hpack-ae99dcfa","identity":"pypi:hpack","label":"hpack","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:idna","slug":"idna-994c9929","identity":"pypi:idna","label":"idna","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.20"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:ip-address","slug":"ip-address-06addbf3","identity":"npm:ip-address","label":"ip-address","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["10.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:markdown","slug":"markdown-80f66882","identity":"pypi:markdown","label":"markdown","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["3.11.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:mdast-util-to-hast","slug":"mdast-util-to-hast-18f18478","identity":"npm:mdast-util-to-hast","label":"mdast-util-to-hast","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["13.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:multidict","slug":"multidict-b407a4ac","identity":"pypi:multidict","label":"multidict","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["7.1.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-api","slug":"opentelemetry-api-341bc8f7","identity":"pypi:opentelemetry-api","label":"opentelemetry-api","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["1.45.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:path-to-regexp","slug":"path-to-regexp-7c531171","identity":"npm:path-to-regexp","label":"path-to-regexp","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["8.4.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:proxy-addr","slug":"proxy-addr-70423975","identity":"npm:proxy-addr","label":"proxy-addr","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["2.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:pydantic-settings","slug":"pydantic-settings-d677745f","identity":"pypi:pydantic-settings","label":"pydantic-settings","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["2.16.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pygments","slug":"pygments-ad71bc11","identity":"pypi:pygments","label":"pygments","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-2-Clause"],"versions":["2.21.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytest","slug":"pytest-07c6f86c","identity":"pypi:pytest","label":"pytest","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["9.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-dotenv","slug":"python-dotenv-27b12285","identity":"pypi:python-dotenv","label":"python-dotenv","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["1.2.4"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:source-map-js","slug":"source-map-js-41a605c1","identity":"npm:source-map-js","label":"source-map-js","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["1.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:tqdm","slug":"tqdm-04b01f90","identity":"pypi:tqdm","label":"tqdm","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT AND MPL-2.0"],"versions":["4.70.1"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:zod","slug":"zod-5dbeeafb","identity":"npm:zod","label":"zod","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["3.25.76","4.6.5"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/code-frame","slug":"babel-code-frame-d957c518","identity":"npm:@babel/code-frame","label":"@babel/code-frame","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/compat-data","slug":"babel-compat-data-a62084ad","identity":"npm:@babel/compat-data","label":"@babel/compat-data","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/generator","slug":"babel-generator-ccac1203","identity":"npm:@babel/generator","label":"@babel/generator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-annotate-as-pure","slug":"babel-helper-annotate-as-pure-87c36399","identity":"npm:@babel/helper-annotate-as-pure","label":"@babel/helper-annotate-as-pure","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.27.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-compilation-targets","slug":"babel-helper-compilation-targets-87d93937","identity":"npm:@babel/helper-compilation-targets","label":"@babel/helper-compilation-targets","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-create-class-features-plugin","slug":"babel-helper-create-class-features-plugin-77ddeb9a","identity":"npm:@babel/helper-create-class-features-plugin","label":"@babel/helper-create-class-features-plugin","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-globals","slug":"babel-helper-globals-0e9ab9db","identity":"npm:@babel/helper-globals","label":"@babel/helper-globals","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-member-expression-to-functions","slug":"babel-helper-member-expression-to-functions-334410bf","identity":"npm:@babel/helper-member-expression-to-functions","label":"@babel/helper-member-expression-to-functions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-module-imports","slug":"babel-helper-module-imports-dbfc0776","identity":"npm:@babel/helper-module-imports","label":"@babel/helper-module-imports","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-module-transforms","slug":"babel-helper-module-transforms-fea089b3","identity":"npm:@babel/helper-module-transforms","label":"@babel/helper-module-transforms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-optimise-call-expression","slug":"babel-helper-optimise-call-expression-e02554f6","identity":"npm:@babel/helper-optimise-call-expression","label":"@babel/helper-optimise-call-expression","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.27.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-plugin-utils","slug":"babel-helper-plugin-utils-a27c98fa","identity":"npm:@babel/helper-plugin-utils","label":"@babel/helper-plugin-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-replace-supers","slug":"babel-helper-replace-supers-aaf10973","identity":"npm:@babel/helper-replace-supers","label":"@babel/helper-replace-supers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-skip-transparent-expression-wrappers","slug":"babel-helper-skip-transparent-expression-wrappers-71673859","identity":"npm:@babel/helper-skip-transparent-expression-wrappers","label":"@babel/helper-skip-transparent-expression-wrappers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.27.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-string-parser","slug":"babel-helper-string-parser-50d29bcc","identity":"npm:@babel/helper-string-parser","label":"@babel/helper-string-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-validator-identifier","slug":"babel-helper-validator-identifier-b255380b","identity":"npm:@babel/helper-validator-identifier","label":"@babel/helper-validator-identifier","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helper-validator-option","slug":"babel-helper-validator-option-ff70c556","identity":"npm:@babel/helper-validator-option","label":"@babel/helper-validator-option","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/helpers","slug":"babel-helpers-14903e70","identity":"npm:@babel/helpers","label":"@babel/helpers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/parser","slug":"babel-parser-90a7ae44","identity":"npm:@babel/parser","label":"@babel/parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/plugin-syntax-jsx","slug":"babel-plugin-syntax-jsx-1e3853b7","identity":"npm:@babel/plugin-syntax-jsx","label":"@babel/plugin-syntax-jsx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/plugin-syntax-typescript","slug":"babel-plugin-syntax-typescript-86970e37","identity":"npm:@babel/plugin-syntax-typescript","label":"@babel/plugin-syntax-typescript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/plugin-transform-modules-commonjs","slug":"babel-plugin-transform-modules-commonjs-d191b1c2","identity":"npm:@babel/plugin-transform-modules-commonjs","label":"@babel/plugin-transform-modules-commonjs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/plugin-transform-typescript","slug":"babel-plugin-transform-typescript-ebf16b34","identity":"npm:@babel/plugin-transform-typescript","label":"@babel/plugin-transform-typescript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/preset-typescript","slug":"babel-preset-typescript-f4f3124b","identity":"npm:@babel/preset-typescript","label":"@babel/preset-typescript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.28.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/runtime","slug":"babel-runtime-2e1b7c1b","identity":"npm:@babel/runtime","label":"@babel/runtime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/template","slug":"babel-template-1de2b79c","identity":"npm:@babel/template","label":"@babel/template","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/traverse","slug":"babel-traverse-7876b2c3","identity":"npm:@babel/traverse","label":"@babel/traverse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@babel/types","slug":"babel-types-7b046801","identity":"npm:@babel/types","label":"@babel/types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.29.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@base-ui/react","slug":"base-ui-react-07009e5c","identity":"npm:@base-ui/react","label":"@base-ui/react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@base-ui/utils","slug":"base-ui-utils-3afb3ca8","identity":"npm:@base-ui/utils","label":"@base-ui/utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@cacheable/memory","slug":"cacheable-memory-e2aaab13","identity":"npm:@cacheable/memory","label":"@cacheable/memory","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@cacheable/utils","slug":"cacheable-utils-6145ea41","identity":"npm:@cacheable/utils","label":"@cacheable/utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@date-fns/tz","slug":"date-fns-tz-f32b7dd3","identity":"npm:@date-fns/tz","label":"@date-fns/tz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@dotenvx/dotenvx","slug":"dotenvx-dotenvx-447509bb","identity":"npm:@dotenvx/dotenvx","label":"@dotenvx/dotenvx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.64.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@ecies/ciphers","slug":"ecies-ciphers-e7b00c68","identity":"npm:@ecies/ciphers","label":"@ecies/ciphers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@emnapi/core","slug":"emnapi-core-3406767f","identity":"npm:@emnapi/core","label":"@emnapi/core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.11.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json"]},{"id":"package:npm:@emnapi/runtime","slug":"emnapi-runtime-9e20d99c","identity":"npm:@emnapi/runtime","label":"@emnapi/runtime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.11.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json"]},{"id":"package:npm:@emnapi/wasi-threads","slug":"emnapi-wasi-threads-d3f1c692","identity":"npm:@emnapi/wasi-threads","label":"@emnapi/wasi-threads","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json"]},{"id":"package:npm:@eslint-community/eslint-utils","slug":"eslint-community-eslint-utils-c7538f47","identity":"npm:@eslint-community/eslint-utils","label":"@eslint-community/eslint-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.9.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint-community/regexpp","slug":"eslint-community-regexpp-df306a50","identity":"npm:@eslint-community/regexpp","label":"@eslint-community/regexpp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.12.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/config-array","slug":"eslint-config-array-64c9736b","identity":"npm:@eslint/config-array","label":"@eslint/config-array","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.23.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/config-helpers","slug":"eslint-config-helpers-a4919ae1","identity":"npm:@eslint/config-helpers","label":"@eslint/config-helpers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/core","slug":"eslint-core-78aa818b","identity":"npm:@eslint/core","label":"@eslint/core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/js","slug":"eslint-js-b7322adc","identity":"npm:@eslint/js","label":"@eslint/js","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/object-schema","slug":"eslint-object-schema-c1bb953b","identity":"npm:@eslint/object-schema","label":"@eslint/object-schema","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["3.0.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@eslint/plugin-kit","slug":"eslint-plugin-kit-be347b9f","identity":"npm:@eslint/plugin-kit","label":"@eslint/plugin-kit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.7.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@floating-ui/core","slug":"floating-ui-core-226c6ce1","identity":"npm:@floating-ui/core","label":"@floating-ui/core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@floating-ui/dom","slug":"floating-ui-dom-92a0b816","identity":"npm:@floating-ui/dom","label":"@floating-ui/dom","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@floating-ui/react-dom","slug":"floating-ui-react-dom-41c4c55a","identity":"npm:@floating-ui/react-dom","label":"@floating-ui/react-dom","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.9"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@floating-ui/utils","slug":"floating-ui-utils-a5f87317","identity":"npm:@floating-ui/utils","label":"@floating-ui/utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.12"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@fontsource-variable/geist","slug":"fontsource-variable-geist-e092d3ef","identity":"npm:@fontsource-variable/geist","label":"@fontsource-variable/geist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["OFL-1.1"],"versions":["5.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@humanfs/core","slug":"humanfs-core-ae1d1f57","identity":"npm:@humanfs/core","label":"@humanfs/core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.19.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@humanfs/types","slug":"humanfs-types-de42ddb8","identity":"npm:@humanfs/types","label":"@humanfs/types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.15.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@humanwhocodes/module-importer","slug":"humanwhocodes-module-importer-2bdf1883","identity":"npm:@humanwhocodes/module-importer","label":"@humanwhocodes/module-importer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@humanwhocodes/retry","slug":"humanwhocodes-retry-179e58ff","identity":"npm:@humanwhocodes/retry","label":"@humanwhocodes/retry","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.4.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@jridgewell/gen-mapping","slug":"jridgewell-gen-mapping-c100bb57","identity":"npm:@jridgewell/gen-mapping","label":"@jridgewell/gen-mapping","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.3.13"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@jridgewell/remapping","slug":"jridgewell-remapping-a8cddd40","identity":"npm:@jridgewell/remapping","label":"@jridgewell/remapping","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@jridgewell/resolve-uri","slug":"jridgewell-resolve-uri-f80859d6","identity":"npm:@jridgewell/resolve-uri","label":"@jridgewell/resolve-uri","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@jridgewell/sourcemap-codec","slug":"jridgewell-sourcemap-codec-1b6bbd68","identity":"npm:@jridgewell/sourcemap-codec","label":"@jridgewell/sourcemap-codec","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.5.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@jridgewell/trace-mapping","slug":"jridgewell-trace-mapping-c6f15179","identity":"npm:@jridgewell/trace-mapping","label":"@jridgewell/trace-mapping","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.3.31"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@keyv/bigmap","slug":"keyv-bigmap-76fbc824","identity":"npm:@keyv/bigmap","label":"@keyv/bigmap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@keyv/serialize","slug":"keyv-serialize-d7a49bfb","identity":"npm:@keyv/serialize","label":"@keyv/serialize","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@modelcontextprotocol/sdk","slug":"modelcontextprotocol-sdk-252ea8a6","identity":"npm:@modelcontextprotocol/sdk","label":"@modelcontextprotocol/sdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.32.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@napi-rs/wasm-runtime","slug":"napi-rs-wasm-runtime-38e2befb","identity":"npm:@napi-rs/wasm-runtime","label":"@napi-rs/wasm-runtime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json"]},{"id":"package:npm:@noble/ciphers","slug":"noble-ciphers-c180756e","identity":"npm:@noble/ciphers","label":"@noble/ciphers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@noble/curves","slug":"noble-curves-4ef91d43","identity":"npm:@noble/curves","label":"@noble/curves","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.9.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@noble/hashes","slug":"noble-hashes-aeabb965","identity":"npm:@noble/hashes","label":"@noble/hashes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@nodelib/fs.scandir","slug":"nodelib-fs-scandir-1c10ead4","identity":"npm:@nodelib/fs.scandir","label":"@nodelib/fs.scandir","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@nodelib/fs.stat","slug":"nodelib-fs-stat-b7824bf1","identity":"npm:@nodelib/fs.stat","label":"@nodelib/fs.stat","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@nodelib/fs.walk","slug":"nodelib-fs-walk-731ca7cb","identity":"npm:@nodelib/fs.walk","label":"@nodelib/fs.walk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@oxc-project/types","slug":"oxc-project-types-24a167b3","identity":"npm:@oxc-project/types","label":"@oxc-project/types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.154.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/number","slug":"radix-ui-number-581a3ecf","identity":"npm:@radix-ui/number","label":"@radix-ui/number","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/primitive","slug":"radix-ui-primitive-89244aca","identity":"npm:@radix-ui/primitive","label":"@radix-ui/primitive","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-accessible-icon","slug":"radix-ui-react-accessible-icon-a630715c","identity":"npm:@radix-ui/react-accessible-icon","label":"@radix-ui/react-accessible-icon","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-accordion","slug":"radix-ui-react-accordion-e9510ee0","identity":"npm:@radix-ui/react-accordion","label":"@radix-ui/react-accordion","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.20"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-alert-dialog","slug":"radix-ui-react-alert-dialog-ecfddaf1","identity":"npm:@radix-ui/react-alert-dialog","label":"@radix-ui/react-alert-dialog","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.23"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-arrow","slug":"radix-ui-react-arrow-0d7b9e5e","identity":"npm:@radix-ui/react-arrow","label":"@radix-ui/react-arrow","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-aspect-ratio","slug":"radix-ui-react-aspect-ratio-86842968","identity":"npm:@radix-ui/react-aspect-ratio","label":"@radix-ui/react-aspect-ratio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-avatar","slug":"radix-ui-react-avatar-23783ea4","identity":"npm:@radix-ui/react-avatar","label":"@radix-ui/react-avatar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-checkbox","slug":"radix-ui-react-checkbox-839a806e","identity":"npm:@radix-ui/react-checkbox","label":"@radix-ui/react-checkbox","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-collapsible","slug":"radix-ui-react-collapsible-2676b67f","identity":"npm:@radix-ui/react-collapsible","label":"@radix-ui/react-collapsible","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.20"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-collection","slug":"radix-ui-react-collection-e7fefa5c","identity":"npm:@radix-ui/react-collection","label":"@radix-ui/react-collection","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-compose-refs","slug":"radix-ui-react-compose-refs-a50a329f","identity":"npm:@radix-ui/react-compose-refs","label":"@radix-ui/react-compose-refs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-context","slug":"radix-ui-react-context-576ee6a1","identity":"npm:@radix-ui/react-context","label":"@radix-ui/react-context","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-context-menu","slug":"radix-ui-react-context-menu-17a66bb5","identity":"npm:@radix-ui/react-context-menu","label":"@radix-ui/react-context-menu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-dialog","slug":"radix-ui-react-dialog-c9ec934b","identity":"npm:@radix-ui/react-dialog","label":"@radix-ui/react-dialog","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.23"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-direction","slug":"radix-ui-react-direction-54eadc4b","identity":"npm:@radix-ui/react-direction","label":"@radix-ui/react-direction","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-dismissable-layer","slug":"radix-ui-react-dismissable-layer-a3c6e769","identity":"npm:@radix-ui/react-dismissable-layer","label":"@radix-ui/react-dismissable-layer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-dropdown-menu","slug":"radix-ui-react-dropdown-menu-bc75d3c0","identity":"npm:@radix-ui/react-dropdown-menu","label":"@radix-ui/react-dropdown-menu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.24"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-focus-guards","slug":"radix-ui-react-focus-guards-42cfef3a","identity":"npm:@radix-ui/react-focus-guards","label":"@radix-ui/react-focus-guards","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-focus-scope","slug":"radix-ui-react-focus-scope-29a5bbac","identity":"npm:@radix-ui/react-focus-scope","label":"@radix-ui/react-focus-scope","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.16"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-form","slug":"radix-ui-react-form-f33c0802","identity":"npm:@radix-ui/react-form","label":"@radix-ui/react-form","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.16"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-hover-card","slug":"radix-ui-react-hover-card-eb8c4657","identity":"npm:@radix-ui/react-hover-card","label":"@radix-ui/react-hover-card","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.23"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-id","slug":"radix-ui-react-id-987d2e61","identity":"npm:@radix-ui/react-id","label":"@radix-ui/react-id","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-label","slug":"radix-ui-react-label-d3c208c7","identity":"npm:@radix-ui/react-label","label":"@radix-ui/react-label","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-menu","slug":"radix-ui-react-menu-46fcb999","identity":"npm:@radix-ui/react-menu","label":"@radix-ui/react-menu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.24"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-menubar","slug":"radix-ui-react-menubar-08d55efa","identity":"npm:@radix-ui/react-menubar","label":"@radix-ui/react-menubar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.24"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-navigation-menu","slug":"radix-ui-react-navigation-menu-8d483544","identity":"npm:@radix-ui/react-navigation-menu","label":"@radix-ui/react-navigation-menu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.22"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-one-time-password-field","slug":"radix-ui-react-one-time-password-field-76b294fc","identity":"npm:@radix-ui/react-one-time-password-field","label":"@radix-ui/react-one-time-password-field","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.16"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-password-toggle-field","slug":"radix-ui-react-password-toggle-field-991121f8","identity":"npm:@radix-ui/react-password-toggle-field","label":"@radix-ui/react-password-toggle-field","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-popover","slug":"radix-ui-react-popover-da57f2a6","identity":"npm:@radix-ui/react-popover","label":"@radix-ui/react-popover","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.23"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-popper","slug":"radix-ui-react-popper-831b72db","identity":"npm:@radix-ui/react-popper","label":"@radix-ui/react-popper","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-portal","slug":"radix-ui-react-portal-1382c60d","identity":"npm:@radix-ui/react-portal","label":"@radix-ui/react-portal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.17"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-presence","slug":"radix-ui-react-presence-adbec356","identity":"npm:@radix-ui/react-presence","label":"@radix-ui/react-presence","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.10"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-primitive","slug":"radix-ui-react-primitive-89b4f1d1","identity":"npm:@radix-ui/react-primitive","label":"@radix-ui/react-primitive","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.10"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-progress","slug":"radix-ui-react-progress-48e46dbe","identity":"npm:@radix-ui/react-progress","label":"@radix-ui/react-progress","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.16"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-radio-group","slug":"radix-ui-react-radio-group-672dcea5","identity":"npm:@radix-ui/react-radio-group","label":"@radix-ui/react-radio-group","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-roving-focus","slug":"radix-ui-react-roving-focus-aab71eef","identity":"npm:@radix-ui/react-roving-focus","label":"@radix-ui/react-roving-focus","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-scroll-area","slug":"radix-ui-react-scroll-area-f6a4a63b","identity":"npm:@radix-ui/react-scroll-area","label":"@radix-ui/react-scroll-area","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.18"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-select","slug":"radix-ui-react-select-5eaaf38a","identity":"npm:@radix-ui/react-select","label":"@radix-ui/react-select","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-separator","slug":"radix-ui-react-separator-3ab6e92e","identity":"npm:@radix-ui/react-separator","label":"@radix-ui/react-separator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.15"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-slider","slug":"radix-ui-react-slider-4ec942a5","identity":"npm:@radix-ui/react-slider","label":"@radix-ui/react-slider","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-slot","slug":"radix-ui-react-slot-0b5c1020","identity":"npm:@radix-ui/react-slot","label":"@radix-ui/react-slot","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-switch","slug":"radix-ui-react-switch-954a4ee2","identity":"npm:@radix-ui/react-switch","label":"@radix-ui/react-switch","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-tabs","slug":"radix-ui-react-tabs-d1364061","identity":"npm:@radix-ui/react-tabs","label":"@radix-ui/react-tabs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.21"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-toast","slug":"radix-ui-react-toast-d3a9320e","identity":"npm:@radix-ui/react-toast","label":"@radix-ui/react-toast","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.23"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-toggle","slug":"radix-ui-react-toggle-84169dad","identity":"npm:@radix-ui/react-toggle","label":"@radix-ui/react-toggle","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.18"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-toggle-group","slug":"radix-ui-react-toggle-group-4ba3d8a4","identity":"npm:@radix-ui/react-toggle-group","label":"@radix-ui/react-toggle-group","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-toolbar","slug":"radix-ui-react-toolbar-2cd2cf6e","identity":"npm:@radix-ui/react-toolbar","label":"@radix-ui/react-toolbar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-tooltip","slug":"radix-ui-react-tooltip-bf2eced6","identity":"npm:@radix-ui/react-tooltip","label":"@radix-ui/react-tooltip","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.16"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-callback-ref","slug":"radix-ui-react-use-callback-ref-bdf07aa2","identity":"npm:@radix-ui/react-use-callback-ref","label":"@radix-ui/react-use-callback-ref","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-controllable-state","slug":"radix-ui-react-use-controllable-state-6f6994ba","identity":"npm:@radix-ui/react-use-controllable-state","label":"@radix-ui/react-use-controllable-state","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-effect-event","slug":"radix-ui-react-use-effect-event-0dc07ac7","identity":"npm:@radix-ui/react-use-effect-event","label":"@radix-ui/react-use-effect-event","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-escape-keydown","slug":"radix-ui-react-use-escape-keydown-1f78b742","identity":"npm:@radix-ui/react-use-escape-keydown","label":"@radix-ui/react-use-escape-keydown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-is-hydrated","slug":"radix-ui-react-use-is-hydrated-931af649","identity":"npm:@radix-ui/react-use-is-hydrated","label":"@radix-ui/react-use-is-hydrated","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-layout-effect","slug":"radix-ui-react-use-layout-effect-cd01a3ed","identity":"npm:@radix-ui/react-use-layout-effect","label":"@radix-ui/react-use-layout-effect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-previous","slug":"radix-ui-react-use-previous-54a0a81a","identity":"npm:@radix-ui/react-use-previous","label":"@radix-ui/react-use-previous","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-rect","slug":"radix-ui-react-use-rect-7d2d8eb9","identity":"npm:@radix-ui/react-use-rect","label":"@radix-ui/react-use-rect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-use-size","slug":"radix-ui-react-use-size-0ec9d7a7","identity":"npm:@radix-ui/react-use-size","label":"@radix-ui/react-use-size","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/react-visually-hidden","slug":"radix-ui-react-visually-hidden-b9c56e4c","identity":"npm:@radix-ui/react-visually-hidden","label":"@radix-ui/react-visually-hidden","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@radix-ui/rect","slug":"radix-ui-rect-bd869810","identity":"npm:@radix-ui/rect","label":"@radix-ui/rect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@reduxjs/toolkit","slug":"reduxjs-toolkit-37f98765","identity":"npm:@reduxjs/toolkit","label":"@reduxjs/toolkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.11.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-android-arm-eabi","slug":"rolldown-binding-android-arm-eabi-aafa4a7a","identity":"npm:@rolldown/binding-android-arm-eabi","label":"@rolldown/binding-android-arm-eabi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-android-arm64","slug":"rolldown-binding-android-arm64-4fba01e6","identity":"npm:@rolldown/binding-android-arm64","label":"@rolldown/binding-android-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-darwin-arm64","slug":"rolldown-binding-darwin-arm64-c68272ff","identity":"npm:@rolldown/binding-darwin-arm64","label":"@rolldown/binding-darwin-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-darwin-x64","slug":"rolldown-binding-darwin-x64-530717d4","identity":"npm:@rolldown/binding-darwin-x64","label":"@rolldown/binding-darwin-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-freebsd-x64","slug":"rolldown-binding-freebsd-x64-9a434b5e","identity":"npm:@rolldown/binding-freebsd-x64","label":"@rolldown/binding-freebsd-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-arm-gnueabihf","slug":"rolldown-binding-linux-arm-gnueabihf-5b12188b","identity":"npm:@rolldown/binding-linux-arm-gnueabihf","label":"@rolldown/binding-linux-arm-gnueabihf","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-arm64-gnu","slug":"rolldown-binding-linux-arm64-gnu-4d84f50b","identity":"npm:@rolldown/binding-linux-arm64-gnu","label":"@rolldown/binding-linux-arm64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-arm64-musl","slug":"rolldown-binding-linux-arm64-musl-30032dd1","identity":"npm:@rolldown/binding-linux-arm64-musl","label":"@rolldown/binding-linux-arm64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-ppc64-gnu","slug":"rolldown-binding-linux-ppc64-gnu-5949f425","identity":"npm:@rolldown/binding-linux-ppc64-gnu","label":"@rolldown/binding-linux-ppc64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-s390x-gnu","slug":"rolldown-binding-linux-s390x-gnu-b2becc57","identity":"npm:@rolldown/binding-linux-s390x-gnu","label":"@rolldown/binding-linux-s390x-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-x64-gnu","slug":"rolldown-binding-linux-x64-gnu-552bf0d8","identity":"npm:@rolldown/binding-linux-x64-gnu","label":"@rolldown/binding-linux-x64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-linux-x64-musl","slug":"rolldown-binding-linux-x64-musl-e9aa57fe","identity":"npm:@rolldown/binding-linux-x64-musl","label":"@rolldown/binding-linux-x64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-openharmony-arm64","slug":"rolldown-binding-openharmony-arm64-a55f4196","identity":"npm:@rolldown/binding-openharmony-arm64","label":"@rolldown/binding-openharmony-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-win32-arm64-msvc","slug":"rolldown-binding-win32-arm64-msvc-b4f088cf","identity":"npm:@rolldown/binding-win32-arm64-msvc","label":"@rolldown/binding-win32-arm64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/binding-win32-x64-msvc","slug":"rolldown-binding-win32-x64-msvc-cc6d5954","identity":"npm:@rolldown/binding-win32-x64-msvc","label":"@rolldown/binding-win32-x64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@rolldown/pluginutils","slug":"rolldown-pluginutils-73ff273e","identity":"npm:@rolldown/pluginutils","label":"@rolldown/pluginutils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@sec-ant/readable-stream","slug":"sec-ant-readable-stream-3c590ee3","identity":"npm:@sec-ant/readable-stream","label":"@sec-ant/readable-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@sindresorhus/merge-streams","slug":"sindresorhus-merge-streams-3bf40078","identity":"npm:@sindresorhus/merge-streams","label":"@sindresorhus/merge-streams","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@standard-schema/spec","slug":"standard-schema-spec-d214ce9f","identity":"npm:@standard-schema/spec","label":"@standard-schema/spec","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@standard-schema/utils","slug":"standard-schema-utils-81950b73","identity":"npm:@standard-schema/utils","label":"@standard-schema/utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/node","slug":"tailwindcss-node-5a7bda04","identity":"npm:@tailwindcss/node","label":"@tailwindcss/node","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide","slug":"tailwindcss-oxide-bc0deb5e","identity":"npm:@tailwindcss/oxide","label":"@tailwindcss/oxide","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-android-arm64","slug":"tailwindcss-oxide-android-arm64-ee536c9e","identity":"npm:@tailwindcss/oxide-android-arm64","label":"@tailwindcss/oxide-android-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-darwin-arm64","slug":"tailwindcss-oxide-darwin-arm64-292dea54","identity":"npm:@tailwindcss/oxide-darwin-arm64","label":"@tailwindcss/oxide-darwin-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-darwin-x64","slug":"tailwindcss-oxide-darwin-x64-47d8c409","identity":"npm:@tailwindcss/oxide-darwin-x64","label":"@tailwindcss/oxide-darwin-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-freebsd-x64","slug":"tailwindcss-oxide-freebsd-x64-2a2dd5a3","identity":"npm:@tailwindcss/oxide-freebsd-x64","label":"@tailwindcss/oxide-freebsd-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-linux-arm-gnueabihf","slug":"tailwindcss-oxide-linux-arm-gnueabihf-26461187","identity":"npm:@tailwindcss/oxide-linux-arm-gnueabihf","label":"@tailwindcss/oxide-linux-arm-gnueabihf","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-linux-arm64-gnu","slug":"tailwindcss-oxide-linux-arm64-gnu-6c30a655","identity":"npm:@tailwindcss/oxide-linux-arm64-gnu","label":"@tailwindcss/oxide-linux-arm64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-linux-arm64-musl","slug":"tailwindcss-oxide-linux-arm64-musl-edeb0668","identity":"npm:@tailwindcss/oxide-linux-arm64-musl","label":"@tailwindcss/oxide-linux-arm64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-linux-x64-gnu","slug":"tailwindcss-oxide-linux-x64-gnu-1b7e7116","identity":"npm:@tailwindcss/oxide-linux-x64-gnu","label":"@tailwindcss/oxide-linux-x64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-linux-x64-musl","slug":"tailwindcss-oxide-linux-x64-musl-6ecbe2a8","identity":"npm:@tailwindcss/oxide-linux-x64-musl","label":"@tailwindcss/oxide-linux-x64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-wasm32-wasi","slug":"tailwindcss-oxide-wasm32-wasi-ca1d3da4","identity":"npm:@tailwindcss/oxide-wasm32-wasi","label":"@tailwindcss/oxide-wasm32-wasi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-win32-arm64-msvc","slug":"tailwindcss-oxide-win32-arm64-msvc-155b7f53","identity":"npm:@tailwindcss/oxide-win32-arm64-msvc","label":"@tailwindcss/oxide-win32-arm64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/oxide-win32-x64-msvc","slug":"tailwindcss-oxide-win32-x64-msvc-ec1bb11f","identity":"npm:@tailwindcss/oxide-win32-x64-msvc","label":"@tailwindcss/oxide-win32-x64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tailwindcss/vite","slug":"tailwindcss-vite-719b0a4f","identity":"npm:@tailwindcss/vite","label":"@tailwindcss/vite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/history","slug":"tanstack-history-7dd0468e","identity":"npm:@tanstack/history","label":"@tanstack/history","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.162.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/query-core","slug":"tanstack-query-core-9a0f2868","identity":"npm:@tanstack/query-core","label":"@tanstack/query-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.104.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/react-query","slug":"tanstack-react-query-049e9666","identity":"npm:@tanstack/react-query","label":"@tanstack/react-query","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.104.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/react-router","slug":"tanstack-react-router-0acc9b30","identity":"npm:@tanstack/react-router","label":"@tanstack/react-router","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.170.40"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/react-router-devtools","slug":"tanstack-react-router-devtools-48fe6b35","identity":"npm:@tanstack/react-router-devtools","label":"@tanstack/react-router-devtools","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.167.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/react-store","slug":"tanstack-react-store-b1d17193","identity":"npm:@tanstack/react-store","label":"@tanstack/react-store","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.11.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/router-core","slug":"tanstack-router-core-e8c8be62","identity":"npm:@tanstack/router-core","label":"@tanstack/router-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.171.32","1.171.33"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/router-devtools-core","slug":"tanstack-router-devtools-core-b3340ea1","identity":"npm:@tanstack/router-devtools-core","label":"@tanstack/router-devtools-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.168.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/router-generator","slug":"tanstack-router-generator-b6ba584d","identity":"npm:@tanstack/router-generator","label":"@tanstack/router-generator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.167.38"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@tanstack/router-plugin","slug":"tanstack-router-plugin-8bc6db3e","identity":"npm:@tanstack/router-plugin","label":"@tanstack/router-plugin","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.168.40"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@tanstack/router-utils","slug":"tanstack-router-utils-e1dbb6f5","identity":"npm:@tanstack/router-utils","label":"@tanstack/router-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.162.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@tanstack/store","slug":"tanstack-store-37e795f0","identity":"npm:@tanstack/store","label":"@tanstack/store","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.11.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tanstack/virtual-file-routes","slug":"tanstack-virtual-file-routes-a6d6195c","identity":"npm:@tanstack/virtual-file-routes","label":"@tanstack/virtual-file-routes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.162.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@ts-morph/common","slug":"ts-morph-common-1c7ef627","identity":"npm:@ts-morph/common","label":"@ts-morph/common","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.27.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@tybys/wasm-util","slug":"tybys-wasm-util-031dcc8d","identity":"npm:@tybys/wasm-util","label":"@tybys/wasm-util","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.10.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json"]},{"id":"package:npm:@types/d3-array","slug":"types-d3-array-a29b6cf2","identity":"npm:@types/d3-array","label":"@types/d3-array","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-color","slug":"types-d3-color-e40fd440","identity":"npm:@types/d3-color","label":"@types/d3-color","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-ease","slug":"types-d3-ease-149b739c","identity":"npm:@types/d3-ease","label":"@types/d3-ease","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-interpolate","slug":"types-d3-interpolate-7f90ad6f","identity":"npm:@types/d3-interpolate","label":"@types/d3-interpolate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-path","slug":"types-d3-path-960b1008","identity":"npm:@types/d3-path","label":"@types/d3-path","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-scale","slug":"types-d3-scale-5a3300ab","identity":"npm:@types/d3-scale","label":"@types/d3-scale","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.9"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-shape","slug":"types-d3-shape-7b817826","identity":"npm:@types/d3-shape","label":"@types/d3-shape","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-time","slug":"types-d3-time-f20949e6","identity":"npm:@types/d3-time","label":"@types/d3-time","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/d3-timer","slug":"types-d3-timer-23dd2733","identity":"npm:@types/d3-timer","label":"@types/d3-timer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/debug","slug":"types-debug-09342db5","identity":"npm:@types/debug","label":"@types/debug","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.13"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/esrecurse","slug":"types-esrecurse-39b3ab02","identity":"npm:@types/esrecurse","label":"@types/esrecurse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@types/estree","slug":"types-estree-8dde2b7e","identity":"npm:@types/estree","label":"@types/estree","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/estree-jsx","slug":"types-estree-jsx-65519fd8","identity":"npm:@types/estree-jsx","label":"@types/estree-jsx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/hast","slug":"types-hast-976cd29f","identity":"npm:@types/hast","label":"@types/hast","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/json-schema","slug":"types-json-schema-71e9bb24","identity":"npm:@types/json-schema","label":"@types/json-schema","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.0.15"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@types/mdast","slug":"types-mdast-ca137420","identity":"npm:@types/mdast","label":"@types/mdast","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/ms","slug":"types-ms-7aa68791","identity":"npm:@types/ms","label":"@types/ms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/node","slug":"types-node-893179a0","identity":"npm:@types/node","label":"@types/node","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["26.6.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/prismjs","slug":"types-prismjs-3298ce7a","identity":"npm:@types/prismjs","label":"@types/prismjs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.26.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/react","slug":"types-react-1801b994","identity":"npm:@types/react","label":"@types/react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["19.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/react-dom","slug":"types-react-dom-0822f902","identity":"npm:@types/react-dom","label":"@types/react-dom","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["19.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/unist","slug":"types-unist-33c4c02a","identity":"npm:@types/unist","label":"@types/unist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.11","3.0.3"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/use-sync-external-store","slug":"types-use-sync-external-store-82a5c51e","identity":"npm:@types/use-sync-external-store","label":"@types/use-sync-external-store","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.0.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@types/validate-npm-package-name","slug":"types-validate-npm-package-name-ba658174","identity":"npm:@types/validate-npm-package-name","label":"@types/validate-npm-package-name","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@typescript-eslint/eslint-plugin","slug":"typescript-eslint-eslint-plugin-37895b16","identity":"npm:@typescript-eslint/eslint-plugin","label":"@typescript-eslint/eslint-plugin","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/parser","slug":"typescript-eslint-parser-30fb3abf","identity":"npm:@typescript-eslint/parser","label":"@typescript-eslint/parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/project-service","slug":"typescript-eslint-project-service-4325b1df","identity":"npm:@typescript-eslint/project-service","label":"@typescript-eslint/project-service","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/scope-manager","slug":"typescript-eslint-scope-manager-9cced343","identity":"npm:@typescript-eslint/scope-manager","label":"@typescript-eslint/scope-manager","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/tsconfig-utils","slug":"typescript-eslint-tsconfig-utils-1c650a80","identity":"npm:@typescript-eslint/tsconfig-utils","label":"@typescript-eslint/tsconfig-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/type-utils","slug":"typescript-eslint-type-utils-7cdfbb29","identity":"npm:@typescript-eslint/type-utils","label":"@typescript-eslint/type-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/types","slug":"typescript-eslint-types-77f3f786","identity":"npm:@typescript-eslint/types","label":"@typescript-eslint/types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/typescript-estree","slug":"typescript-eslint-typescript-estree-82954698","identity":"npm:@typescript-eslint/typescript-estree","label":"@typescript-eslint/typescript-estree","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/utils","slug":"typescript-eslint-utils-688d256d","identity":"npm:@typescript-eslint/utils","label":"@typescript-eslint/utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@typescript-eslint/visitor-keys","slug":"typescript-eslint-visitor-keys-fbb1a81d","identity":"npm:@typescript-eslint/visitor-keys","label":"@typescript-eslint/visitor-keys","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:@uiw/copy-to-clipboard","slug":"uiw-copy-to-clipboard-8bead46c","identity":"npm:@uiw/copy-to-clipboard","label":"@uiw/copy-to-clipboard","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.21"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@uiw/react-markdown-preview","slug":"uiw-react-markdown-preview-8928ea94","identity":"npm:@uiw/react-markdown-preview","label":"@uiw/react-markdown-preview","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@uiw/react-md-editor","slug":"uiw-react-md-editor-ba7a4bdd","identity":"npm:@uiw/react-md-editor","label":"@uiw/react-md-editor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@ungap/structured-clone","slug":"ungap-structured-clone-ab04e895","identity":"npm:@ungap/structured-clone","label":"@ungap/structured-clone","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:@vitejs/plugin-react","slug":"vitejs-plugin-react-0eef6115","identity":"npm:@vitejs/plugin-react","label":"@vitejs/plugin-react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:accepts","slug":"accepts-be3cbd71","identity":"npm:accepts","label":"accepts","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:acorn","slug":"acorn-7462fc91","identity":"npm:acorn","label":"acorn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.18.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:acorn-jsx","slug":"acorn-jsx-39f7c275","identity":"npm:acorn-jsx","label":"acorn-jsx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:agent-base","slug":"agent-base-a3970bdd","identity":"npm:agent-base","label":"agent-base","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:aiofiles","slug":"aiofiles-41b094bb","identity":"pypi:aiofiles","label":"aiofiles","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["25.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiohappyeyeballs","slug":"aiohappyeyeballs-ea4657b8","identity":"pypi:aiohappyeyeballs","label":"aiohappyeyeballs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0"],"versions":["2.7.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiohttp-retry","slug":"aiohttp-retry-70699ddd","identity":"pypi:aiohttp-retry","label":"aiohttp-retry","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.9.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiosignal","slug":"aiosignal-b6794e75","identity":"pypi:aiosignal","label":"aiosignal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiosmtplib","slug":"aiosmtplib-e8671b81","identity":"pypi:aiosmtplib","label":"aiosmtplib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:aiosqlite","slug":"aiosqlite-c379fabf","identity":"pypi:aiosqlite","label":"aiosqlite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.22.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:ajv-formats","slug":"ajv-formats-78fbf756","identity":"npm:ajv-formats","label":"ajv-formats","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:alembic","slug":"alembic-662caf9d","identity":"pypi:alembic","label":"alembic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.20.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:annotated-doc","slug":"annotated-doc-9568e1af","identity":"pypi:annotated-doc","label":"annotated-doc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:annotated-types","slug":"annotated-types-2304c38b","identity":"pypi:annotated-types","label":"annotated-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:ansi-regex","slug":"ansi-regex-920343ce","identity":"npm:ansi-regex","label":"ansi-regex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:ansis","slug":"ansis-fa431623","identity":"npm:ansis","label":"ansis","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["4.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:argparse","slug":"argparse-b5701db7","identity":"npm:argparse","label":"argparse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","PSF-2.0","Python-2.0"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:aria-hidden","slug":"aria-hidden-c855d183","identity":"npm:aria-hidden","label":"aria-hidden","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:ast-serialize","slug":"ast-serialize-4fe42cf9","identity":"pypi:ast-serialize","label":"ast-serialize","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.13.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:ast-types","slug":"ast-types-47084315","identity":"npm:ast-types","label":"ast-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.16.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:astroid","slug":"astroid-12016648","identity":"pypi:astroid","label":"astroid","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.1-or-later"],"versions":["4.0.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:asttokens","slug":"asttokens-c349c5f9","identity":"pypi:asttokens","label":"asttokens","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:asynckit","slug":"asynckit-084253d2","identity":"npm:asynckit","label":"asynckit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:asyncpg","slug":"asyncpg-0fe19492","identity":"pypi:asyncpg","label":"asyncpg","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.32.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:attrs","slug":"attrs-2e7954ac","identity":"pypi:attrs","label":"attrs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["26.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:audioop-lts","slug":"audioop-lts-1da6267f","identity":"pypi:audioop-lts","label":"audioop-lts","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0"],"versions":["0.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:azure-storage-queue","slug":"azure-storage-queue-fc8a7c70","identity":"pypi:azure-storage-queue","label":"azure-storage-queue","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.18.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:babel","slug":"babel-c668b0a9","identity":"pypi:babel","label":"babel","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2.18.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:babel-dead-code-elimination","slug":"babel-dead-code-elimination-be561d65","identity":"npm:babel-dead-code-elimination","label":"babel-dead-code-elimination","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.12"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:backrefs","slug":"backrefs-b5389480","identity":"pypi:backrefs","label":"backrefs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:bail","slug":"bail-8d9e1b54","identity":"npm:bail","label":"bail","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:balanced-match","slug":"balanced-match-bdbd1dc3","identity":"npm:balanced-match","label":"balanced-match","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:baseline-browser-mapping","slug":"baseline-browser-mapping-e31a849c","identity":"npm:baseline-browser-mapping","label":"baseline-browser-mapping","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.11.25"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:bcp-47-match","slug":"bcp-47-match-4036a9ba","identity":"npm:bcp-47-match","label":"bcp-47-match","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:bcrypt","slug":"bcrypt-f766cbbf","identity":"pypi:bcrypt","label":"bcrypt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:beautifulsoup4","slug":"beautifulsoup4-eddf0c04","identity":"pypi:beautifulsoup4","label":"beautifulsoup4","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.15.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:boolbase","slug":"boolbase-23160ca2","identity":"npm:boolbase","label":"boolbase","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:braces","slug":"braces-16233bc9","identity":"npm:braces","label":"braces","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:bundle-name","slug":"bundle-name-d8e83f6d","identity":"npm:bundle-name","label":"bundle-name","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:bytes","slug":"bytes-8a22cc41","identity":"npm:bytes","label":"bytes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cacheable","slug":"cacheable-0089dd05","identity":"npm:cacheable","label":"cacheable","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:call-bind-apply-helpers","slug":"call-bind-apply-helpers-78957419","identity":"npm:call-bind-apply-helpers","label":"call-bind-apply-helpers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:call-bound","slug":"call-bound-9572ae3f","identity":"npm:call-bound","label":"call-bound","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:callsites","slug":"callsites-3381460c","identity":"npm:callsites","label":"callsites","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:caniuse-lite","slug":"caniuse-lite-e06ab132","identity":"npm:caniuse-lite","label":"caniuse-lite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["CC-BY-4.0"],"versions":["1.0.30001810"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:ccount","slug":"ccount-1701465a","identity":"npm:ccount","label":"ccount","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:cffi","slug":"cffi-38e65d3e","identity":"pypi:cffi","label":"cffi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","MIT-0"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:cfgv","slug":"cfgv-4583061f","identity":"pypi:cfgv","label":"cfgv","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:chalk","slug":"chalk-8df0bdaf","identity":"npm:chalk","label":"chalk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.6.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:character-entities","slug":"character-entities-fadf7f03","identity":"npm:character-entities","label":"character-entities","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:character-entities-html4","slug":"character-entities-html4-979c8601","identity":"npm:character-entities-html4","label":"character-entities-html4","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:character-entities-legacy","slug":"character-entities-legacy-72cfb89e","identity":"npm:character-entities-legacy","label":"character-entities-legacy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:character-reference-invalid","slug":"character-reference-invalid-791f1a58","identity":"npm:character-reference-invalid","label":"character-reference-invalid","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:charset-normalizer","slug":"charset-normalizer-74ccb20a","identity":"pypi:charset-normalizer","label":"charset-normalizer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.5.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:chokidar","slug":"chokidar-52c6aecd","identity":"npm:chokidar","label":"chokidar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:class-variance-authority","slug":"class-variance-authority-3a19330f","identity":"npm:class-variance-authority","label":"class-variance-authority","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.7.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cli-cursor","slug":"cli-cursor-c7c50cdb","identity":"npm:cli-cursor","label":"cli-cursor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cli-spinners","slug":"cli-spinners-df2ee187","identity":"npm:cli-spinners","label":"cli-spinners","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.9.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:click","slug":"click-ef97f731","identity":"pypi:click","label":"click","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["8.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:click-option-group","slug":"click-option-group-43453dea","identity":"pypi:click-option-group","label":"click-option-group","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.5.9"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:clsx","slug":"clsx-302ac87a","identity":"npm:clsx","label":"clsx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cmdk","slug":"cmdk-91729400","identity":"npm:cmdk","label":"cmdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cn","slug":"cn-18e9ace0","identity":"npm:cn","label":"cn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:code-block-writer","slug":"code-block-writer-bafd27e7","identity":"npm:code-block-writer","label":"code-block-writer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["13.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:colorama","slug":"colorama-abaf57c3","identity":"pypi:colorama","label":"colorama","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.4.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:combined-stream","slug":"combined-stream-b0356c50","identity":"npm:combined-stream","label":"combined-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:comma-separated-tokens","slug":"comma-separated-tokens-938b545a","identity":"npm:comma-separated-tokens","label":"comma-separated-tokens","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:commander","slug":"commander-e4ed5c85","identity":"npm:commander","label":"commander","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.1.0","14.0.3"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:content-disposition","slug":"content-disposition-87619660","identity":"npm:content-disposition","label":"content-disposition","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:content-type","slug":"content-type-7fa6e83d","identity":"npm:content-type","label":"content-type","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.5","2.1.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:convert-source-map","slug":"convert-source-map-78f51653","identity":"npm:convert-source-map","label":"convert-source-map","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cookie","slug":"cookie-a2a53f4d","identity":"npm:cookie","label":"cookie","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cookie-es","slug":"cookie-es-fccb14d2","identity":"npm:cookie-es","label":"cookie-es","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cookie-signature","slug":"cookie-signature-429a9ed6","identity":"npm:cookie-signature","label":"cookie-signature","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cors","slug":"cors-4759e73f","identity":"npm:cors","label":"cors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.8.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cosmiconfig","slug":"cosmiconfig-75133a25","identity":"npm:cosmiconfig","label":"cosmiconfig","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cross-spawn","slug":"cross-spawn-11ddd240","identity":"npm:cross-spawn","label":"cross-spawn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.0.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:css-selector-parser","slug":"css-selector-parser-0831c071","identity":"npm:css-selector-parser","label":"css-selector-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:cssesc","slug":"cssesc-1c461bf4","identity":"npm:cssesc","label":"cssesc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:cssselect2","slug":"cssselect2-87d00b2b","identity":"pypi:cssselect2","label":"cssselect2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.10.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:csstype","slug":"csstype-64cd134e","identity":"npm:csstype","label":"csstype","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-array","slug":"d3-array-d7030bb5","identity":"npm:d3-array","label":"d3-array","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","ISC"],"versions":["3.2.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-color","slug":"d3-color-1b82248b","identity":"npm:d3-color","label":"d3-color","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-ease","slug":"d3-ease-325f140b","identity":"npm:d3-ease","label":"d3-ease","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-format","slug":"d3-format-6da42c7c","identity":"npm:d3-format","label":"d3-format","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-interpolate","slug":"d3-interpolate-0a6d9932","identity":"npm:d3-interpolate","label":"d3-interpolate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-path","slug":"d3-path-0f72af98","identity":"npm:d3-path","label":"d3-path","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","ISC"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-scale","slug":"d3-scale-6d449a2e","identity":"npm:d3-scale","label":"d3-scale","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-shape","slug":"d3-shape-ce111f69","identity":"npm:d3-shape","label":"d3-shape","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","ISC"],"versions":["3.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-time","slug":"d3-time-8374a368","identity":"npm:d3-time","label":"d3-time","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-time-format","slug":"d3-time-format-57557ec1","identity":"npm:d3-time-format","label":"d3-time-format","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["4.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:d3-timer","slug":"d3-timer-2e634c1e","identity":"npm:d3-timer","label":"d3-timer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:date-fns","slug":"date-fns-b797eff3","identity":"npm:date-fns","label":"date-fns","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:debug","slug":"debug-e3b3b23f","identity":"npm:debug","label":"debug","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.4.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:debugpy","slug":"debugpy-71725cbb","identity":"pypi:debugpy","label":"debugpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.22"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:decimal.js-light","slug":"decimal-js-light-bca5bfff","identity":"npm:decimal.js-light","label":"decimal.js-light","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.5.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:decode-named-character-reference","slug":"decode-named-character-reference-d0c309dc","identity":"npm:decode-named-character-reference","label":"decode-named-character-reference","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:decorator","slug":"decorator-500c1fb8","identity":"pypi:decorator","label":"decorator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","non-standard"],"versions":["5.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:dedent","slug":"dedent-30f4112e","identity":"npm:dedent","label":"dedent","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:deep-is","slug":"deep-is-0ee8b226","identity":"npm:deep-is","label":"deep-is","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:default-browser","slug":"default-browser-7bc285c6","identity":"npm:default-browser","label":"default-browser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:default-browser-id","slug":"default-browser-id-1306286c","identity":"npm:default-browser-id","label":"default-browser-id","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:define-lazy-prop","slug":"define-lazy-prop-370561b8","identity":"npm:define-lazy-prop","label":"define-lazy-prop","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:delayed-stream","slug":"delayed-stream-b1ee7639","identity":"npm:delayed-stream","label":"delayed-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:depd","slug":"depd-8c68abf1","identity":"npm:depd","label":"depd","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:deprecated","slug":"deprecated-e7bb8a9a","identity":"pypi:deprecated","label":"deprecated","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:dequal","slug":"dequal-7b882b20","identity":"npm:dequal","label":"dequal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:detect-libc","slug":"detect-libc-b4be90cb","identity":"npm:detect-libc","label":"detect-libc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:detect-node-es","slug":"detect-node-es-2d46ab7b","identity":"npm:detect-node-es","label":"detect-node-es","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:devlop","slug":"devlop-b37fc7f6","identity":"npm:devlop","label":"devlop","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:dill","slug":"dill-e2d26698","identity":"pypi:dill","label":"dill","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:direction","slug":"direction-5463ec66","identity":"npm:direction","label":"direction","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:distlib","slug":"distlib-d66be865","identity":"pypi:distlib","label":"distlib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0"],"versions":["0.4.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:distro","slug":"distro-36b318e9","identity":"pypi:distro","label":"distro","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.9.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:docopt","slug":"docopt-a034efe2","identity":"pypi:docopt","label":"docopt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.6.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:docstring-parser","slug":"docstring-parser-9edeecc2","identity":"pypi:docstring-parser","label":"docstring-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.18.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:dotenv","slug":"dotenv-230bc017","identity":"npm:dotenv","label":"dotenv","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["17.4.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:dotenv","slug":"dotenv-c49c342b","identity":"pypi:dotenv","label":"dotenv","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.9"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:dotty-dict","slug":"dotty-dict-33e68274","identity":"pypi:dotty-dict","label":"dotty-dict","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:dunder-proto","slug":"dunder-proto-06a3ed8c","identity":"npm:dunder-proto","label":"dunder-proto","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:eciesjs","slug":"eciesjs-5462e624","identity":"npm:eciesjs","label":"eciesjs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.18"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:ee-first","slug":"ee-first-53b9047e","identity":"npm:ee-first","label":"ee-first","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:electron-to-chromium","slug":"electron-to-chromium-375b132f","identity":"npm:electron-to-chromium","label":"electron-to-chromium","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.5.433"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:embla-carousel","slug":"embla-carousel-2aafeebe","identity":"npm:embla-carousel","label":"embla-carousel","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.6.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:embla-carousel-react","slug":"embla-carousel-react-836fc6dc","identity":"npm:embla-carousel-react","label":"embla-carousel-react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.6.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:embla-carousel-reactive-utils","slug":"embla-carousel-reactive-utils-bfd4d795","identity":"npm:embla-carousel-reactive-utils","label":"embla-carousel-reactive-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.6.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:emoji-regex","slug":"emoji-regex-8e51d994","identity":"npm:emoji-regex","label":"emoji-regex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.6.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:encodeurl","slug":"encodeurl-7def4e10","identity":"npm:encodeurl","label":"encodeurl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:enhanced-resolve","slug":"enhanced-resolve-3bd00f72","identity":"npm:enhanced-resolve","label":"enhanced-resolve","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.25.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:entities","slug":"entities-dadc420c","identity":"npm:entities","label":"entities","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["6.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:env-paths","slug":"env-paths-2a051888","identity":"npm:env-paths","label":"env-paths","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:error-ex","slug":"error-ex-ab587189","identity":"npm:error-ex","label":"error-ex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:es-define-property","slug":"es-define-property-47323fb6","identity":"npm:es-define-property","label":"es-define-property","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:es-errors","slug":"es-errors-ef18b576","identity":"npm:es-errors","label":"es-errors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:es-object-atoms","slug":"es-object-atoms-c0d03b04","identity":"npm:es-object-atoms","label":"es-object-atoms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:es-set-tostringtag","slug":"es-set-tostringtag-10bc0ea9","identity":"npm:es-set-tostringtag","label":"es-set-tostringtag","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:es-toolkit","slug":"es-toolkit-4d2306f5","identity":"npm:es-toolkit","label":"es-toolkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.46.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:escalade","slug":"escalade-6fb20cfb","identity":"npm:escalade","label":"escalade","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:escape-html","slug":"escape-html-fb926c89","identity":"npm:escape-html","label":"escape-html","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:escape-string-regexp","slug":"escape-string-regexp-48b4cb67","identity":"npm:escape-string-regexp","label":"escape-string-regexp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0","5.0.0"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:eslint","slug":"eslint-421604c9","identity":"npm:eslint","label":"eslint","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.11.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:eslint-plugin-react-hooks","slug":"eslint-plugin-react-hooks-14270148","identity":"npm:eslint-plugin-react-hooks","label":"eslint-plugin-react-hooks","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:eslint-plugin-react-refresh","slug":"eslint-plugin-react-refresh-be6657b2","identity":"npm:eslint-plugin-react-refresh","label":"eslint-plugin-react-refresh","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.5.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:eslint-scope","slug":"eslint-scope-e94b244d","identity":"npm:eslint-scope","label":"eslint-scope","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["9.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:eslint-visitor-keys","slug":"eslint-visitor-keys-32b1188a","identity":"npm:eslint-visitor-keys","label":"eslint-visitor-keys","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["3.4.3","5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:espree","slug":"espree-00afe3f4","identity":"npm:espree","label":"espree","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["11.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:esprima","slug":"esprima-33701895","identity":"npm:esprima","label":"esprima","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["4.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:esquery","slug":"esquery-c9ae3aa0","identity":"npm:esquery","label":"esquery","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:esrecurse","slug":"esrecurse-4abfbbe8","identity":"npm:esrecurse","label":"esrecurse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["4.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:estraverse","slug":"estraverse-042e57d4","identity":"npm:estraverse","label":"estraverse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["5.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:estree-util-is-identifier-name","slug":"estree-util-is-identifier-name-16401954","identity":"npm:estree-util-is-identifier-name","label":"estree-util-is-identifier-name","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:esutils","slug":"esutils-333daa20","identity":"npm:esutils","label":"esutils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:etag","slug":"etag-5bf82a9a","identity":"npm:etag","label":"etag","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.8.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:eventemitter3","slug":"eventemitter3-dd086b94","identity":"npm:eventemitter3","label":"eventemitter3","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:eventsource","slug":"eventsource-b1d9e25a","identity":"npm:eventsource","label":"eventsource","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:eventsource-parser","slug":"eventsource-parser-1bfc59a5","identity":"npm:eventsource-parser","label":"eventsource-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:execa","slug":"execa-1234354e","identity":"npm:execa","label":"execa","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.1.1","9.6.1"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:executing","slug":"executing-36845a5b","identity":"pypi:executing","label":"executing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:express","slug":"express-1db97c49","identity":"npm:express","label":"express","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:express-rate-limit","slug":"express-rate-limit-d59e1958","identity":"npm:express-rate-limit","label":"express-rate-limit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.5.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:extend","slug":"extend-a49ffc1d","identity":"npm:extend","label":"extend","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fast-deep-equal","slug":"fast-deep-equal-9efeb437","identity":"npm:fast-deep-equal","label":"fast-deep-equal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fast-glob","slug":"fast-glob-252e51fb","identity":"npm:fast-glob","label":"fast-glob","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fast-json-stable-stringify","slug":"fast-json-stable-stringify-178e5c18","identity":"npm:fast-json-stable-stringify","label":"fast-json-stable-stringify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:fast-levenshtein","slug":"fast-levenshtein-08886bf2","identity":"npm:fast-levenshtein","label":"fast-levenshtein","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:fastapi","slug":"fastapi-e52fd482","identity":"pypi:fastapi","label":"fastapi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.141.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:fastq","slug":"fastq-cc3d7764","identity":"npm:fastq","label":"fastq","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.20.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fdir","slug":"fdir-d78fecd4","identity":"npm:fdir","label":"fdir","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:figures","slug":"figures-d69096f0","identity":"npm:figures","label":"figures","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:file-entry-cache","slug":"file-entry-cache-126c69d4","identity":"npm:file-entry-cache","label":"file-entry-cache","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.1.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:fill-range","slug":"fill-range-2ea43335","identity":"npm:fill-range","label":"fill-range","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:finalhandler","slug":"finalhandler-7a4e31f4","identity":"npm:finalhandler","label":"finalhandler","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:find-up","slug":"find-up-bf684d3a","identity":"npm:find-up","label":"find-up","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:flat-cache","slug":"flat-cache-b7f57c59","identity":"npm:flat-cache","label":"flat-cache","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.1.23"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:flatbuffers","slug":"flatbuffers-90c67795","identity":"pypi:flatbuffers","label":"flatbuffers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["25.12.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:forwarded","slug":"forwarded-752269ca","identity":"npm:forwarded","label":"forwarded","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fresh","slug":"fresh-eb605422","identity":"npm:fresh","label":"fresh","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:frozenlist","slug":"frozenlist-110237da","identity":"pypi:frozenlist","label":"frozenlist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:fs-extra","slug":"fs-extra-d5f614b1","identity":"npm:fs-extra","label":"fs-extra","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.3.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fsevents","slug":"fsevents-f43d69ec","identity":"npm:fsevents","label":"fsevents","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:function-bind","slug":"function-bind-45751970","identity":"npm:function-bind","label":"function-bind","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:fuzzysort","slug":"fuzzysort-795a26a9","identity":"npm:fuzzysort","label":"fuzzysort","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:gensync","slug":"gensync-102f0859","identity":"npm:gensync","label":"gensync","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0-beta.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-east-asian-width","slug":"get-east-asian-width-fa28f6a7","identity":"npm:get-east-asian-width","label":"get-east-asian-width","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-intrinsic","slug":"get-intrinsic-2b696d7d","identity":"npm:get-intrinsic","label":"get-intrinsic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-nonce","slug":"get-nonce-a5be7768","identity":"npm:get-nonce","label":"get-nonce","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-own-enumerable-keys","slug":"get-own-enumerable-keys-eaae0cb2","identity":"npm:get-own-enumerable-keys","label":"get-own-enumerable-keys","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-proto","slug":"get-proto-1cc62888","identity":"npm:get-proto","label":"get-proto","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:get-stream","slug":"get-stream-320a5eb9","identity":"npm:get-stream","label":"get-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.1","9.0.1"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:ghp-import","slug":"ghp-import-17055206","identity":"pypi:ghp-import","label":"ghp-import","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:gitdb","slug":"gitdb-dac4580b","identity":"pypi:gitdb","label":"gitdb","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["4.0.12"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:github-slugger","slug":"github-slugger-71153285","identity":"npm:github-slugger","label":"github-slugger","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:glob-parent","slug":"glob-parent-3d212448","identity":"npm:glob-parent","label":"glob-parent","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["5.1.2","6.0.2"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:globals","slug":"globals-6245888b","identity":"npm:globals","label":"globals","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["17.12.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:goober","slug":"goober-129a261c","identity":"npm:goober","label":"goober","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.19"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:googleapis-common-protos","slug":"googleapis-common-protos-d5ca3481","identity":"pypi:googleapis-common-protos","label":"googleapis-common-protos","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.75.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:gopd","slug":"gopd-3abcb949","identity":"npm:gopd","label":"gopd","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:graceful-fs","slug":"graceful-fs-0b6c8932","identity":"npm:graceful-fs","label":"graceful-fs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["4.2.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:greenlet","slug":"greenlet-cd6f7934","identity":"pypi:greenlet","label":"greenlet","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","MIT AND PSF-2.0","MIT AND Python-2.0"],"versions":["3.5.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:griffelib","slug":"griffelib-750f9275","identity":"pypi:griffelib","label":"griffelib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["2.3.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:has-symbols","slug":"has-symbols-4abfccb0","identity":"npm:has-symbols","label":"has-symbols","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:has-tostringtag","slug":"has-tostringtag-ca3c086c","identity":"npm:has-tostringtag","label":"has-tostringtag","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hashery","slug":"hashery-699de3fd","identity":"npm:hashery","label":"hashery","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:hasown","slug":"hasown-c4159556","identity":"npm:hasown","label":"hasown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-from-html","slug":"hast-util-from-html-b7fa7ac7","identity":"npm:hast-util-from-html","label":"hast-util-from-html","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-from-parse5","slug":"hast-util-from-parse5-4eaf729b","identity":"npm:hast-util-from-parse5","label":"hast-util-from-parse5","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-has-property","slug":"hast-util-has-property-78931d31","identity":"npm:hast-util-has-property","label":"hast-util-has-property","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-heading-rank","slug":"hast-util-heading-rank-e117b11e","identity":"npm:hast-util-heading-rank","label":"hast-util-heading-rank","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-is-element","slug":"hast-util-is-element-3bc52b2c","identity":"npm:hast-util-is-element","label":"hast-util-is-element","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-parse-selector","slug":"hast-util-parse-selector-e8996606","identity":"npm:hast-util-parse-selector","label":"hast-util-parse-selector","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-raw","slug":"hast-util-raw-c7946ecc","identity":"npm:hast-util-raw","label":"hast-util-raw","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-select","slug":"hast-util-select-463d3ede","identity":"npm:hast-util-select","label":"hast-util-select","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-to-html","slug":"hast-util-to-html-f4ac12ec","identity":"npm:hast-util-to-html","label":"hast-util-to-html","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-to-jsx-runtime","slug":"hast-util-to-jsx-runtime-7e0c3661","identity":"npm:hast-util-to-jsx-runtime","label":"hast-util-to-jsx-runtime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-to-parse5","slug":"hast-util-to-parse5-89ad8f13","identity":"npm:hast-util-to-parse5","label":"hast-util-to-parse5","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-to-string","slug":"hast-util-to-string-936c8d7e","identity":"npm:hast-util-to-string","label":"hast-util-to-string","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hast-util-whitespace","slug":"hast-util-whitespace-8daf8cab","identity":"npm:hast-util-whitespace","label":"hast-util-whitespace","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hastscript","slug":"hastscript-3c8216dc","identity":"npm:hastscript","label":"hastscript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hermes-estree","slug":"hermes-estree-aea47267","identity":"npm:hermes-estree","label":"hermes-estree","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.25.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:hermes-parser","slug":"hermes-parser-e7c3b0a8","identity":"npm:hermes-parser","label":"hermes-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.25.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:hono","slug":"hono-02d807eb","identity":"npm:hono","label":"hono","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.13.13"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:hookified","slug":"hookified-81aa52fa","identity":"npm:hookified","label":"hookified","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.15.1","2.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:html-url-attributes","slug":"html-url-attributes-f6365024","identity":"npm:html-url-attributes","label":"html-url-attributes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:html-void-elements","slug":"html-void-elements-fe14cfa5","identity":"npm:html-void-elements","label":"html-void-elements","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:http-errors","slug":"http-errors-a224027f","identity":"npm:http-errors","label":"http-errors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:httpcore","slug":"httpcore-ba6ae671","identity":"pypi:httpcore","label":"httpcore","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.0.9"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:https-proxy-agent","slug":"https-proxy-agent-0ae16386","identity":"npm:https-proxy-agent","label":"https-proxy-agent","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:httptools","slug":"httptools-b6cca685","identity":"pypi:httptools","label":"httptools","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:httpx","slug":"httpx-a512a166","identity":"pypi:httpx","label":"httpx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.28.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:httpx-sse","slug":"httpx-sse-0029fe64","identity":"pypi:httpx-sse","label":"httpx-sse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:human-signals","slug":"human-signals-f5f4f158","identity":"npm:human-signals","label":"human-signals","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.1.0","8.0.1"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:hyperframe","slug":"hyperframe-e8ff0952","identity":"pypi:hyperframe","label":"hyperframe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:iconv-lite","slug":"iconv-lite-cfec4972","identity":"npm:iconv-lite","label":"iconv-lite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:identify","slug":"identify-bd45ae56","identity":"pypi:identify","label":"identify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.6.20"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:ignore","slug":"ignore-3015b1fc","identity":"npm:ignore","label":"ignore","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.3.2","7.0.9"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:immer","slug":"immer-55532025","identity":"npm:immer","label":"immer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.1.18"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:import-fresh","slug":"import-fresh-66023a8c","identity":"npm:import-fresh","label":"import-fresh","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:imurmurhash","slug":"imurmurhash-24981ac0","identity":"npm:imurmurhash","label":"imurmurhash","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:inherits","slug":"inherits-bef218e5","identity":"npm:inherits","label":"inherits","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["2.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:iniconfig","slug":"iniconfig-1f66e358","identity":"pypi:iniconfig","label":"iniconfig","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:inline-style-parser","slug":"inline-style-parser-1aeed0d8","identity":"npm:inline-style-parser","label":"inline-style-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:input-otp","slug":"input-otp-b2c180c5","identity":"npm:input-otp","label":"input-otp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:internmap","slug":"internmap-00fa1d76","identity":"npm:internmap","label":"internmap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:ipaddr.js","slug":"ipaddr-js-20a3bae6","identity":"npm:ipaddr.js","label":"ipaddr.js","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.9.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:ipdb","slug":"ipdb-fbd53910","identity":"pypi:ipdb","label":"ipdb","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.13.13"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ipython","slug":"ipython-7a140323","identity":"pypi:ipython","label":"ipython","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["9.17.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ipython-pygments-lexers","slug":"ipython-pygments-lexers-6216051e","identity":"pypi:ipython-pygments-lexers","label":"ipython-pygments-lexers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:is-alphabetical","slug":"is-alphabetical-796b345e","identity":"npm:is-alphabetical","label":"is-alphabetical","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-alphanumerical","slug":"is-alphanumerical-7faaa48c","identity":"npm:is-alphanumerical","label":"is-alphanumerical","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-arrayish","slug":"is-arrayish-aba830f6","identity":"npm:is-arrayish","label":"is-arrayish","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-decimal","slug":"is-decimal-2f11a7f7","identity":"npm:is-decimal","label":"is-decimal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-docker","slug":"is-docker-8be7f538","identity":"npm:is-docker","label":"is-docker","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-extglob","slug":"is-extglob-1afbb12e","identity":"npm:is-extglob","label":"is-extglob","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-glob","slug":"is-glob-dc8c90d2","identity":"npm:is-glob","label":"is-glob","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-hexadecimal","slug":"is-hexadecimal-f99521ce","identity":"npm:is-hexadecimal","label":"is-hexadecimal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-in-ssh","slug":"is-in-ssh-f5e90a30","identity":"npm:is-in-ssh","label":"is-in-ssh","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-inside-container","slug":"is-inside-container-686bd0fe","identity":"npm:is-inside-container","label":"is-inside-container","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-interactive","slug":"is-interactive-195b706b","identity":"npm:is-interactive","label":"is-interactive","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-number","slug":"is-number-c0feb6a5","identity":"npm:is-number","label":"is-number","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-obj","slug":"is-obj-ef6d3426","identity":"npm:is-obj","label":"is-obj","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-plain-obj","slug":"is-plain-obj-f8b24205","identity":"npm:is-plain-obj","label":"is-plain-obj","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-promise","slug":"is-promise-04c84dd0","identity":"npm:is-promise","label":"is-promise","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-regexp","slug":"is-regexp-2d0c3977","identity":"npm:is-regexp","label":"is-regexp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-stream","slug":"is-stream-cebd7dab","identity":"npm:is-stream","label":"is-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1","4.0.1"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-unicode-supported","slug":"is-unicode-supported-28b534d6","identity":"npm:is-unicode-supported","label":"is-unicode-supported","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0","2.1.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:is-wsl","slug":"is-wsl-02f7fa6a","identity":"npm:is-wsl","label":"is-wsl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:isbot","slug":"isbot-62434f54","identity":"npm:isbot","label":"isbot","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Unlicense"],"versions":["5.1.39"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:isexe","slug":"isexe-47f89bdf","identity":"npm:isexe","label":"isexe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BlueOak-1.0.0","ISC"],"versions":["2.0.0","3.1.5"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:isodate","slug":"isodate-fdef8b9b","identity":"pypi:isodate","label":"isodate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:isort","slug":"isort-a8397697","identity":"pypi:isort","label":"isort","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jedi","slug":"jedi-9eb0c211","identity":"pypi:jedi","label":"jedi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.20.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jiter","slug":"jiter-d62b34e9","identity":"pypi:jiter","label":"jiter","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.17.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:jiti","slug":"jiti-82df3f95","identity":"npm:jiti","label":"jiti","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.7.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:jose","slug":"jose-3db1b283","identity":"npm:jose","label":"jose","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.2.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:js-tokens","slug":"js-tokens-8b3f06fa","identity":"npm:js-tokens","label":"js-tokens","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:jsesc","slug":"jsesc-96b39045","identity":"npm:jsesc","label":"jsesc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:json-parse-even-better-errors","slug":"json-parse-even-better-errors-49f997fe","identity":"npm:json-parse-even-better-errors","label":"json-parse-even-better-errors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:json-schema-traverse","slug":"json-schema-traverse-5fe5e658","identity":"npm:json-schema-traverse","label":"json-schema-traverse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.1","1.0.0"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:json-schema-typed","slug":"json-schema-typed-e82a9ee2","identity":"npm:json-schema-typed","label":"json-schema-typed","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["8.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:json-stable-stringify-without-jsonify","slug":"json-stable-stringify-without-jsonify-58ac8634","identity":"npm:json-stable-stringify-without-jsonify","label":"json-stable-stringify-without-jsonify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:json5","slug":"json5-2e47090b","identity":"npm:json5","label":"json5","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:jsonfile","slug":"jsonfile-a7643986","identity":"npm:jsonfile","label":"jsonfile","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:jsonschema","slug":"jsonschema-df23f5cd","identity":"pypi:jsonschema","label":"jsonschema","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.26.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:jsonschema-specifications","slug":"jsonschema-specifications-5d87863a","identity":"pypi:jsonschema-specifications","label":"jsonschema-specifications","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2025.9.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:keyv","slug":"keyv-f710ed0f","identity":"npm:keyv","label":"keyv","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:kleur","slug":"kleur-37f67ac0","identity":"npm:kleur","label":"kleur","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.3","4.1.5"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:levn","slug":"levn-1b7ee804","identity":"npm:levn","label":"levn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:librt","slug":"librt-be98c166","identity":"pypi:librt","label":"librt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.16.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:libsass","slug":"libsass-a516c5c0","identity":"pypi:libsass","label":"libsass","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.23.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:lightningcss","slug":"lightningcss-c58528d1","identity":"npm:lightningcss","label":"lightningcss","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-android-arm64","slug":"lightningcss-android-arm64-9590ce22","identity":"npm:lightningcss-android-arm64","label":"lightningcss-android-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-darwin-arm64","slug":"lightningcss-darwin-arm64-f50d3ffb","identity":"npm:lightningcss-darwin-arm64","label":"lightningcss-darwin-arm64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-darwin-x64","slug":"lightningcss-darwin-x64-d1e6258e","identity":"npm:lightningcss-darwin-x64","label":"lightningcss-darwin-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-freebsd-x64","slug":"lightningcss-freebsd-x64-980efbea","identity":"npm:lightningcss-freebsd-x64","label":"lightningcss-freebsd-x64","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-linux-arm-gnueabihf","slug":"lightningcss-linux-arm-gnueabihf-fa17a0b9","identity":"npm:lightningcss-linux-arm-gnueabihf","label":"lightningcss-linux-arm-gnueabihf","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-linux-arm64-gnu","slug":"lightningcss-linux-arm64-gnu-94e49992","identity":"npm:lightningcss-linux-arm64-gnu","label":"lightningcss-linux-arm64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-linux-arm64-musl","slug":"lightningcss-linux-arm64-musl-6ab82229","identity":"npm:lightningcss-linux-arm64-musl","label":"lightningcss-linux-arm64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-linux-x64-gnu","slug":"lightningcss-linux-x64-gnu-7ca4fe6b","identity":"npm:lightningcss-linux-x64-gnu","label":"lightningcss-linux-x64-gnu","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-linux-x64-musl","slug":"lightningcss-linux-x64-musl-58b7df26","identity":"npm:lightningcss-linux-x64-musl","label":"lightningcss-linux-x64-musl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-win32-arm64-msvc","slug":"lightningcss-win32-arm64-msvc-611f8e1b","identity":"npm:lightningcss-win32-arm64-msvc","label":"lightningcss-win32-arm64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lightningcss-win32-x64-msvc","slug":"lightningcss-win32-x64-msvc-a0bbc0ce","identity":"npm:lightningcss-win32-x64-msvc","label":"lightningcss-win32-x64-msvc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.32.0","1.33.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:limits","slug":"limits-3fbfd900","identity":"pypi:limits","label":"limits","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.8.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:lines-and-columns","slug":"lines-and-columns-2a720476","identity":"npm:lines-and-columns","label":"lines-and-columns","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:llvmlite","slug":"llvmlite-7b5a17d5","identity":"pypi:llvmlite","label":"llvmlite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","BSD-2-Clause","BSD-2-Clause AND Apache-2.0 WITH LLVM-exception","non-standard"],"versions":["0.50.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:locate-path","slug":"locate-path-b0cb3d76","identity":"npm:locate-path","label":"locate-path","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:log-symbols","slug":"log-symbols-772a44bf","identity":"npm:log-symbols","label":"log-symbols","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:loguru","slug":"loguru-e43ce3bb","identity":"pypi:loguru","label":"loguru","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.7.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:longest-streak","slug":"longest-streak-29a5f621","identity":"npm:longest-streak","label":"longest-streak","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:loudness","slug":"loudness-06e89bbf","identity":"pypi:loudness","label":"loudness","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:lru-cache","slug":"lru-cache-e88912e8","identity":"npm:lru-cache","label":"lru-cache","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BlueOak-1.0.0","ISC"],"versions":["5.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:lucide-react","slug":"lucide-react-a154fc81","identity":"npm:lucide-react","label":"lucide-react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.48.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:magic-string","slug":"magic-string-57707138","identity":"npm:magic-string","label":"magic-string","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.30.21"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:markdown-it-py","slug":"markdown-it-py-27073f5e","identity":"pypi:markdown-it-py","label":"markdown-it-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:markdown-table","slug":"markdown-table-6bc447bb","identity":"npm:markdown-table","label":"markdown-table","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:markupsafe","slug":"markupsafe-1bdd4c7f","identity":"pypi:markupsafe","label":"markupsafe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:math-intrinsics","slug":"math-intrinsics-8ccaf44c","identity":"npm:math-intrinsics","label":"math-intrinsics","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:matplotlib-inline","slug":"matplotlib-inline-50f95e0d","identity":"pypi:matplotlib-inline","label":"matplotlib-inline","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mccabe","slug":"mccabe-dd4f88ab","identity":"pypi:mccabe","label":"mccabe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:mdast-util-find-and-replace","slug":"mdast-util-find-and-replace-a446a0eb","identity":"npm:mdast-util-find-and-replace","label":"mdast-util-find-and-replace","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-from-markdown","slug":"mdast-util-from-markdown-400c606c","identity":"npm:mdast-util-from-markdown","label":"mdast-util-from-markdown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm","slug":"mdast-util-gfm-091e29c3","identity":"npm:mdast-util-gfm","label":"mdast-util-gfm","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm-autolink-literal","slug":"mdast-util-gfm-autolink-literal-48f344f0","identity":"npm:mdast-util-gfm-autolink-literal","label":"mdast-util-gfm-autolink-literal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm-footnote","slug":"mdast-util-gfm-footnote-bd727231","identity":"npm:mdast-util-gfm-footnote","label":"mdast-util-gfm-footnote","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm-strikethrough","slug":"mdast-util-gfm-strikethrough-190e64fd","identity":"npm:mdast-util-gfm-strikethrough","label":"mdast-util-gfm-strikethrough","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm-table","slug":"mdast-util-gfm-table-a1aad123","identity":"npm:mdast-util-gfm-table","label":"mdast-util-gfm-table","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-gfm-task-list-item","slug":"mdast-util-gfm-task-list-item-268dddc7","identity":"npm:mdast-util-gfm-task-list-item","label":"mdast-util-gfm-task-list-item","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-mdx-expression","slug":"mdast-util-mdx-expression-561b68a8","identity":"npm:mdast-util-mdx-expression","label":"mdast-util-mdx-expression","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-mdx-jsx","slug":"mdast-util-mdx-jsx-904d32a8","identity":"npm:mdast-util-mdx-jsx","label":"mdast-util-mdx-jsx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-mdxjs-esm","slug":"mdast-util-mdxjs-esm-b0facab2","identity":"npm:mdast-util-mdxjs-esm","label":"mdast-util-mdxjs-esm","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-phrasing","slug":"mdast-util-phrasing-29a5c68e","identity":"npm:mdast-util-phrasing","label":"mdast-util-phrasing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-to-markdown","slug":"mdast-util-to-markdown-19aea245","identity":"npm:mdast-util-to-markdown","label":"mdast-util-to-markdown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mdast-util-to-string","slug":"mdast-util-to-string-04f6a9c9","identity":"npm:mdast-util-to-string","label":"mdast-util-to-string","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:mdurl","slug":"mdurl-e6f5f075","identity":"pypi:mdurl","label":"mdurl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:media-typer","slug":"media-typer-fd5f066e","identity":"npm:media-typer","label":"media-typer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:merge-descriptors","slug":"merge-descriptors-16241c3a","identity":"npm:merge-descriptors","label":"merge-descriptors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:merge-stream","slug":"merge-stream-d0a3d295","identity":"npm:merge-stream","label":"merge-stream","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:merge2","slug":"merge2-39f0191e","identity":"npm:merge2","label":"merge2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:mergedeep","slug":"mergedeep-77a23f49","identity":"pypi:mergedeep","label":"mergedeep","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:micromark","slug":"micromark-55bbc568","identity":"npm:micromark","label":"micromark","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-core-commonmark","slug":"micromark-core-commonmark-195430fe","identity":"npm:micromark-core-commonmark","label":"micromark-core-commonmark","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm","slug":"micromark-extension-gfm-d83f6864","identity":"npm:micromark-extension-gfm","label":"micromark-extension-gfm","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-autolink-literal","slug":"micromark-extension-gfm-autolink-literal-6fb38d16","identity":"npm:micromark-extension-gfm-autolink-literal","label":"micromark-extension-gfm-autolink-literal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-footnote","slug":"micromark-extension-gfm-footnote-972092cc","identity":"npm:micromark-extension-gfm-footnote","label":"micromark-extension-gfm-footnote","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-strikethrough","slug":"micromark-extension-gfm-strikethrough-e57211a9","identity":"npm:micromark-extension-gfm-strikethrough","label":"micromark-extension-gfm-strikethrough","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-table","slug":"micromark-extension-gfm-table-2cfc1887","identity":"npm:micromark-extension-gfm-table","label":"micromark-extension-gfm-table","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-tagfilter","slug":"micromark-extension-gfm-tagfilter-39b91d25","identity":"npm:micromark-extension-gfm-tagfilter","label":"micromark-extension-gfm-tagfilter","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-extension-gfm-task-list-item","slug":"micromark-extension-gfm-task-list-item-dad1b650","identity":"npm:micromark-extension-gfm-task-list-item","label":"micromark-extension-gfm-task-list-item","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-factory-destination","slug":"micromark-factory-destination-293963ae","identity":"npm:micromark-factory-destination","label":"micromark-factory-destination","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-factory-label","slug":"micromark-factory-label-3ab1ecf9","identity":"npm:micromark-factory-label","label":"micromark-factory-label","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-factory-space","slug":"micromark-factory-space-c47a5adb","identity":"npm:micromark-factory-space","label":"micromark-factory-space","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-factory-title","slug":"micromark-factory-title-ece0d9b2","identity":"npm:micromark-factory-title","label":"micromark-factory-title","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-factory-whitespace","slug":"micromark-factory-whitespace-04b6efd9","identity":"npm:micromark-factory-whitespace","label":"micromark-factory-whitespace","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-character","slug":"micromark-util-character-7601c4de","identity":"npm:micromark-util-character","label":"micromark-util-character","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-chunked","slug":"micromark-util-chunked-101a1909","identity":"npm:micromark-util-chunked","label":"micromark-util-chunked","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-classify-character","slug":"micromark-util-classify-character-de955105","identity":"npm:micromark-util-classify-character","label":"micromark-util-classify-character","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-combine-extensions","slug":"micromark-util-combine-extensions-5b258c79","identity":"npm:micromark-util-combine-extensions","label":"micromark-util-combine-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-decode-numeric-character-reference","slug":"micromark-util-decode-numeric-character-reference-69132fb7","identity":"npm:micromark-util-decode-numeric-character-reference","label":"micromark-util-decode-numeric-character-reference","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-decode-string","slug":"micromark-util-decode-string-a0d91cc4","identity":"npm:micromark-util-decode-string","label":"micromark-util-decode-string","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-encode","slug":"micromark-util-encode-2a1c6cb9","identity":"npm:micromark-util-encode","label":"micromark-util-encode","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-html-tag-name","slug":"micromark-util-html-tag-name-02488597","identity":"npm:micromark-util-html-tag-name","label":"micromark-util-html-tag-name","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-normalize-identifier","slug":"micromark-util-normalize-identifier-a9758761","identity":"npm:micromark-util-normalize-identifier","label":"micromark-util-normalize-identifier","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-resolve-all","slug":"micromark-util-resolve-all-0f225c93","identity":"npm:micromark-util-resolve-all","label":"micromark-util-resolve-all","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-sanitize-uri","slug":"micromark-util-sanitize-uri-44638e5e","identity":"npm:micromark-util-sanitize-uri","label":"micromark-util-sanitize-uri","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-subtokenize","slug":"micromark-util-subtokenize-bbc2eccf","identity":"npm:micromark-util-subtokenize","label":"micromark-util-subtokenize","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-symbol","slug":"micromark-util-symbol-0cbff0df","identity":"npm:micromark-util-symbol","label":"micromark-util-symbol","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromark-util-types","slug":"micromark-util-types-ac5660bc","identity":"npm:micromark-util-types","label":"micromark-util-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:micromatch","slug":"micromatch-5e92d7dd","identity":"npm:micromatch","label":"micromatch","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mime-db","slug":"mime-db-2aca89e7","identity":"npm:mime-db","label":"mime-db","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.52.0","1.54.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mime-types","slug":"mime-types-a32c45ef","identity":"npm:mime-types","label":"mime-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.35","3.0.2"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mimic-fn","slug":"mimic-fn-1b56a239","identity":"npm:mimic-fn","label":"mimic-fn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:mimic-function","slug":"mimic-function-5b93d1fd","identity":"npm:mimic-function","label":"mimic-function","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:minimist","slug":"minimist-f0c39d1e","identity":"npm:minimist","label":"minimist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:mkdocs","slug":"mkdocs-a74efb5d","identity":"pypi:mkdocs","label":"mkdocs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["1.6.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mkdocs-get-deps","slug":"mkdocs-get-deps-504099a6","identity":"pypi:mkdocs-get-deps","label":"mkdocs-get-deps","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mkdocs-material","slug":"mkdocs-material-59ad908c","identity":"pypi:mkdocs-material","label":"mkdocs-material","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.7.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mkdocs-material-extensions","slug":"mkdocs-material-extensions-9672e965","identity":"pypi:mkdocs-material-extensions","label":"mkdocs-material-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mkdocs-to-pdf","slug":"mkdocs-to-pdf-41f8f7a9","identity":"pypi:mkdocs-to-pdf","label":"mkdocs-to-pdf","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.12.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mpmath","slug":"mpmath-4ccb7a41","identity":"pypi:mpmath","label":"mpmath","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:ms","slug":"ms-1f5985e4","identity":"npm:ms","label":"ms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:mypy","slug":"mypy-2008b5d3","identity":"pypi:mypy","label":"mypy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mypy-extensions","slug":"mypy-extensions-702f6cf3","identity":"pypi:mypy-extensions","label":"mypy-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:natural-compare","slug":"natural-compare-948a7244","identity":"npm:natural-compare","label":"natural-compare","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:negotiator","slug":"negotiator-44ced9f0","identity":"npm:negotiator","label":"negotiator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:next-themes","slug":"next-themes-9e7031bb","identity":"npm:next-themes","label":"next-themes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:node-releases","slug":"node-releases-e645deb1","identity":"npm:node-releases","label":"node-releases","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.56"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:nodeenv","slug":"nodeenv-71203cea","identity":"pypi:nodeenv","label":"nodeenv","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["1.11.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:npm-run-path","slug":"npm-run-path-b2a4132a","identity":"npm:npm-run-path","label":"npm-run-path","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.1","6.0.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:nth-check","slug":"nth-check-0cd8cb4c","identity":"npm:nth-check","label":"nth-check","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["2.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:num2words","slug":"num2words-21434d3a","identity":"pypi:num2words","label":"num2words","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.1"],"versions":["0.5.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:numba","slug":"numba-4cc2d278","identity":"pypi:numba","label":"numba","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.68.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:numpy","slug":"numpy-ba79b98d","identity":"pypi:numpy","label":"numpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib","non-standard"],"versions":["2.5.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:object-assign","slug":"object-assign-fa9dc3dc","identity":"npm:object-assign","label":"object-assign","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:object-inspect","slug":"object-inspect-e860635c","identity":"npm:object-inspect","label":"object-inspect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.13.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:object-treeify","slug":"object-treeify-b80577d7","identity":"npm:object-treeify","label":"object-treeify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.33"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:on-finished","slug":"on-finished-7268054d","identity":"npm:on-finished","label":"on-finished","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:once","slug":"once-15d11e4d","identity":"npm:once","label":"once","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:onetime","slug":"onetime-a2a82057","identity":"npm:onetime","label":"onetime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.1.2","7.0.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:onnxruntime","slug":"onnxruntime-5acdb617","identity":"pypi:onnxruntime","label":"onnxruntime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.24.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:open","slug":"open-ea526a80","identity":"npm:open","label":"open","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:openai-agents","slug":"openai-agents-9a2ca669","identity":"pypi:openai-agents","label":"openai-agents","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.13.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-http-transport","slug":"opentelemetry-exporter-http-transport-6aa16cfc","identity":"pypi:opentelemetry-exporter-http-transport","label":"opentelemetry-exporter-http-transport","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.66b1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-common","slug":"opentelemetry-exporter-otlp-common-1383434b","identity":"pypi:opentelemetry-exporter-otlp-common","label":"opentelemetry-exporter-otlp-common","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.66b1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-proto-common","slug":"opentelemetry-exporter-otlp-proto-common-636ba371","identity":"pypi:opentelemetry-exporter-otlp-proto-common","label":"opentelemetry-exporter-otlp-proto-common","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.45.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-proto-http","slug":"opentelemetry-exporter-otlp-proto-http-6f55af01","identity":"pypi:opentelemetry-exporter-otlp-proto-http","label":"opentelemetry-exporter-otlp-proto-http","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.45.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-proto","slug":"opentelemetry-proto-f15a3372","identity":"pypi:opentelemetry-proto","label":"opentelemetry-proto","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.45.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-sdk","slug":"opentelemetry-sdk-38b86085","identity":"pypi:opentelemetry-sdk","label":"opentelemetry-sdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.45.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:opentelemetry-semantic-conventions","slug":"opentelemetry-semantic-conventions-15f3be17","identity":"pypi:opentelemetry-semantic-conventions","label":"opentelemetry-semantic-conventions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.66b1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:optionator","slug":"optionator-8de2d3ef","identity":"npm:optionator","label":"optionator","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:ora","slug":"ora-e208f4d8","identity":"npm:ora","label":"ora","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:p-limit","slug":"p-limit-989e28a2","identity":"npm:p-limit","label":"p-limit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:p-locate","slug":"p-locate-df7c6699","identity":"npm:p-locate","label":"p-locate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:packaging","slug":"packaging-78ee1f47","identity":"pypi:packaging","label":"packaging","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 OR BSD-2-Clause","non-standard"],"versions":["26.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:paginate","slug":"paginate-5ae8b120","identity":"pypi:paginate","label":"paginate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.5.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:parent-module","slug":"parent-module-09f7937b","identity":"npm:parent-module","label":"parent-module","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parse-entities","slug":"parse-entities-5c37e9d8","identity":"npm:parse-entities","label":"parse-entities","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parse-json","slug":"parse-json-f7a0a4f2","identity":"npm:parse-json","label":"parse-json","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parse-ms","slug":"parse-ms-29a5c8ce","identity":"npm:parse-ms","label":"parse-ms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parse-numeric-range","slug":"parse-numeric-range-12084147","identity":"npm:parse-numeric-range","label":"parse-numeric-range","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parse5","slug":"parse5-7a4b420d","identity":"npm:parse5","label":"parse5","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:parseurl","slug":"parseurl-2b58ab3c","identity":"npm:parseurl","label":"parseurl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:parso","slug":"parso-fa59fdde","identity":"pypi:parso","label":"parso","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:path-browserify","slug":"path-browserify-4c14fc14","identity":"npm:path-browserify","label":"path-browserify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:path-exists","slug":"path-exists-912be959","identity":"npm:path-exists","label":"path-exists","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:path-key","slug":"path-key-369bc367","identity":"npm:path-key","label":"path-key","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.1","4.0.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:pathe","slug":"pathe-d655e854","identity":"npm:pathe","label":"pathe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:pathspec","slug":"pathspec-01378677","identity":"pypi:pathspec","label":"pathspec","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pexpect","slug":"pexpect-9ad65a0c","identity":"pypi:pexpect","label":"pexpect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["4.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:picocolors","slug":"picocolors-63d33c23","identity":"npm:picocolors","label":"picocolors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:pipecat-ai","slug":"pipecat-ai-3fa93743","identity":"pypi:pipecat-ai","label":"pipecat-ai","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["1.14.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:pkce-challenge","slug":"pkce-challenge-f9f15269","identity":"npm:pkce-challenge","label":"pkce-challenge","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:platformdirs","slug":"platformdirs-e64002f0","identity":"pypi:platformdirs","label":"platformdirs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.13.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pluggy","slug":"pluggy-24479aaf","identity":"pypi:pluggy","label":"pluggy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:postcss-selector-parser","slug":"postcss-selector-parser-e1de6cba","identity":"npm:postcss-selector-parser","label":"postcss-selector-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.1.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:powershell-utils","slug":"powershell-utils-6fdd7cc1","identity":"npm:powershell-utils","label":"powershell-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:pre-commit","slug":"pre-commit-6a196b54","identity":"pypi:pre-commit","label":"pre-commit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:prelude-ls","slug":"prelude-ls-64dbf7f1","identity":"npm:prelude-ls","label":"prelude-ls","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:prettier","slug":"prettier-48ef094b","identity":"npm:prettier","label":"prettier","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.9.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:prettier-plugin-tailwindcss","slug":"prettier-plugin-tailwindcss-9dc36172","identity":"npm:prettier-plugin-tailwindcss","label":"prettier-plugin-tailwindcss","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:pretty-ms","slug":"pretty-ms-09063416","identity":"npm:pretty-ms","label":"pretty-ms","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:prompt-toolkit","slug":"prompt-toolkit-e6f4118a","identity":"pypi:prompt-toolkit","label":"prompt-toolkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.0.53"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:prompts","slug":"prompts-86e18d33","identity":"npm:prompts","label":"prompts","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:propcache","slug":"propcache-1fcd6be4","identity":"pypi:propcache","label":"propcache","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.5.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:property-information","slug":"property-information-4a9b5253","identity":"npm:property-information","label":"property-information","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:proxy-from-env","slug":"proxy-from-env-30b120c8","identity":"npm:proxy-from-env","label":"proxy-from-env","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:psutil","slug":"psutil-840b9a74","identity":"pypi:psutil","label":"psutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["7.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ptyprocess","slug":"ptyprocess-ec2650c7","identity":"pypi:ptyprocess","label":"ptyprocess","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["0.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:punycode","slug":"punycode-ffd39662","identity":"npm:punycode","label":"punycode","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:pure-eval","slug":"pure-eval-24d2bc1c","identity":"pypi:pure-eval","label":"pure-eval","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pycparser","slug":"pycparser-102d9d3e","identity":"pypi:pycparser","label":"pycparser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pydantic","slug":"pydantic-4ac148ca","identity":"pypi:pydantic","label":"pydantic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.14.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pydantic-core","slug":"pydantic-core-f9814ebc","identity":"pypi:pydantic-core","label":"pydantic-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.50.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pydyf","slug":"pydyf-60de6213","identity":"pypi:pydyf","label":"pydyf","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.13.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pylint","slug":"pylint-25488847","identity":"pypi:pylint","label":"pylint","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["GPL-2.0-or-later"],"versions":["4.0.10"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyphen","slug":"pyphen-9e168dac","identity":"pypi:pyphen","label":"pyphen","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["GPL-2.0-or-later","LGPL-2.0-or-later","MPL-1.1"],"versions":["0.18.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytest-asyncio","slug":"pytest-asyncio-5e711c5a","identity":"pypi:pytest-asyncio","label":"pytest-asyncio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytest-rerunfailures","slug":"pytest-rerunfailures-4c7ba7f5","identity":"pypi:pytest-rerunfailures","label":"pytest-rerunfailures","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["16.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytest-timeout","slug":"pytest-timeout-60d0ba05","identity":"pypi:pytest-timeout","label":"pytest-timeout","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-barcode","slug":"python-barcode-38ddfa72","identity":"pypi:python-barcode","label":"python-barcode","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.16.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-dateutil","slug":"python-dateutil-8eac96b7","identity":"pypi:python-dateutil","label":"python-dateutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.9.0.post0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-discovery","slug":"python-discovery-6dfeea81","identity":"pypi:python-discovery","label":"python-discovery","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.6.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-gitlab","slug":"python-gitlab-ca77f17a","identity":"pypi:python-gitlab","label":"python-gitlab","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-3.0-or-later"],"versions":["8.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-semantic-release","slug":"python-semantic-release-abd077f0","identity":"pypi:python-semantic-release","label":"python-semantic-release","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pywin32","slug":"pywin32-9a7c83ae","identity":"pypi:pywin32","label":"pywin32","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["312"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyyaml","slug":"pyyaml-16000901","identity":"pypi:pyyaml","label":"pyyaml","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:pyyaml-env-tag","slug":"pyyaml-env-tag-7c09b2b4","identity":"pypi:pyyaml-env-tag","label":"pyyaml-env-tag","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:qified","slug":"qified-75549a5f","identity":"npm:qified","label":"qified","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.10.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:qrcode","slug":"qrcode-dc7f5ffb","identity":"pypi:qrcode","label":"qrcode","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["8.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:queue-microtask","slug":"queue-microtask-3a600ba4","identity":"npm:queue-microtask","label":"queue-microtask","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:radix-ui","slug":"radix-ui-46d73883","identity":"npm:radix-ui","label":"radix-ui","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.6.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:range-parser","slug":"range-parser-64541a01","identity":"npm:range-parser","label":"range-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:raw-body","slug":"raw-body-ab6f4962","identity":"npm:raw-body","label":"raw-body","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react","slug":"react-29607ded","identity":"npm:react","label":"react","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["19.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-day-picker","slug":"react-day-picker-47672710","identity":"npm:react-day-picker","label":"react-day-picker","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-dom","slug":"react-dom-fb4a1520","identity":"npm:react-dom","label":"react-dom","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["19.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-is","slug":"react-is-d95e9978","identity":"npm:react-is","label":"react-is","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["19.2.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-markdown","slug":"react-markdown-62167450","identity":"npm:react-markdown","label":"react-markdown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-redux","slug":"react-redux-683d99aa","identity":"npm:react-redux","label":"react-redux","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-remove-scroll","slug":"react-remove-scroll-fb631c55","identity":"npm:react-remove-scroll","label":"react-remove-scroll","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.7.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-remove-scroll-bar","slug":"react-remove-scroll-bar-09543480","identity":"npm:react-remove-scroll-bar","label":"react-remove-scroll-bar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-resizable-panels","slug":"react-resizable-panels-8b9ad5c4","identity":"npm:react-resizable-panels","label":"react-resizable-panels","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.14.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:react-style-singleton","slug":"react-style-singleton-023f9f7d","identity":"npm:react-style-singleton","label":"react-style-singleton","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:readdirp","slug":"readdirp-8a27c4bc","identity":"npm:readdirp","label":"readdirp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:recast","slug":"recast-8192fc08","identity":"npm:recast","label":"recast","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.23.11"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:recharts","slug":"recharts-61e9d91c","identity":"npm:recharts","label":"recharts","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.10.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:redux","slug":"redux-4962b903","identity":"npm:redux","label":"redux","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:redux-thunk","slug":"redux-thunk-6e5de0fb","identity":"npm:redux-thunk","label":"redux-thunk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:referencing","slug":"referencing-b8d98ce1","identity":"pypi:referencing","label":"referencing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.37.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:refractor","slug":"refractor-d9f014dd","identity":"npm:refractor","label":"refractor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype","slug":"rehype-326ca846","identity":"npm:rehype","label":"rehype","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["13.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-attr","slug":"rehype-attr-ab618519","identity":"npm:rehype-attr","label":"rehype-attr","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-autolink-headings","slug":"rehype-autolink-headings-d314de6b","identity":"npm:rehype-autolink-headings","label":"rehype-autolink-headings","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-ignore","slug":"rehype-ignore-77a2340f","identity":"npm:rehype-ignore","label":"rehype-ignore","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-parse","slug":"rehype-parse-2e7c5ec2","identity":"npm:rehype-parse","label":"rehype-parse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-prism-plus","slug":"rehype-prism-plus-a723284c","identity":"npm:rehype-prism-plus","label":"rehype-prism-plus","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-raw","slug":"rehype-raw-f1f2bc28","identity":"npm:rehype-raw","label":"rehype-raw","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-rewrite","slug":"rehype-rewrite-674ca3a8","identity":"npm:rehype-rewrite","label":"rehype-rewrite","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-slug","slug":"rehype-slug-12617363","identity":"npm:rehype-slug","label":"rehype-slug","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:rehype-stringify","slug":"rehype-stringify-94c9fbb6","identity":"npm:rehype-stringify","label":"rehype-stringify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["10.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:remark-gfm","slug":"remark-gfm-7828ea76","identity":"npm:remark-gfm","label":"remark-gfm","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:remark-github-blockquote-alert","slug":"remark-github-blockquote-alert-7622d9a0","identity":"npm:remark-github-blockquote-alert","label":"remark-github-blockquote-alert","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:remark-parse","slug":"remark-parse-4812c797","identity":"npm:remark-parse","label":"remark-parse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:remark-rehype","slug":"remark-rehype-f68daab1","identity":"npm:remark-rehype","label":"remark-rehype","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:remark-stringify","slug":"remark-stringify-d466fc2a","identity":"npm:remark-stringify","label":"remark-stringify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:requests-toolbelt","slug":"requests-toolbelt-bb89e811","identity":"pypi:requests-toolbelt","label":"requests-toolbelt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:require-from-string","slug":"require-from-string-c13fac7a","identity":"npm:require-from-string","label":"require-from-string","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:resampy","slug":"resampy-8b55441c","identity":"pypi:resampy","label":"resampy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["0.4.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:reselect","slug":"reselect-ed47b27b","identity":"npm:reselect","label":"reselect","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.2.0","5.3.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:resolve-from","slug":"resolve-from-28917033","identity":"npm:resolve-from","label":"resolve-from","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:restore-cursor","slug":"restore-cursor-87a0e680","identity":"npm:restore-cursor","label":"restore-cursor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:reusify","slug":"reusify-3316f946","identity":"npm:reusify","label":"reusify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:rich","slug":"rich-23b343f7","identity":"pypi:rich","label":"rich","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["15.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:rolldown","slug":"rolldown-53931726","identity":"npm:rolldown","label":"rolldown","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:router","slug":"router-05a7fc6e","identity":"npm:router","label":"router","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:rpds-py","slug":"rpds-py-67c64be8","identity":"pypi:rpds-py","label":"rpds-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2026.9.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:ruff","slug":"ruff-d5943bdf","identity":"pypi:ruff","label":"ruff","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.16.10"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:run-applescript","slug":"run-applescript-39774afe","identity":"npm:run-applescript","label":"run-applescript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:run-parallel","slug":"run-parallel-50a8a921","identity":"npm:run-parallel","label":"run-parallel","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:safer-buffer","slug":"safer-buffer-ecb57a88","identity":"npm:safer-buffer","label":"safer-buffer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:scheduler","slug":"scheduler-f5eceb7d","identity":"npm:scheduler","label":"scheduler","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.28.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:scipy","slug":"scipy-215f884d","identity":"pypi:scipy","label":"scipy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.18.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:semver","slug":"semver-8e84695e","identity":"npm:semver","label":"semver","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["6.3.1","7.8.5"],"dossier":false,"occurrenceCount":3,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:send","slug":"send-d870dc25","identity":"npm:send","label":"send","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:sentencex","slug":"sentencex-dc1cf0e2","identity":"pypi:sentencex","label":"sentencex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.32"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:sentry-sdk","slug":"sentry-sdk-2727cc69","identity":"pypi:sentry-sdk","label":"sentry-sdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.72.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:seroval-plugins","slug":"seroval-plugins-5204bbff","identity":"npm:seroval-plugins","label":"seroval-plugins","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.6.7"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:serve-static","slug":"serve-static-9b722b2d","identity":"npm:serve-static","label":"serve-static","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:setprototypeof","slug":"setprototypeof-e3faf556","identity":"npm:setprototypeof","label":"setprototypeof","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:shadcn","slug":"shadcn-418c56ec","identity":"npm:shadcn","label":"shadcn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.21.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:shebang-command","slug":"shebang-command-e7e36d5c","identity":"npm:shebang-command","label":"shebang-command","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:shebang-regex","slug":"shebang-regex-37d0cef7","identity":"npm:shebang-regex","label":"shebang-regex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:shellingham","slug":"shellingham-fceabe5b","identity":"pypi:shellingham","label":"shellingham","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.5.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:side-channel","slug":"side-channel-d59c04c6","identity":"npm:side-channel","label":"side-channel","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:side-channel-list","slug":"side-channel-list-46f991b9","identity":"npm:side-channel-list","label":"side-channel-list","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:side-channel-map","slug":"side-channel-map-2deeb875","identity":"npm:side-channel-map","label":"side-channel-map","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:side-channel-weakmap","slug":"side-channel-weakmap-d3de1245","identity":"npm:side-channel-weakmap","label":"side-channel-weakmap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:signal-exit","slug":"signal-exit-81be8954","identity":"npm:signal-exit","label":"signal-exit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.0.7","4.1.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:sisteransi","slug":"sisteransi-4e7f1197","identity":"npm:sisteransi","label":"sisteransi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:six","slug":"six-3c3888bd","identity":"pypi:six","label":"six","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.17.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:slowapi","slug":"slowapi-f9a4c599","identity":"pypi:slowapi","label":"slowapi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.10"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:smart-buffer","slug":"smart-buffer-bf4702a2","identity":"npm:smart-buffer","label":"smart-buffer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:smmap","slug":"smmap-943fc5aa","identity":"pypi:smmap","label":"smmap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["5.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sniffio","slug":"sniffio-83f32c9d","identity":"pypi:sniffio","label":"sniffio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 OR MIT"],"versions":["1.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:socks","slug":"socks-d172a456","identity":"npm:socks","label":"socks","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.8.10"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:sonner","slug":"sonner-929a7298","identity":"npm:sonner","label":"sonner","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.8"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:soundfile","slug":"soundfile-10750d91","identity":"pypi:soundfile","label":"soundfile","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.13.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:source-map","slug":"source-map-40e335ad","identity":"npm:source-map","label":"source-map","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.6.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:soxr","slug":"soxr-a0701a3a","identity":"pypi:soxr","label":"soxr","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.0-or-later","LGPL-2.1-or-later"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:space-separated-tokens","slug":"space-separated-tokens-c471a577","identity":"npm:space-separated-tokens","label":"space-separated-tokens","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:sqlalchemy","slug":"sqlalchemy-5de7c53b","identity":"pypi:sqlalchemy","label":"sqlalchemy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:sse-starlette","slug":"sse-starlette-94ef666b","identity":"pypi:sse-starlette","label":"sse-starlette","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.5.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:stack-data","slug":"stack-data-d640fe0e","identity":"pypi:stack-data","label":"stack-data","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.6.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:statuses","slug":"statuses-c4dfedb5","identity":"npm:statuses","label":"statuses","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:stdin-discarder","slug":"stdin-discarder-f4e99411","identity":"npm:stdin-discarder","label":"stdin-discarder","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:string-width","slug":"string-width-79897e90","identity":"npm:string-width","label":"string-width","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:stringify-entities","slug":"stringify-entities-125d7ead","identity":"npm:stringify-entities","label":"stringify-entities","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:stringify-object","slug":"stringify-object-01a8c0cb","identity":"npm:stringify-object","label":"stringify-object","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:strip-ansi","slug":"strip-ansi-bbd27d8f","identity":"npm:strip-ansi","label":"strip-ansi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["7.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:strip-bom","slug":"strip-bom-9f52200c","identity":"npm:strip-bom","label":"strip-bom","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:strip-final-newline","slug":"strip-final-newline-40ad4c14","identity":"npm:strip-final-newline","label":"strip-final-newline","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.0","4.0.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:style-to-js","slug":"style-to-js-7af2bdaf","identity":"npm:style-to-js","label":"style-to-js","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.21"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:style-to-object","slug":"style-to-object-dc5ae31c","identity":"npm:style-to-object","label":"style-to-object","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.14"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:sympy","slug":"sympy-b30cb89e","identity":"pypi:sympy","label":"sympy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","MIT","non-standard"],"versions":["1.14.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:tailwind-merge","slug":"tailwind-merge-149e8091","identity":"npm:tailwind-merge","label":"tailwind-merge","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.7.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tailwindcss","slug":"tailwindcss-73c205c0","identity":"npm:tailwindcss","label":"tailwindcss","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tapable","slug":"tapable-41f824e6","identity":"npm:tapable","label":"tapable","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tiny-invariant","slug":"tiny-invariant-b42ee6ec","identity":"npm:tiny-invariant","label":"tiny-invariant","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:tinycss2","slug":"tinycss2-301fccf6","identity":"pypi:tinycss2","label":"tinycss2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:tinyglobby","slug":"tinyglobby-dc19540c","identity":"npm:tinyglobby","label":"tinyglobby","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.17"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:tinyhtml5","slug":"tinyhtml5-2f138940","identity":"pypi:tinyhtml5","label":"tinyhtml5","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:to-regex-range","slug":"to-regex-range-468662f2","identity":"npm:to-regex-range","label":"to-regex-range","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:toidentifier","slug":"toidentifier-d7c0e2d2","identity":"npm:toidentifier","label":"toidentifier","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:tomlkit","slug":"tomlkit-d5fa3fad","identity":"pypi:tomlkit","label":"tomlkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.15.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:traitlets","slug":"traitlets-52bd6ddb","identity":"pypi:traitlets","label":"traitlets","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["5.16.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:trim-lines","slug":"trim-lines-d6032ca4","identity":"npm:trim-lines","label":"trim-lines","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:trough","slug":"trough-9f16011a","identity":"npm:trough","label":"trough","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:ts-api-utils","slug":"ts-api-utils-07fd653b","identity":"npm:ts-api-utils","label":"ts-api-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:ts-morph","slug":"ts-morph-6d1fe574","identity":"npm:ts-morph","label":"ts-morph","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["26.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tsconfig-paths","slug":"tsconfig-paths-70d85491","identity":"npm:tsconfig-paths","label":"tsconfig-paths","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.2.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tslib","slug":"tslib-d05e0935","identity":"npm:tslib","label":"tslib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["0BSD"],"versions":["2.8.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:tw-animate-css","slug":"tw-animate-css-c0808f2a","identity":"npm:tw-animate-css","label":"tw-animate-css","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:twilio","slug":"twilio-fea8bb79","identity":"pypi:twilio","label":"twilio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["9.12.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:ty","slug":"ty-9d155882","identity":"pypi:ty","label":"ty","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.0.89"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:type-check","slug":"type-check-a7a05ff6","identity":"npm:type-check","label":"type-check","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:type-is","slug":"type-is-95471b5f","identity":"npm:type-is","label":"type-is","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:types-requests","slug":"types-requests-1c349d80","identity":"pypi:types-requests","label":"types-requests","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.33.0.20261006"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:types-ujson","slug":"types-ujson-a1c81a59","identity":"pypi:types-ujson","label":"types-ujson","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["5.10.0.20250822"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:typescript","slug":"typescript-9b49e36c","identity":"npm:typescript","label":"typescript","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["6.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:typescript-eslint","slug":"typescript-eslint-63885413","identity":"npm:typescript-eslint","label":"typescript-eslint","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.70.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":1,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","identity":"pypi:typing-extensions","label":"typing-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0","non-standard"],"versions":["4.16.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:typing-inspection","slug":"typing-inspection-0abeb500","identity":"pypi:typing-inspection","label":"typing-inspection","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:tzdata","slug":"tzdata-f80b3bb7","identity":"pypi:tzdata","label":"tzdata","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2026.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:undici-types","slug":"undici-types-385a20bc","identity":"npm:undici-types","label":"undici-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["8.9.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unicorn-magic","slug":"unicorn-magic-cc44159a","identity":"npm:unicorn-magic","label":"unicorn-magic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unified","slug":"unified-d3d1b160","identity":"npm:unified","label":"unified","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["11.0.5"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-filter","slug":"unist-util-filter-9d40f8ab","identity":"npm:unist-util-filter","label":"unist-util-filter","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-is","slug":"unist-util-is-500f2b54","identity":"npm:unist-util-is","label":"unist-util-is","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-position","slug":"unist-util-position-501a2562","identity":"npm:unist-util-position","label":"unist-util-position","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-stringify-position","slug":"unist-util-stringify-position-297cc0d5","identity":"npm:unist-util-stringify-position","label":"unist-util-stringify-position","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-visit","slug":"unist-util-visit-97738386","identity":"npm:unist-util-visit","label":"unist-util-visit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.0","5.1.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unist-util-visit-parents","slug":"unist-util-visit-parents-fed995ef","identity":"npm:unist-util-visit-parents","label":"unist-util-visit-parents","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:universalify","slug":"universalify-024c7947","identity":"npm:universalify","label":"universalify","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unpipe","slug":"unpipe-0327ee3f","identity":"npm:unpipe","label":"unpipe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:unplugin","slug":"unplugin-cc9b53f3","identity":"npm:unplugin","label":"unplugin","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:update-browserslist-db","slug":"update-browserslist-db-75400f27","identity":"npm:update-browserslist-db","label":"update-browserslist-db","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:uri-js","slug":"uri-js-1053a491","identity":"npm:uri-js","label":"uri-js","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["4.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:use-callback-ref","slug":"use-callback-ref-e82b364e","identity":"npm:use-callback-ref","label":"use-callback-ref","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:use-sidecar","slug":"use-sidecar-b0a9a935","identity":"npm:use-sidecar","label":"use-sidecar","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:use-sync-external-store","slug":"use-sync-external-store-085f0fd1","identity":"npm:use-sync-external-store","label":"use-sync-external-store","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.6.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:util-deprecate","slug":"util-deprecate-2b1985a1","identity":"npm:util-deprecate","label":"util-deprecate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:uvicorn","slug":"uvicorn-07c7a595","identity":"pypi:uvicorn","label":"uvicorn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.53.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:uvloop","slug":"uvloop-7921eb0f","identity":"pypi:uvloop","label":"uvloop","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.23.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:validate-npm-package-name","slug":"validate-npm-package-name-1ea4086a","identity":"npm:validate-npm-package-name","label":"validate-npm-package-name","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["7.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:vary","slug":"vary-f8fd7044","identity":"npm:vary","label":"vary","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:vaul","slug":"vaul-ba55d071","identity":"npm:vaul","label":"vaul","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":2,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:vfile","slug":"vfile-33c4321c","identity":"npm:vfile","label":"vfile","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:vfile-location","slug":"vfile-location-f2ca8efa","identity":"npm:vfile-location","label":"vfile-location","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["5.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:vfile-message","slug":"vfile-message-95198ca1","identity":"npm:vfile-message","label":"vfile-message","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.3"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:victory-vendor","slug":"victory-vendor-1fd44678","identity":"npm:victory-vendor","label":"victory-vendor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC AND MIT"],"versions":["37.3.6"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:watchdog","slug":"watchdog-55ddb444","identity":"pypi:watchdog","label":"watchdog","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["6.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:watchfiles","slug":"watchfiles-d200b8ce","identity":"pypi:watchfiles","label":"watchfiles","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:pypi:wcwidth","slug":"wcwidth-038a8957","identity":"pypi:wcwidth","label":"wcwidth","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:web-namespaces","slug":"web-namespaces-2f44061f","identity":"npm:web-namespaces","label":"web-namespaces","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:webencodings","slug":"webencodings-04815c4d","identity":"pypi:webencodings","label":"webencodings","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.6.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:webpack-virtual-modules","slug":"webpack-virtual-modules-a9467704","identity":"npm:webpack-virtual-modules","label":"webpack-virtual-modules","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.6.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:websockets","slug":"websockets-047236a0","identity":"pypi:websockets","label":"websockets","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["13.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:which","slug":"which-1e7f9364","identity":"npm:which","label":"which","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["2.0.2","4.0.0"],"dossier":false,"occurrenceCount":4,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:win32-setctime","slug":"win32-setctime-649675e1","identity":"pypi:win32-setctime","label":"win32-setctime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:word-wrap","slug":"word-wrap-124a9003","identity":"npm:word-wrap","label":"word-wrap","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:wrappy","slug":"wrappy-f4e94e3b","identity":"npm:wrappy","label":"wrappy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.0.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:wrapt","slug":"wrapt-505c01f2","identity":"pypi:wrapt","label":"wrapt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","non-standard"],"versions":["2.5.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:wsl-utils","slug":"wsl-utils-2721a0d6","identity":"npm:wsl-utils","label":"wsl-utils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.3.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:yallist","slug":"yallist-7f7ac870","identity":"npm:yallist","label":"yallist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.1.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:pypi:yarl","slug":"yarl-05cd1b35","identity":"pypi:yarl","label":"yarl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.25.1"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["sbom.cdx.json","uv.lock"]},{"id":"package:npm:yocto-queue","slug":"yocto-queue-1d448017","identity":"npm:yocto-queue","label":"yocto-queue","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:npm:yocto-spinner","slug":"yocto-spinner-7c8aa105","identity":"npm:yocto-spinner","label":"yocto-spinner","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:yoctocolors","slug":"yoctocolors-31353206","identity":"npm:yoctocolors","label":"yoctocolors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.1.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:zod-to-json-schema","slug":"zod-to-json-schema-075caf94","identity":"npm:zod-to-json-schema","label":"zod-to-json-schema","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["3.25.2"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]},{"id":"package:npm:zod-validation-error","slug":"zod-validation-error-a3cf2664","identity":"npm:zod-validation-error","label":"zod-validation-error","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json"]},{"id":"package:pypi:zopfli","slug":"zopfli-5e2184a1","identity":"pypi:zopfli","label":"zopfli","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.4.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:npm:zwitch","slug":"zwitch-d8ea4eb0","identity":"npm:zwitch","label":"zwitch","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.4"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["dashboard/package-lock.json","sbom.cdx.json"]}],"vulnerabilities":[{"id":"GHSA-22hg-r758-rrw9","slug":"ghsa-22hg-r758-rrw9-14adf850","dossier":true,"summary":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","aliases":["BIT-pillow-2026-112390","CVE-2026-112390"],"sourceIds":["GHSA-22hg-r758-rrw9"],"published":"2026-10-21T20:39:49Z","modified":"2026-10-26T08:56:03.565713059Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-239g-whfq-7xj9","slug":"ghsa-239g-whfq-7xj9-ede3fcd6","dossier":false,"summary":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","aliases":["CVE-2026-87817","PYSEC-2026-3982"],"sourceIds":["GHSA-239g-whfq-7xj9","PYSEC-2026-3982"],"published":"2026-09-09T12:17:16.830Z","modified":"2026-09-30T23:45:04.022111787Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-239g-whfq-7xj9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87817"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2218"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/c7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3982.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-23c5-xmqv-rm74","slug":"ghsa-23c5-xmqv-rm74-946f15d0","dossier":false,"summary":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","aliases":["CVE-2026-27904"],"sourceIds":["GHSA-23c5-xmqv-rm74"],"published":"2026-02-26T22:07:15Z","modified":"2026-09-10T03:50:59.274637421Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"},{"type":"PACKAGE","url":"https://github.com/isaacs/minimatch"}],"versionKeys":["npm:minimatch@10.0.3","npm:minimatch@10.1.1","npm:minimatch@3.1.2","npm:minimatch@9.0.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-23mf-xhv8-69c2","slug":"ghsa-23mf-xhv8-69c2-0feffb42","dossier":false,"summary":"GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)","aliases":["CVE-2026-110859"],"sourceIds":["GHSA-23mf-xhv8-69c2"],"published":"2026-10-27T15:28:03Z","modified":"2026-10-27T15:47:08.812491596Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-23mf-xhv8-69c2"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2233"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8da65080849a56a2fc9f3e7817bbf0524e8397d5"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-248v-346w-9cwc","slug":"ghsa-248v-346w-9cwc-8a7dbdf1","dossier":false,"summary":"Certifi removes GLOBALTRUST root certificate","aliases":["CVE-2024-39689","PYSEC-2024-230"],"sourceIds":["GHSA-248v-346w-9cwc","PYSEC-2024-230"],"published":"2024-07-05T19:15:10Z","modified":"2026-09-10T03:50:15.994602411Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39689"},{"type":"FIX","url":"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"},{"type":"ARTICLE","url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241206-0001"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241206-0001/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-248v-346w-9cwc"}],"versionKeys":["pypi:certifi@2024.6.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-24rc-8hj2-v98c","slug":"ghsa-24rc-8hj2-v98c-379a2f18","dossier":true,"summary":"Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode","aliases":["BIT-pillow-2026-96638","CVE-2026-96638"],"sourceIds":["GHSA-24rc-8hj2-v98c"],"published":"2026-10-22T15:59:35Z","modified":"2026-10-29T10:55:36.262902070Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96638"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10015"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-254f-3936-288h","slug":"ghsa-254f-3936-288h-1cc364b4","dossier":true,"summary":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","aliases":["BIT-pillow-2026-112391","CVE-2026-112391"],"sourceIds":["GHSA-254f-3936-288h"],"published":"2026-10-21T21:11:07Z","modified":"2026-10-26T08:56:17.690706279Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112391"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-25h7-pfq9-p65f","slug":"ghsa-25h7-pfq9-p65f-1f62933a","dossier":false,"summary":"flatted vulnerable to unbounded recursion DoS in parse() revive phase","aliases":["CVE-2026-32141"],"sourceIds":["GHSA-25h7-pfq9-p65f"],"published":"2026-03-13T15:40:42Z","modified":"2026-09-10T03:50:36.276174418Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32141"},{"type":"WEB","url":"https://github.com/WebReflection/flatted/pull/88"},{"type":"WEB","url":"https://github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606"},{"type":"PACKAGE","url":"https://github.com/WebReflection/flatted"}],"versionKeys":["npm:flatted@3.3.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-27h8-gf7j-v5hc","slug":"ghsa-27h8-gf7j-v5hc-bd4ebeac","dossier":true,"summary":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","aliases":["BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326"],"sourceIds":["GHSA-27h8-gf7j-v5hc","PYSEC-2026-4326"],"published":"2026-10-19T22:17:06.587Z","modified":"2026-10-27T11:10:35.409737764Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112392"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-27r3-jxmh-p828","slug":"ghsa-27r3-jxmh-p828-539d4c66","dossier":false,"summary":"body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body","aliases":["CVE-2026-111181"],"sourceIds":["GHSA-27r3-jxmh-p828"],"published":"2026-10-23T20:53:11Z","modified":"2026-10-23T21:00:06.131613693Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111181"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/commit/1260c3845f54502a05a87594f09a334786bb34d7"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/commit/f7075eae3a84c3473ab4bf0a777da28db208e916"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/expressjs/body-parser"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/releases/tag/1.20.9"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/releases/tag/v2.4.0"}],"versionKeys":["npm:body-parser@1.20.3","npm:body-parser@1.20.4","npm:body-parser@2.3.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-284h-m62q-gf8w","slug":"ghsa-284h-m62q-gf8w-da9acb0c","dossier":false,"summary":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","aliases":["CVE-2026-78676","PYSEC-2026-3786"],"sourceIds":["GHSA-284h-m62q-gf8w","PYSEC-2026-3786"],"published":"2026-08-25T02:16:52.030Z","modified":"2026-09-08T19:00:06.885837775Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-284h-m62q-gf8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78676"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3786.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-config-injection"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2883-xcg3-v3hh","slug":"ghsa-2883-xcg3-v3hh-763c5083","dossier":false,"summary":"js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources","aliases":["CVE-2026-84375"],"sourceIds":["GHSA-2883-xcg3-v3hh"],"published":"2026-09-08T21:24:51Z","modified":"2026-09-08T21:30:05.575808098Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-2883-xcg3-v3hh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84375"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/pull/797"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/3485bc06ff8a0251505f44a00414d90df2466639"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/6a8e05f9a485188ed730ac81e81ae221352ef480"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/d90b6612a5a84385bdcb556c44578eac76dc0f6b"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.2"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.2"}],"versionKeys":["npm:js-yaml@3.14.1","npm:js-yaml@3.14.2","npm:js-yaml@4.1.0","npm:js-yaml@4.1.1","npm:js-yaml@4.3.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-28wg-ghj8-5hjv","slug":"ghsa-28wg-ghj8-5hjv-10215c04","dossier":false,"summary":"nanoid: non-secure generators can loop indefinitely with negative size","aliases":["CVE-2026-67214"],"sourceIds":["GHSA-28wg-ghj8-5hjv"],"published":"2026-07-29T15:31:12Z","modified":"2026-09-10T03:50:51.191256883Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67214"},{"type":"WEB","url":"https://github.com/ai/nanoid/pull/600"},{"type":"WEB","url":"https://github.com/ai/nanoid/pull/601"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d"},{"type":"PACKAGE","url":"https://github.com/ai/nanoid"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/5.1.16"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"}],"versionKeys":["npm:nanoid@3.3.11"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-2c2j-9gv5-cj73","slug":"ghsa-2c2j-9gv5-cj73-60bc1f35","dossier":false,"summary":"Starlette has possible denial-of-service vector when parsing large files in multipart forms","aliases":["CVE-2025-54121","PYSEC-2026-1941"],"sourceIds":["GHSA-2c2j-9gv5-cj73","PYSEC-2026-1941"],"published":"2025-07-21T19:34:23Z","modified":"2026-09-10T03:50:25.704876348Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54121"},{"type":"FIX","url":"https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1"},{"type":"PACKAGE","url":"https://github.com/encode/starlette"},{"type":"WEB","url":"https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14"},{"type":"WEB","url":"https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2c2j-9gv5-cj73"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-2f96-g7mh-g2hx","slug":"ghsa-2f96-g7mh-g2hx-dd7ec02d","dossier":false,"summary":"GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist","aliases":["CVE-2026-67325","PYSEC-2026-3836"],"sourceIds":["GHSA-2f96-g7mh-g2hx","PYSEC-2026-3836"],"published":"2026-07-21T19:43:43Z","modified":"2026-09-23T05:15:05.950374846Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2f96-g7mh-g2hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67325"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2161"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/56806080c1348749b07daa4a2024ce47b3cad285"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-option-prefix-abbreviation"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2f96-g7mh-g2hx"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2fqr-mr3j-6wp8","slug":"ghsa-2fqr-mr3j-6wp8-5ee7c60f","dossier":false,"summary":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence","aliases":["CVE-2026-54279","PYSEC-2026-2112"],"sourceIds":["GHSA-2fqr-mr3j-6wp8","PYSEC-2026-2112"],"published":"2026-06-15T20:08:51Z","modified":"2026-11-03T16:45:04.163545105Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54279"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2112.yaml"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-2g4f-4pwh-qvx6","slug":"ghsa-2g4f-4pwh-qvx6-26ecd362","dossier":false,"summary":"ajv has ReDoS when using `$data` option","aliases":["CVE-2025-69873"],"sourceIds":["GHSA-2g4f-4pwh-qvx6"],"published":"2026-02-11T21:30:39Z","modified":"2026-09-10T03:50:33.716487588Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69873"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/pull/2586"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/pull/2588"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/pull/2590"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/6991"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/commit/720a23fa453ffae8340e92c9b0fe886c54cfe0d5"},{"type":"WEB","url":"https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g4f-4pwh-qvx6"},{"type":"PACKAGE","url":"https://github.com/ajv-validator/ajv"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/releases/tag/v6.14.0"},{"type":"WEB","url":"https://github.com/ajv-validator/ajv/releases/tag/v8.18.0"}],"versionKeys":["npm:ajv@6.12.6"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-2g87-pp6c-29x5","slug":"ghsa-2g87-pp6c-29x5-5aaa26fd","dossier":false,"summary":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","aliases":["CVE-2026-123817"],"sourceIds":["GHSA-2g87-pp6c-29x5"],"published":"2026-10-19T17:07:23Z","modified":"2026-11-09T21:30:07.738926065Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-2gqq-gqf2-x968","slug":"ghsa-2gqq-gqf2-x968-3100bf54","dossier":false,"summary":"undici vulnerable to response truncation via oversized chunked responses in the dump interceptor","aliases":["CVE-2026-84947"],"sourceIds":["GHSA-2gqq-gqf2-x968"],"published":"2026-09-29T18:18:51Z","modified":"2026-09-29T18:28:11.302166457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84947"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/21693f406f0142f3504192e9f9b022dcf84782ae"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/6d583124e7cf60b640097d64144ed633cc450584"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2gx3-rcp4-g85q","slug":"ghsa-2gx3-rcp4-g85q-9272f372","dossier":false,"summary":"PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)","aliases":["CVE-2026-101917","PYSEC-2026-4140"],"sourceIds":["GHSA-2gx3-rcp4-g85q","PYSEC-2026-4140"],"published":"2026-09-29T23:11:51Z","modified":"2026-10-01T17:56:20.150726241Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101917"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2gx3-rcp4-g85q"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-2h4p-vjrc-8xpq","slug":"ghsa-2h4p-vjrc-8xpq-f59f8dec","dossier":false,"summary":"Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup","aliases":["CVE-2026-44307","PYSEC-2026-2617"],"sourceIds":["GHSA-2h4p-vjrc-8xpq","PYSEC-2026-2617"],"published":"2026-05-06T21:45:16Z","modified":"2026-09-10T03:50:45.452547864Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44307"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/issues/435"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12"},{"type":"PACKAGE","url":"https://pypi.org/project/mako"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2h4p-vjrc-8xpq"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-2jfj-6hjv-fm6j","slug":"ghsa-2jfj-6hjv-fm6j-6286571a","dossier":false,"summary":"undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches","aliases":["CVE-2026-84933"],"sourceIds":["GHSA-2jfj-6hjv-fm6j"],"published":"2026-09-29T18:19:58Z","modified":"2026-09-29T18:30:41.174435110Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84933"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b6c5a00252c37da9dd2db9bead053bb843e1f988"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cb75bbb34224a968b4ad80cab8b7aba5e0b3b28a"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2m5v-pch6-74hx","slug":"ghsa-2m5v-pch6-74hx-9bc28a85","dossier":false,"summary":"undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent","aliases":["CVE-2026-109383"],"sourceIds":["GHSA-2m5v-pch6-74hx"],"published":"2026-10-27T19:02:26Z","modified":"2026-10-27T19:15:22.407771210Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109383"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/04cb74b1db131ff8f5b4557dce811cbf5f4664b4"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/8c59f6b302898cb2e9b0f7962cd7212b6e597c9f"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/f75eac00ac177f7b2e6c8bfbd52d4113164286e6"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-2mjp-6q6p-2qxm","slug":"ghsa-2mjp-6q6p-2qxm-7fbfca50","dossier":false,"summary":"Undici has an HTTP Request/Response Smuggling issue","aliases":["CVE-2026-1525"],"sourceIds":["GHSA-2mjp-6q6p-2qxm"],"published":"2026-03-13T20:07:03Z","modified":"2026-09-10T03:50:36.493109202Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1525"},{"type":"WEB","url":"https://hackerone.com/reports/3556037"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"WEB","url":"https://cwe.mitre.org/data/definitions/444.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2qfp-q593-8484","slug":"ghsa-2qfp-q593-8484-b683fc2e","dossier":false,"summary":"Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation","aliases":["CVE-2025-6176","PYSEC-2026-1906","PYSEC-2026-2401"],"sourceIds":["GHSA-2qfp-q593-8484","PYSEC-2026-2401"],"published":"2025-10-31T00:30:35Z","modified":"2026-09-10T03:50:29.153413546Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6176"},{"type":"WEB","url":"https://github.com/google/brotli/issues/1327"},{"type":"WEB","url":"https://github.com/google/brotli/issues/1375"},{"type":"WEB","url":"https://github.com/google/brotli/pull/1234"},{"type":"WEB","url":"https://github.com/scrapy/scrapy/pull/7134"},{"type":"WEB","url":"https://github.com/google/brotli/commit/67d78bc41db1a0d03f2e763497748f2f69946627"},{"type":"WEB","url":"https://github.com/scrapy/scrapy/commit/14737e91edc513967f516fc839cc9c8a4f8d91da"},{"type":"PACKAGE","url":"https://github.com/google/brotli"},{"type":"WEB","url":"https://github.com/google/brotli/releases/tag/v1.2.0"},{"type":"WEB","url":"https://huntr.com/bounties/2c26a886-5984-47ee-a421-0d5fe1344eb0"},{"type":"PACKAGE","url":"https://pypi.org/project/brotli"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2qfp-q593-8484"}],"versionKeys":["pypi:brotli@1.1.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2v37-7h3g-55p8","slug":"ghsa-2v37-7h3g-55p8-563431fd","dossier":false,"summary":"nanoid: custom generators can loop indefinitely when size is zero","aliases":["CVE-2026-67213"],"sourceIds":["GHSA-2v37-7h3g-55p8"],"published":"2026-07-29T15:31:12Z","modified":"2026-09-10T03:50:51.243328986Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67213"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b"},{"type":"PACKAGE","url":"https://github.com/ai/nanoid"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/3.3.17"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/3.3.18"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/5.1.6"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"}],"versionKeys":["npm:nanoid@3.3.11","npm:nanoid@3.3.16"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-2vrm-gr82-f7m5","slug":"ghsa-2vrm-gr82-f7m5-5092ea0c","dossier":false,"summary":"AIOHTTP has CRLF injection through multipart part content type header construction","aliases":["CVE-2026-34514","PYSEC-2026-2096"],"sourceIds":["GHSA-2vrm-gr82-f7m5","PYSEC-2026-2096"],"published":"2026-04-01T21:16:59.417Z","modified":"2026-09-10T03:50:42.288164171Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-2wc2-fm75-p42x","slug":"ghsa-2wc2-fm75-p42x-9941d681","dossier":false,"summary":"Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists","aliases":["CVE-2026-49476","PYSEC-2026-3071"],"sourceIds":["GHSA-2wc2-fm75-p42x","PYSEC-2026-3071"],"published":"2026-07-09T13:37:40Z","modified":"2026-09-10T03:50:51.299551127Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-2wc2-fm75-p42x"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"PACKAGE","url":"https://pypi.org/project/soupsieve"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2wc2-fm75-p42x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49476"}],"versionKeys":["pypi:soupsieve@2.6","pypi:soupsieve@2.7","pypi:soupsieve@2.8"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2xpw-w6gg-jr37","slug":"ghsa-2xpw-w6gg-jr37-91cead57","dossier":false,"summary":"urllib3 streaming API improperly handles highly compressed data","aliases":["CVE-2025-66471","PYSEC-2026-1994"],"sourceIds":["GHSA-2xpw-w6gg-jr37","PYSEC-2026-1994"],"published":"2025-12-05T18:15:54Z","modified":"2026-09-25T17:15:05.968189421Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-332p-7hrc-92wf","slug":"ghsa-332p-7hrc-92wf-af7b2989","dossier":true,"summary":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","aliases":["BIT-pillow-2026-112393","CVE-2026-112393"],"sourceIds":["GHSA-332p-7hrc-92wf"],"published":"2026-10-21T21:28:09Z","modified":"2026-10-26T08:56:07.886625845Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112393"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-333x-w4r6-6crp","slug":"ghsa-333x-w4r6-6crp-edd42481","dossier":false,"summary":"fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references","aliases":["CVE-2026-110725"],"sourceIds":["GHSA-333x-w4r6-6crp"],"published":"2026-10-23T21:36:40Z","modified":"2026-10-23T21:45:04.900311356Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110725"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/39e6493c1356f30a0084171627eb266786e1620e"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/a9b8d67353630aab053cd727cf629023dd018d2b"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"}],"versionKeys":["npm:fast-uri@3.1.8"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-35jp-ww65-95wh","slug":"ghsa-35jp-ww65-95wh-20697265","dossier":false,"summary":"axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`","aliases":["CVE-2026-44494"],"sourceIds":["GHSA-35jp-ww65-95wh"],"published":"2026-05-29T16:04:00Z","modified":"2026-09-10T03:51:04.268287831Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44494"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fvcv-3m26-pcqx"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-35p6-xmwp-9g52","slug":"ghsa-35p6-xmwp-9g52-9ca8b935","dossier":false,"summary":"undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse","aliases":["CVE-2026-6733"],"sourceIds":["GHSA-35p6-xmwp-9g52"],"published":"2026-06-19T14:19:13Z","modified":"2026-09-10T03:51:07.666603424Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6733"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/6ea54ef8c4051e95bb68c89d4a5c9274fe6fbb4b"},{"type":"WEB","url":"https://hackerone.com/reports/3582376"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.27.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.28.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.5.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-37ch-88jc-xwx2","slug":"ghsa-37ch-88jc-xwx2-2809a0d1","dossier":false,"summary":"path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters","aliases":["CVE-2024-45296","CVE-2026-4867","GHSA-9wv6-86v2-598j"],"sourceIds":["GHSA-37ch-88jc-xwx2"],"published":"2026-03-27T20:04:53Z","modified":"2026-09-10T03:50:36.768786245Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4867"},{"type":"WEB","url":"https://blakeembrey.com/posts/2024-09-web-redos"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wv6-86v2-598j"},{"type":"PACKAGE","url":"https://github.com/pillarjs/path-to-regexp"},{"type":"WEB","url":"https://github.com/pillarjs/path-to-regexp/releases/tag/v.0.1.13"}],"versionKeys":["npm:path-to-regexp@0.1.12"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-38jv-5279-wg99","slug":"ghsa-38jv-5279-wg99-c9df8f7b","dossier":false,"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","aliases":["CVE-2026-21441","PYSEC-2026-1996"],"sourceIds":["GHSA-38jv-5279-wg99","PYSEC-2026-1996"],"published":"2026-01-07T19:18:14Z","modified":"2026-09-10T03:50:32.562010895Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38jv-5279-wg99"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-394h-qwmc-48pf","slug":"ghsa-394h-qwmc-48pf-2e9bb5ce","dossier":false,"summary":"virtualenv: Xonsh activation literals depend on the script decoding codec","aliases":["BIT-virtualenv-2026-113718","CVE-2026-113718"],"sourceIds":["GHSA-394h-qwmc-48pf"],"published":"2026-10-23T22:24:43Z","modified":"2026-10-29T10:55:57.228294866Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113718"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3432"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-3f7w-8rr8-f37f","slug":"ghsa-3f7w-8rr8-f37f-9cab61a6","dossier":false,"summary":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","aliases":["CVE-2026-73620","PYSEC-2026-3949"],"sourceIds":["GHSA-3f7w-8rr8-f37f","PYSEC-2026-3949"],"published":"2026-08-03T20:09:56Z","modified":"2026-09-10T13:10:44.075529324Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/3af0c2516c5e18c829da30338614688f6b69b49c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3g43-6gmg-66jw","slug":"ghsa-3g43-6gmg-66jw-7dc8cdbd","dossier":false,"summary":"axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge","aliases":["CVE-2026-44495"],"sourceIds":["GHSA-3g43-6gmg-66jw"],"published":"2026-05-29T16:07:31Z","modified":"2026-09-10T03:51:04.440180855Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44495"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-3j72-p6qg-6xp7","slug":"ghsa-3j72-p6qg-6xp7-6d019684","dossier":true,"summary":"Pillow: TarIO negative size field causes infinite CPU-spin loop","aliases":["BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341"],"sourceIds":["GHSA-3j72-p6qg-6xp7","PYSEC-2026-4341"],"published":"2026-10-21T21:20:32.650Z","modified":"2026-10-29T10:55:45.826300321Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96642"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10012"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-3jxr-9vmj-r5cp","slug":"ghsa-3jxr-9vmj-r5cp-a4f3a60d","dossier":false,"summary":"brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups","aliases":["CVE-2026-13149"],"sourceIds":["GHSA-3jxr-9vmj-r5cp"],"published":"2026-07-20T20:51:09Z","modified":"2026-09-10T03:51:10.092354944Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/S:N/AU:Y/R:U/V:D/RE:M/U:Amber"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-3jxr-9vmj-r5cp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13149"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/122"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/123"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/835d6be91201122d9adffb0c0c8c094189ace265"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/d74e63030c012e3b7ae81657b8d665619cd51b95"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/releases/tag/v1.1.16"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/releases/tag/v2.1.2"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/releases/tag/v5.0.7"},{"type":"WEB","url":"https://www.npmjs.com/package/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@2.0.2"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-3p68-rc4w-qgx5","slug":"ghsa-3p68-rc4w-qgx5-b9fd4cd5","dossier":false,"summary":"Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF","aliases":["CVE-2025-62718"],"sourceIds":["GHSA-3p68-rc4w-qgx5"],"published":"2026-04-09T17:32:19Z","modified":"2026-09-10T03:50:42.452672741Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62718"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10661"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10688"},{"type":"WEB","url":"https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c"},{"type":"WEB","url":"https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc1034#section-3.1"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.31.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.15.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-3ppc-4f35-3m26","slug":"ghsa-3ppc-4f35-3m26-03892396","dossier":false,"summary":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","aliases":["CVE-2026-26996"],"sourceIds":["GHSA-3ppc-4f35-3m26"],"published":"2026-02-18T22:38:11Z","modified":"2026-09-10T03:50:33.812431744Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5"},{"type":"PACKAGE","url":"https://github.com/isaacs/minimatch"}],"versionKeys":["npm:minimatch@10.0.3","npm:minimatch@10.1.1","npm:minimatch@3.1.2","npm:minimatch@9.0.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-3pq3-5fj3-cg6v","slug":"ghsa-3pq3-5fj3-cg6v-602045f2","dossier":false,"summary":"Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls","aliases":["CVE-2026-101898"],"sourceIds":["GHSA-3pq3-5fj3-cg6v"],"published":"2026-09-30T15:02:14Z","modified":"2026-09-30T15:15:04.067807024Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-3pq3-5fj3-cg6v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101898"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-3rp5-jjmw-4wv2","slug":"ghsa-3rp5-jjmw-4wv2-6d7352e6","dossier":false,"summary":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","aliases":["CVE-2026-69097","PYSEC-2026-3981"],"sourceIds":["GHSA-3rp5-jjmw-4wv2","PYSEC-2026-3981"],"published":"2026-07-24T16:22:02Z","modified":"2026-10-23T21:47:05Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2176"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.53"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3981.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-submodule-names"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3v7f-55p6-f55p","slug":"ghsa-3v7f-55p6-f55p-cfa06046","dossier":false,"summary":"Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching","aliases":["CVE-2026-33672"],"sourceIds":["GHSA-3v7f-55p6-f55p"],"published":"2026-03-25T21:13:39Z","modified":"2026-09-10T03:50:36.949634538Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33672"},{"type":"WEB","url":"https://github.com/micromatch/picomatch/commit/4516eb521f13a46b2fe1a1d2c9ef6b20ddc0e903"},{"type":"PACKAGE","url":"https://github.com/micromatch/picomatch"}],"versionKeys":["npm:picomatch@2.3.1","npm:picomatch@4.0.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-3w6x-2g7m-8v23","slug":"ghsa-3w6x-2g7m-8v23-acc11428","dossier":false,"summary":"Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `parseReviver`","aliases":["CVE-2026-42044"],"sourceIds":["GHSA-3w6x-2g7m-8v23"],"published":"2026-05-05T00:19:33Z","modified":"2026-09-10T03:50:45.398396828Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-3w6x-2g7m-8v23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42044"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-3wq7-rqq7-wx6j","slug":"ghsa-3wq7-rqq7-wx6j-29b8d785","dossier":false,"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS","aliases":["CVE-2026-34517","PYSEC-2026-2099"],"sourceIds":["GHSA-3wq7-rqq7-wx6j","PYSEC-2026-2099"],"published":"2026-04-01T21:16:59.870Z","modified":"2026-09-10T03:50:42.683852324Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-3wxw-xv34-2frg","slug":"ghsa-3wxw-xv34-2frg-c013ae2d","dossier":false,"summary":"GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","aliases":["CVE-2026-78679","PYSEC-2026-3837"],"sourceIds":["GHSA-3wxw-xv34-2frg","PYSEC-2026-3837"],"published":"2026-09-08T19:42:22Z","modified":"2026-09-23T05:15:05.925079070Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3wxw-xv34-2frg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78679"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2208"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-tagreference-create"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3wxw-xv34-2frg"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-3xpg-4rpp-hhhm","slug":"ghsa-3xpg-4rpp-hhhm-9f4d35c1","dossier":false,"summary":"undici vulnerable to Denial of Service via unbounded decompression of compressed responses","aliases":["CVE-2026-84890"],"sourceIds":["GHSA-3xpg-4rpp-hhhm"],"published":"2026-09-29T18:20:37Z","modified":"2026-09-29T18:30:41.143057118Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84890"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2c7d7e1227043c644c4c32cfd1e276f4fd4fcb11"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/7aac7f12f757844763c8b8f1ab6e305e80d55838"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-42h9-826w-cgv3","slug":"ghsa-42h9-826w-cgv3-ec079418","dossier":false,"summary":"Axios: Excessive recursion in formDataToJSON can cause denial of service","aliases":["CVE-2026-67313"],"sourceIds":["GHSA-42h9-826w-cgv3"],"published":"2026-07-20T17:58:59Z","modified":"2026-09-10T03:51:10.187294734Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-42h9-826w-cgv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67313"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68942"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11001"},{"type":"WEB","url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.33.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formdatatojson"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-42vr-xj54-vc7v","slug":"ghsa-42vr-xj54-vc7v-bb2dfa49","dossier":false,"summary":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","aliases":["CVE-2026-101918","PYSEC-2026-4141"],"sourceIds":["GHSA-42vr-xj54-vc7v","PYSEC-2026-4141"],"published":"2026-09-30T15:41:05Z","modified":"2026-10-01T17:56:09.538835697Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-42vr-xj54-vc7v"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-43fc-jf86-j433","slug":"ghsa-43fc-jf86-j433-2bd62bad","dossier":false,"summary":"Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig","aliases":["CVE-2026-25639"],"sourceIds":["GHSA-43fc-jf86-j433"],"published":"2026-02-09T17:46:14Z","modified":"2026-09-10T03:50:34.100599628Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25639"},{"type":"WEB","url":"https://github.com/axios/axios/pull/7369"},{"type":"WEB","url":"https://github.com/axios/axios/pull/7388"},{"type":"WEB","url":"https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d7ff1409c68168d3057fc3891f911b2b92616f9e"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.30.3"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.13.5"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-43mp-35q3-x3fq","slug":"ghsa-43mp-35q3-x3fq-895b1d20","dossier":false,"summary":"virtualenv: Deletion recovery can change a symlink target's mode","aliases":["BIT-virtualenv-2026-113724","CVE-2026-113724"],"sourceIds":["GHSA-43mp-35q3-x3fq"],"published":"2026-10-21T21:31:34Z","modified":"2026-10-29T10:55:47.691444554Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113724"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3427"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-445q-vr5w-6q77","slug":"ghsa-445q-vr5w-6q77-193bc3c3","dossier":false,"summary":"Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in formDataToStream","aliases":["CVE-2026-42037"],"sourceIds":["GHSA-445q-vr5w-6q77"],"published":"2026-05-05T00:40:45Z","modified":"2026-09-10T03:50:45.396631689Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-445q-vr5w-6q77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42037"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4558-3h8r-v8xp","slug":"ghsa-4558-3h8r-v8xp-9e09a0b2","dossier":true,"summary":"Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","aliases":["BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327"],"sourceIds":["GHSA-4558-3h8r-v8xp","PYSEC-2026-4327"],"published":"2026-10-19T21:17:07.747Z","modified":"2026-10-27T11:10:34.006455299Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112394"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9723"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-45hq-cxwh-f6vc","slug":"ghsa-45hq-cxwh-f6vc-d18d2872","dossier":false,"summary":"Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading","aliases":["BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255"],"sourceIds":["GHSA-45hq-cxwh-f6vc","PYSEC-2026-2255"],"published":"2026-07-06T19:17:08.577Z","modified":"2026-09-10T03:50:51.372929814Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-462x-pgg6-55fp","slug":"ghsa-462x-pgg6-55fp-29049dd8","dossier":true,"summary":"Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","aliases":["BIT-pillow-2026-112395","CVE-2026-112395"],"sourceIds":["GHSA-462x-pgg6-55fp"],"published":"2026-10-20T20:49:26Z","modified":"2026-10-26T08:56:01.770928143Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112395"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-48p4-8xcf-vxj5","slug":"ghsa-48p4-8xcf-vxj5-13f12656","dossier":false,"summary":"urllib3 does not control redirects in browsers and Node.js","aliases":["CVE-2025-50182","PYSEC-2026-1997"],"sourceIds":["GHSA-48p4-8xcf-vxj5","PYSEC-2026-1997"],"published":"2025-06-18T17:50:11Z","modified":"2026-09-10T03:50:24.821170285Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-48p4-8xcf-vxj5"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-494j-54xm-rwp3","slug":"ghsa-494j-54xm-rwp3-eab1773e","dossier":false,"summary":"AIOHTTP: Secure attribute not enforced for shared cookie","aliases":["CVE-2026-111063"],"sourceIds":["GHSA-494j-54xm-rwp3"],"published":"2026-10-19T17:07:47Z","modified":"2026-10-26T15:00:05.287728271Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111063"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-494p-63j8-28p3","slug":"ghsa-494p-63j8-28p3-74531279","dossier":false,"summary":"virtualenv: Downloaded wheel selection and caching precede verification","aliases":["BIT-virtualenv-2026-113714","CVE-2026-113714"],"sourceIds":["GHSA-494p-63j8-28p3"],"published":"2026-10-23T22:25:22Z","modified":"2026-10-29T10:55:43.999222952Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113714"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3430"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-4992-7rv2-5pvq","slug":"ghsa-4992-7rv2-5pvq-12913d15","dossier":false,"summary":"Undici has CRLF Injection in undici via `upgrade` option","aliases":["CVE-2026-1527"],"sourceIds":["GHSA-4992-7rv2-5pvq"],"published":"2026-03-13T20:41:26Z","modified":"2026-09-10T03:50:37.246920699Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4992-7rv2-5pvq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1527"},{"type":"WEB","url":"https://hackerone.com/reports/3487198"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4cwx-7wf7-3272","slug":"ghsa-4cwx-7wf7-3272-2a4cbb99","dossier":false,"summary":"undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives","aliases":["CVE-2026-13697"],"sourceIds":["GHSA-4cwx-7wf7-3272"],"published":"2026-08-03T19:19:47Z","modified":"2026-09-10T03:51:13.021707572Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4fh9-h7wg-q85m","slug":"ghsa-4fh9-h7wg-q85m-f401ee5c","dossier":false,"summary":"mdast-util-to-hast has unsanitized class attribute","aliases":["CVE-2025-66400"],"sourceIds":["GHSA-4fh9-h7wg-q85m"],"published":"2025-12-02T01:25:46Z","modified":"2026-09-10T03:50:31.288154267Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/syntax-tree/mdast-util-to-hast/security/advisories/GHSA-4fh9-h7wg-q85m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66400"},{"type":"WEB","url":"https://github.com/syntax-tree/mdast-util-to-hast/commit/6fc783ae6abdeb798fd5a68e7f3f21411dde7403"},{"type":"WEB","url":"https://github.com/syntax-tree/mdast-util-to-hast/commit/ab3a79570a1afbfa7efef5d4a0cd9b5caafbc5d7"},{"type":"PACKAGE","url":"https://github.com/syntax-tree/mdast-util-to-hast"}],"versionKeys":["npm:mdast-util-to-hast@13.2.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4fvr-rgm6-gqmc","slug":"ghsa-4fvr-rgm6-gqmc-c8b35c87","dossier":false,"summary":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit","aliases":["CVE-2026-54273","PYSEC-2026-2107"],"sourceIds":["GHSA-4fvr-rgm6-gqmc","PYSEC-2026-2107"],"published":"2026-06-15T20:10:32Z","modified":"2026-09-10T03:51:07.881817751Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4gmw-gg2m-w46p","slug":"ghsa-4gmw-gg2m-w46p-58f27cb8","dossier":false,"summary":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","aliases":["CVE-2026-76219","PYSEC-2026-3838"],"sourceIds":["GHSA-4gmw-gg2m-w46p","PYSEC-2026-3838"],"published":"2026-08-07T15:33:57Z","modified":"2026-09-10T12:25:42.767166279Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-4gmw-gg2m-w46p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76219"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/9b5dcaf85da5946dbf69dcd53f9edba08f760b32"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-read-tree"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4gmw-gg2m-w46p"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-4hjh-wcwx-xvwj","slug":"ghsa-4hjh-wcwx-xvwj-0390ef58","dossier":false,"summary":"Axios is vulnerable to DoS attack through lack of data size check","aliases":["CVE-2025-58754"],"sourceIds":["GHSA-4hjh-wcwx-xvwj"],"published":"2025-09-11T21:07:55Z","modified":"2026-09-10T03:50:27.860875468Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-4hjh-wcwx-xvwj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58754"},{"type":"WEB","url":"https://github.com/axios/axios/pull/7011"},{"type":"WEB","url":"https://github.com/axios/axios/pull/7034"},{"type":"WEB","url":"https://github.com/axios/axios/commit/945435fc51467303768202250debb8d4ae892593"},{"type":"WEB","url":"https://github.com/axios/axios/commit/a1b1d3f073a988601583a604f5f9f5d05a3d0b67"},{"type":"WEB","url":"https://github.com/axios/axios/commit/c30252f685e8f4326722de84923fcbc8cf557f06"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.30.2"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.12.0"}],"versionKeys":["npm:axios@1.11.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4hqw-qxg8-jxx2","slug":"ghsa-4hqw-qxg8-jxx2-6e84c6d9","dossier":false,"summary":"Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders","aliases":["CVE-2026-101900"],"sourceIds":["GHSA-4hqw-qxg8-jxx2"],"published":"2026-09-30T15:34:46Z","modified":"2026-09-30T15:46:17.701967512Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-4hqw-qxg8-jxx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101900"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4m7w-qmgq-4wj5","slug":"ghsa-4m7w-qmgq-4wj5-f98433d3","dossier":false,"summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","aliases":["CVE-2026-54275","PYSEC-2026-237"],"sourceIds":["GHSA-4m7w-qmgq-4wj5","PYSEC-2026-237"],"published":"2026-06-15T20:11:13Z","modified":"2026-09-10T03:50:48.205198252Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4mjr-xmp4-gh2g","slug":"ghsa-4mjr-xmp4-gh2g-3eea625c","dossier":false,"summary":"qs: Denial of Service via Attacker Controlled isBuffer","aliases":["CVE-2026-82417"],"sourceIds":["GHSA-4mjr-xmp4-gh2g"],"published":"2026-09-02T14:45:13Z","modified":"2026-09-10T03:51:14.991984096Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-4mjr-xmp4-gh2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82417"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/e83d321ffafb38cf210683ac31714fce6ce1c6c6"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"versionKeys":["npm:qs@6.13.0","npm:qs@6.14.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4qv8-2p9j-2685","slug":"ghsa-4qv8-2p9j-2685-48c36546","dossier":false,"summary":"undici vulnerable to Denial of Service via unbounded memory in the EventSource parser","aliases":["CVE-2026-109924"],"sourceIds":["GHSA-4qv8-2p9j-2685"],"published":"2026-10-23T22:13:29Z","modified":"2026-10-23T22:30:04.104974737Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109924"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/299162740d5f39120092277e70efacb4d151c1c6"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/789ef26461c648480433846607154f52d74ec9ab"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/c43b23fdc6b37e1283d4347408bb16800f867d9e"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-4rm8-3hmm-39fg","slug":"ghsa-4rm8-3hmm-39fg-6e9ca404","dossier":true,"summary":"Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise","aliases":["BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340"],"sourceIds":["GHSA-4rm8-3hmm-39fg","PYSEC-2026-4340"],"published":"2026-10-21T21:20:32.500Z","modified":"2026-10-29T10:56:07.449486409Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96641"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10010"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-4rr5-89j8-mwwm","slug":"ghsa-4rr5-89j8-mwwm-f8e3c770","dossier":false,"summary":"Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer","aliases":["BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328"],"sourceIds":["GHSA-4rr5-89j8-mwwm","PYSEC-2026-4328"],"published":"2026-10-19T22:17:06.837Z","modified":"2026-10-27T11:10:49.694224501Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rr5-89j8-mwwm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112396"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/dc95da20207827a062cfbf551ee9f6031465a8bb"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4w7w-5xrc-9h26","slug":"ghsa-4w7w-5xrc-9h26-97337653","dossier":false,"summary":"undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects","aliases":["CVE-2026-109829"],"sourceIds":["GHSA-4w7w-5xrc-9h26"],"published":"2026-10-27T19:02:31Z","modified":"2026-10-27T19:15:22.403656345Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109829"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/26c2bfb3def0b67241ce878e80657ed5d6c3efa8"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b20b82ad80a405a12b6ce1f341bcd418de390aa0"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-4w7w-66w2-5vf9","slug":"ghsa-4w7w-66w2-5vf9-1ec64746","dossier":false,"summary":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","aliases":["CVE-2026-39365"],"sourceIds":["GHSA-4w7w-66w2-5vf9"],"published":"2026-04-06T18:03:46Z","modified":"2026-09-10T03:50:42.779400319Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39365"},{"type":"WEB","url":"https://github.com/vitejs/vite/pull/22161"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v6.4.2"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v7.3.2"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v8.0.5"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-4x4j-2g7c-83w6","slug":"ghsa-4x4j-2g7c-83w6-326c14d2","dossier":false,"summary":"Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path","aliases":["BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257"],"sourceIds":["GHSA-4x4j-2g7c-83w6","PYSEC-2026-2257"],"published":"2026-07-06T19:17:08.830Z","modified":"2026-09-10T03:51:10.324377232Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55798"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2257.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-4x5r-pxfx-6jf8","slug":"ghsa-4x5r-pxfx-6jf8-59419f35","dossier":false,"summary":"@babel/core: Arbitrary File Read via sourceMappingURL Comment","aliases":["CVE-2026-49356"],"sourceIds":["GHSA-4x5r-pxfx-6jf8"],"published":"2026-06-15T17:14:14Z","modified":"2026-09-10T03:50:48.280629201Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/babel/babel/security/advisories/GHSA-4x5r-pxfx-6jf8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49356"},{"type":"WEB","url":"https://babeljs.io/docs/options#inputsourcemap"},{"type":"PACKAGE","url":"https://github.com/babel/babel"}],"versionKeys":["npm:@babel/core@7.26.10"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-4xgf-cpjx-pc3j","slug":"ghsa-4xgf-cpjx-pc3j-c1284f87","dossier":false,"summary":"pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size","aliases":["CVE-2026-58203"],"sourceIds":["GHSA-4xgf-cpjx-pc3j"],"published":"2026-06-19T22:10:42Z","modified":"2026-09-10T03:50:48.282428168Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pydantic/pydantic-settings/security/advisories/GHSA-4xgf-cpjx-pc3j"},{"type":"PACKAGE","url":"https://github.com/pydantic/pydantic-settings"}],"versionKeys":["pypi:pydantic-settings@2.12.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5239-wwwm-4pmq","slug":"ghsa-5239-wwwm-4pmq-228840e4","dossier":false,"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","aliases":["CVE-2026-4539","PYSEC-2026-2987"],"sourceIds":["GHSA-5239-wwwm-4pmq","PYSEC-2026-2987"],"published":"2026-03-22T06:30:15Z","modified":"2026-09-10T03:50:59.780634752Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"},{"type":"PACKAGE","url":"https://pypi.org/project/pygments"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5239-wwwm-4pmq"}],"versionKeys":["pypi:pygments@2.19.1","pypi:pygments@2.19.2"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-52cp-r559-cp3m","slug":"ghsa-52cp-r559-cp3m-8cf6b3f8","dossier":false,"summary":"js-yaml: YAML merge-key chains can force quadratic CPU consumption","aliases":["CVE-2026-59869"],"sourceIds":["GHSA-52cp-r559-cp3m"],"published":"2026-07-20T21:19:09Z","modified":"2026-09-10T03:50:12.263307536Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-52cp-r559-cp3m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59869"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/59423c6f8cdc78742ac00e25a4dd39ef16b702e4"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/3.15.0"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/releases/tag/4.3.0"}],"versionKeys":["npm:js-yaml@3.14.1","npm:js-yaml@3.14.2","npm:js-yaml@4.1.0","npm:js-yaml@4.1.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-537c-gmf6-5ccf","slug":"ghsa-537c-gmf6-5ccf-23a24e16","dossier":false,"summary":"Vulnerable OpenSSL included in cryptography wheels","aliases":[],"sourceIds":["GHSA-537c-gmf6-5ccf"],"published":"2026-06-15T20:12:27Z","modified":"2026-09-10T03:50:48.298936410Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-537c-gmf6-5ccf"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://openssl-library.org/news/secadv/20260609.txt"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-539m-9xh6-q6rr","slug":"ghsa-539m-9xh6-q6rr-c4575e3c","dossier":false,"summary":"GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()","aliases":["CVE-2026-73619","PYSEC-2026-3948"],"sourceIds":["GHSA-539m-9xh6-q6rr","PYSEC-2026-3948"],"published":"2026-08-03T20:14:28Z","modified":"2026-09-10T13:11:01.695990206Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2193"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.57"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-archive"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-542g-h47m-68v8","slug":"ghsa-542g-h47m-68v8-ba3bccdd","dossier":false,"summary":"Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization","aliases":["CVE-2026-101901"],"sourceIds":["GHSA-542g-h47m-68v8"],"published":"2026-09-30T15:01:07Z","modified":"2026-09-30T15:15:04.061469672Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-542g-h47m-68v8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101901"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-54jq-c3m8-4m76","slug":"ghsa-54jq-c3m8-4m76-bba4b2d3","dossier":false,"summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","aliases":["CVE-2025-69226","PYSEC-2026-1097"],"sourceIds":["GHSA-54jq-c3m8-4m76","PYSEC-2026-1097"],"published":"2026-01-05T23:09:51Z","modified":"2026-09-10T03:50:32.751498447Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-54jq-c3m8-4m76"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-54p9-h82j-f925","slug":"ghsa-54p9-h82j-f925-623d2ef6","dossier":false,"summary":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","aliases":["CVE-2026-104874","PYSEC-2026-4244"],"sourceIds":["GHSA-54p9-h82j-f925","PYSEC-2026-4244"],"published":"2026-10-05T23:40:58Z","modified":"2026-10-15T14:56:05.601333622Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104874"},{"type":"WEB","url":"https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40"},{"type":"PACKAGE","url":"https://github.com/aio-libs/multidict"},{"type":"WEB","url":"https://github.com/aio-libs/multidict/releases/tag/v6.9.1"},{"type":"PACKAGE","url":"https://pypi.org/project/multidict"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-54p9-h82j-f925"}],"versionKeys":["pypi:multidict@6.7.0","pypi:multidict@6.7.1"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-558c-9hv2-4prj","slug":"ghsa-558c-9hv2-4prj-1ba67416","dossier":false,"summary":"virtualenv: Generated files can follow existing destination links","aliases":["BIT-virtualenv-2026-113721","CVE-2026-113721"],"sourceIds":["GHSA-558c-9hv2-4prj"],"published":"2026-10-22T17:03:12Z","modified":"2026-10-29T10:55:51.822936662Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113721"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3431"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-55wc-3pg8-jfw6","slug":"ghsa-55wc-3pg8-jfw6-7a30c525","dossier":false,"summary":"undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor","aliases":["CVE-2026-87029"],"sourceIds":["GHSA-55wc-3pg8-jfw6"],"published":"2026-10-27T19:02:10Z","modified":"2026-10-27T19:15:22.392692308Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87029"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/63cba7712ca012b2603c6aeeb4c72d8692332cd0"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/f851f315db1f2acce0ea668f88d9d0fa61c8420c"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5639-2j2p-m4mx","slug":"ghsa-5639-2j2p-m4mx-3aefc2b3","dossier":false,"summary":"Mako: Path traversal via drive-letter URI on Windows in TemplateLookup","aliases":["CVE-2026-102991","PYSEC-2026-4243"],"sourceIds":["GHSA-5639-2j2p-m4mx","PYSEC-2026-4243"],"published":"2026-10-05T23:42:02Z","modified":"2026-10-15T14:55:45.473045835Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102991"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/issues/441"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/000ed85e4e48771eff460bf4fc721fb43de80e08"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_4_2"},{"type":"PACKAGE","url":"https://pypi.org/project/mako"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5639-2j2p-m4mx"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.12","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-567q-5qvw-pf92","slug":"ghsa-567q-5qvw-pf92-60527ab6","dossier":false,"summary":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","aliases":["CVE-2026-112907"],"sourceIds":["GHSA-567q-5qvw-pf92"],"published":"2026-10-23T22:27:32Z","modified":"2026-10-23T22:45:03.452878321Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-587h-7wmj-h5pm","slug":"ghsa-587h-7wmj-h5pm-d91659cb","dossier":false,"summary":"launch-editor: `fs.existsSync()` existence check can be bypassed on Windows","aliases":["CVE-2026-112942"],"sourceIds":["GHSA-587h-7wmj-h5pm"],"published":"2026-10-20T19:48:25Z","modified":"2026-10-20T20:00:04.608979840Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-587h-7wmj-h5pm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112942"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/commit/f13cd835d4b8e860b1d4d080ad8a490cc2463679"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-58r4-6rv3-gfh8","slug":"ghsa-58r4-6rv3-gfh8-17253bd5","dossier":true,"summary":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","aliases":["BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329"],"sourceIds":["GHSA-58r4-6rv3-gfh8","PYSEC-2026-4329"],"published":"2026-10-19T22:17:06.970Z","modified":"2026-10-28T11:10:53.627071818Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112397"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-597g-3phw-6986","slug":"ghsa-597g-3phw-6986-6d75801e","dossier":false,"summary":"virtualenv Has TOCTOU Vulnerabilities in Directory Creation","aliases":["BIT-virtualenv-2026-22702","CVE-2026-22702","PYSEC-2026-2009"],"sourceIds":["GHSA-597g-3phw-6986","PYSEC-2026-2009"],"published":"2026-01-13T18:45:57Z","modified":"2026-09-10T03:50:32.732715893Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22702"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3013"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/dec4cec5d16edaf83a00a658f32d1e032661cebc"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"PACKAGE","url":"https://pypi.org/project/virtualenv"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-597g-3phw-6986"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-59cr-6r3x-644w","slug":"ghsa-59cr-6r3x-644w-a8ec12fb","dossier":false,"summary":"GitPython submodule update path traversal can write outside the repository","aliases":["CVE-2026-100689"],"sourceIds":["GHSA-59cr-6r3x-644w"],"published":"2026-09-30T23:47:12Z","modified":"2026-10-01T00:00:05.754996881Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-59cr-6r3x-644w"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2225"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1ed0ebc2f2e74d979cdc367a4864a7731fdcc093"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-59g5-xgcq-4qw3","slug":"ghsa-59g5-xgcq-4qw3-949fce0e","dossier":false,"summary":"Denial of service (DoS) via deformation `multipart/form-data` boundary","aliases":["CVE-2024-53981","PYSEC-2026-1851"],"sourceIds":["GHSA-59g5-xgcq-4qw3","PYSEC-2026-1851"],"published":"2024-12-02T21:37:04Z","modified":"2026-09-10T03:50:21.270678783Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53981"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59g5-xgcq-4qw3"}],"versionKeys":["pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-5c9x-8gcm-mpgx","slug":"ghsa-5c9x-8gcm-mpgx-c911a679","dossier":false,"summary":"Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0","aliases":["CVE-2026-42034"],"sourceIds":["GHSA-5c9x-8gcm-mpgx"],"published":"2026-05-05T00:33:25Z","modified":"2026-09-10T03:50:45.707956373Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-5c9x-8gcm-mpgx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42034"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-5h93-6whr-6q8j","slug":"ghsa-5h93-6whr-6q8j-24a4ef90","dossier":false,"summary":"Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies","aliases":["CVE-2026-116685"],"sourceIds":["GHSA-5h93-6whr-6q8j"],"published":"2026-10-27T21:05:34Z","modified":"2026-10-27T21:15:03.819223133Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-5h93-6whr-6q8j"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3397"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3448"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/2106335745563b2321b8c73fef2c12903d00aa6e"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/c6762e821c527925f0b617db216d00fbd1d0bf99"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0","pypi:mcp@1.28.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-5p39-cfhj-2xmp","slug":"ghsa-5p39-cfhj-2xmp-77a62550","dossier":false,"summary":"AnyIO process-pool workers can block indefinitely on undrained stderr","aliases":["CVE-2026-64847","PYSEC-2026-4024"],"sourceIds":["GHSA-5p39-cfhj-2xmp","PYSEC-2026-4024"],"published":"2026-09-18T17:17:10Z","modified":"2026-10-01T17:55:57.336188727Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1207"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/anyio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64847"}],"versionKeys":["pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-5p4m-2wfm-xmqj","slug":"ghsa-5p4m-2wfm-xmqj-cf9a2800","dossier":false,"summary":"JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported","aliases":[],"sourceIds":["GHSA-5p4m-2wfm-xmqj"],"published":"2026-08-06T20:27:32Z","modified":"2026-09-10T03:50:53.407436483Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-5p4m-2wfm-xmqj"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"}],"versionKeys":["npm:js-yaml@3.14.1","npm:js-yaml@3.14.2","npm:js-yaml@4.1.0","npm:js-yaml@4.1.1","npm:js-yaml@4.3.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-5rvq-cxj2-64vf","slug":"ghsa-5rvq-cxj2-64vf-5e3e7388","dossier":false,"summary":"python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","aliases":["CVE-2026-53539","PYSEC-2026-3036"],"sourceIds":["GHSA-5rvq-cxj2-64vf","PYSEC-2026-3036"],"published":"2026-06-15T20:24:09Z","modified":"2026-09-10T03:50:48.426087467Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5rvq-cxj2-64vf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53539"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-5vjq-rrrf-7h2q","slug":"ghsa-5vjq-rrrf-7h2q-86d7b4a3","dossier":false,"summary":"virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST","aliases":["BIT-virtualenv-2026-113726","CVE-2026-113726"],"sourceIds":["GHSA-5vjq-rrrf-7h2q"],"published":"2026-10-21T16:46:23Z","modified":"2026-10-29T10:55:33.825448161Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113726"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.4"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-5wmx-573v-2qwq","slug":"ghsa-5wmx-573v-2qwq-3c948197","dossier":false,"summary":"Python-Markdown has an Uncaught Exception","aliases":["CVE-2025-69534","PYSEC-2026-89"],"sourceIds":["GHSA-5wmx-573v-2qwq","PYSEC-2026-89"],"published":"2026-03-05T15:16:11.243Z","modified":"2026-09-10T03:50:37.537940778Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534"},{"type":"REPORT","url":"https://github.com/Python-Markdown/markdown/issues/1534"},{"type":"WEB","url":"https://github.com/Python-Markdown/markdown/pull/1535"},{"type":"PACKAGE","url":"https://github.com/Python-Markdown/markdown"},{"type":"WEB","url":"https://github.com/Python-Markdown/markdown/actions/runs/15736122892"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5wmx-573v-2qwq"}],"versionKeys":["pypi:markdown@3.8"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5wr8-gcqf-gqf3","slug":"ghsa-5wr8-gcqf-gqf3-8b4786ad","dossier":false,"summary":"aiohttp server lacks an initial request/header timeout","aliases":["CVE-2026-111064"],"sourceIds":["GHSA-5wr8-gcqf-gqf3"],"published":"2026-10-19T17:08:04Z","modified":"2026-10-19T17:15:04.139404381Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-5x8w-8jj5-q52h","slug":"ghsa-5x8w-8jj5-q52h-96fe86d3","dossier":true,"summary":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","aliases":["BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330"],"sourceIds":["GHSA-5x8w-8jj5-q52h","PYSEC-2026-4330"],"published":"2026-10-19T22:17:07.107Z","modified":"2026-10-28T11:10:48.833199086Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112398"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-5x94-69rx-g8h2","slug":"ghsa-5x94-69rx-g8h2-0bc05f88","dossier":false,"summary":"Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254"],"sourceIds":["GHSA-5x94-69rx-g8h2","PYSEC-2026-2254"],"published":"2026-07-06T19:17:08.270Z","modified":"2026-09-10T03:51:10.514604451Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-5xm2-6676-qcp9","slug":"ghsa-5xm2-6676-qcp9-1e22ee95","dossier":true,"summary":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","aliases":["BIT-pillow-2026-112399","CVE-2026-112399"],"sourceIds":["GHSA-5xm2-6676-qcp9"],"published":"2026-10-21T21:17:56Z","modified":"2026-10-26T08:56:16.789537980Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112399"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-5xmw-vc9v-4wf2","slug":"ghsa-5xmw-vc9v-4wf2-86a8861a","dossier":false,"summary":"Pillow has a heap buffer overflow with nested list coordinates","aliases":["BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"sourceIds":["GHSA-5xmw-vc9v-4wf2","PYSEC-2026-2251"],"published":"2026-05-04T20:18:27Z","modified":"2026-10-19T20:00:04.709097863Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"WEB","url":"https://github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/cf6de8ca9b23e714aa5310e1c791eda66fc0b670"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2251.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-5xxx-qhh7-9287","slug":"ghsa-5xxx-qhh7-9287-87d91b3e","dossier":false,"summary":"GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","aliases":["CVE-2026-78678","PYSEC-2026-3788"],"sourceIds":["GHSA-5xxx-qhh7-9287","PYSEC-2026-3788"],"published":"2026-08-25T02:16:52.313Z","modified":"2026-09-08T19:00:06.904435463Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-5xxx-qhh7-9287"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78678"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3788.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-repo-blame"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-62hf-57xw-28j9","slug":"ghsa-62hf-57xw-28j9-99ff537b","dossier":false,"summary":"Axios: unbounded recursion in toFormData causes DoS via deeply nested request data","aliases":["CVE-2026-42039"],"sourceIds":["GHSA-62hf-57xw-28j9"],"published":"2026-05-05T00:34:32Z","modified":"2026-09-10T03:50:45.703789635Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-62hf-57xw-28j9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42039"},{"type":"WEB","url":"https://github.com/axios/axios/commit/85132ffba1a77609ea5d101c8a413dea7174932f"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.15.1"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-62p4-gmf7-7g93","slug":"ghsa-62p4-gmf7-7g93-cb81341c","dossier":false,"summary":"Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)","aliases":["BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493"],"sourceIds":["GHSA-62p4-gmf7-7g93","PYSEC-2026-3493"],"published":"2026-07-20T21:08:13Z","modified":"2026-09-10T03:51:10.632149522Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9719"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-62p4-gmf7-7g93"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-62q4-447f-wv8h","slug":"ghsa-62q4-447f-wv8h-ddd02de0","dossier":false,"summary":"Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path","aliases":["CVE-2026-46338","PYSEC-2026-2999"],"sourceIds":["GHSA-62q4-447f-wv8h","PYSEC-2026-2999"],"published":"2026-05-19T20:00:29Z","modified":"2026-09-10T03:50:45.703936995Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-62q4-447f-wv8h"},{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/pull/2039"},{"type":"PACKAGE","url":"https://github.com/facelessuser/pymdown-extensions"},{"type":"PACKAGE","url":"https://pypi.org/project/pymdown-extensions"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-62q4-447f-wv8h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46338"}],"versionKeys":["pypi:pymdown-extensions@10.21.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-63hf-3vf5-4wqf","slug":"ghsa-63hf-3vf5-4wqf-aadd9f0f","dossier":false,"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","aliases":["CVE-2026-34520","PYSEC-2026-2102"],"sourceIds":["GHSA-63hf-3vf5-4wqf","PYSEC-2026-2102"],"published":"2026-04-01T21:17:00.333Z","modified":"2026-09-10T03:50:43.255807027Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-63hw-fmq6-xxg2","slug":"ghsa-63hw-fmq6-xxg2-00aac622","dossier":false,"summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","aliases":["CVE-2026-54277","PYSEC-2026-2110"],"sourceIds":["GHSA-63hw-fmq6-xxg2","PYSEC-2026-2110"],"published":"2026-06-15T20:09:16Z","modified":"2026-09-10T03:50:48.460120366Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-654x-cwwv-5j9c","slug":"ghsa-654x-cwwv-5j9c-54c66942","dossier":false,"summary":"Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1","aliases":["BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336"],"sourceIds":["GHSA-654x-cwwv-5j9c","PYSEC-2026-4336"],"published":"2026-10-21T22:16:49.410Z","modified":"2026-10-29T10:56:00.934076155Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114501"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10172"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-65pc-fj4g-8rjx","slug":"ghsa-65pc-fj4g-8rjx-9fe9e88a","dossier":true,"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","aliases":["CVE-2026-45409","PYSEC-2026-215"],"sourceIds":["GHSA-65pc-fj4g-8rjx","PYSEC-2026-215"],"published":"2026-05-19T14:34:32Z","modified":"2026-09-10T03:50:45.700124422Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}],"versionKeys":["pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-65qm-jvmh-6pqg","slug":"ghsa-65qm-jvmh-6pqg-7925f039","dossier":true,"summary":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","aliases":["BIT-pillow-2026-112400","CVE-2026-112400"],"sourceIds":["GHSA-65qm-jvmh-6pqg"],"published":"2026-10-20T20:53:36Z","modified":"2026-10-26T08:55:49.781288748Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112400"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-68fv-2mgg-jv7q","slug":"ghsa-68fv-2mgg-jv7q-a588da43","dossier":false,"summary":"source-map-js allows event-loop denial of service through indexed source-map section offsets","aliases":["CVE-2026-93749"],"sourceIds":["GHSA-68fv-2mgg-jv7q"],"published":"2026-09-18T18:31:44Z","modified":"2026-10-05T23:45:07.974936711Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93749"},{"type":"WEB","url":"https://github.com/7rulnik/source-map-js/issues/76"},{"type":"WEB","url":"https://github.com/7rulnik/source-map-js/pull/79"},{"type":"WEB","url":"https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016"},{"type":"PACKAGE","url":"https://github.com/7rulnik/source-map-js"},{"type":"WEB","url":"https://github.com/7rulnik/source-map-js/blob/c1cd8904bb7bd0c7fb5879fcda48134d82a27934/lib/source-node.js#L115-L118"},{"type":"WEB","url":"https://github.com/7rulnik/source-map-js/releases/tag/v1.2.2"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/source-map-js-through-1.2.1-event-loop-denial-of-service"}],"versionKeys":["npm:source-map-js@1.2.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-698v-4r3x-3vcv","slug":"ghsa-698v-4r3x-3vcv-1bca3b44","dossier":false,"summary":"launch-editor: escapeCmdArgs() omits % escaping on Windows","aliases":["CVE-2026-112943"],"sourceIds":["GHSA-698v-4r3x-3vcv"],"published":"2026-10-20T18:30:24Z","modified":"2026-10-20T18:45:09.467993691Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-698v-4r3x-3vcv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112943"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/pull/155"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/commit/3c2f9bf2ff8fe63d056a8f9cc52d825b66ca79fc"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-69f9-5gxw-wvc2","slug":"ghsa-69f9-5gxw-wvc2-eec14573","dossier":false,"summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","aliases":["CVE-2025-69224","PYSEC-2026-1099"],"sourceIds":["GHSA-69f9-5gxw-wvc2","PYSEC-2026-1099"],"published":"2026-01-05T22:58:57Z","modified":"2026-09-10T03:49:54.440954011Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69f9-5gxw-wvc2"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-69hj-f68j-2879","slug":"ghsa-69hj-f68j-2879-d34e420d","dossier":true,"summary":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","aliases":["CVE-2026-112909"],"sourceIds":["GHSA-69hj-f68j-2879"],"published":"2026-10-28T21:08:35Z","modified":"2026-10-28T21:15:04.974667790Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3","pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-6chq-wfr3-2hj9","slug":"ghsa-6chq-wfr3-2hj9-cc9a2a5e","dossier":false,"summary":"Axios: Header Injection via Prototype Pollution","aliases":["CVE-2026-42035"],"sourceIds":["GHSA-6chq-wfr3-2hj9"],"published":"2026-05-05T00:25:47Z","modified":"2026-09-10T03:51:04.772235088Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-6chq-wfr3-2hj9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42035"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-6cjc-53gc-5rqm","slug":"ghsa-6cjc-53gc-5rqm-f1beb40a","dossier":false,"summary":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","aliases":["CVE-2026-111065"],"sourceIds":["GHSA-6cjc-53gc-5rqm"],"published":"2026-10-20T19:57:24Z","modified":"2026-10-20T20:15:05.286053785Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111065"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-6g55-p6wh-862q","slug":"ghsa-6g55-p6wh-862q-12f1aeab","dossier":false,"summary":"PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments","aliases":["CVE-2026-45623"],"sourceIds":["GHSA-6g55-p6wh-862q"],"published":"2026-07-23T15:06:16Z","modified":"2026-09-10T03:51:10.752909750Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q"},{"type":"WEB","url":"https://github.com/postcss/postcss/commit/aaec7b78b3ce2792585b4b300ef1bd5dd5b3e8ad"},{"type":"WEB","url":"https://github.com/postcss/postcss/commit/c64b7488d2731dfa16213739b42c34faf5a9eba3"},{"type":"PACKAGE","url":"https://github.com/postcss/postcss"},{"type":"WEB","url":"https://github.com/postcss/postcss/releases/tag/8.5.12"}],"versionKeys":["npm:postcss@8.4.49","npm:postcss@8.5.3","npm:postcss@8.5.6"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-6hr6-w5qg-qmwg","slug":"ghsa-6hr6-w5qg-qmwg-135c855f","dossier":false,"summary":"h2: Duplicate Host header could facilitate request smuggling","aliases":["CVE-2026-71554","PYSEC-2026-3628"],"sourceIds":["GHSA-6hr6-w5qg-qmwg","PYSEC-2026-3628"],"published":"2026-08-06T21:53:41Z","modified":"2026-09-10T03:51:13.136510577Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h2/security/advisories/GHSA-6hr6-w5qg-qmwg"},{"type":"WEB","url":"https://github.com/python-hyper/h2/commit/292a40829feefda98c8509dcdbbb4a57af9bd6a6"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h2"},{"type":"PACKAGE","url":"https://pypi.org/project/h2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6hr6-w5qg-qmwg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71554"}],"versionKeys":["pypi:h2@4.1.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-6j4f-fj2g-mc7p","slug":"ghsa-6j4f-fj2g-mc7p-48b1368d","dossier":false,"summary":"brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion","aliases":["CVE-2026-102276"],"sourceIds":["GHSA-6j4f-fj2g-mc7p"],"published":"2026-09-29T23:44:58Z","modified":"2026-09-30T00:00:03.836613572Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102276"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/5171e681c0922b7ae8bfaf9a331e309107be6edc"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@1.1.16","npm:brace-expansion@2.0.2","npm:brace-expansion@5.0.8"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-6jhg-hg63-jvvf","slug":"ghsa-6jhg-hg63-jvvf-74cd77d8","dossier":false,"summary":"AIOHTTP vulnerable to  denial of service through large payloads","aliases":["CVE-2025-69228","PYSEC-2026-1100"],"sourceIds":["GHSA-6jhg-hg63-jvvf","PYSEC-2026-1100"],"published":"2026-01-05T23:13:14Z","modified":"2026-09-10T03:50:32.839537992Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69228"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6jhg-hg63-jvvf"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6jv3-5f52-599m","slug":"ghsa-6jv3-5f52-599m-dd700d26","dossier":false,"summary":"python-multipart: Semicolon treated as querystring field separator enables parameter smuggling","aliases":["CVE-2026-53538","PYSEC-2026-3037"],"sourceIds":["GHSA-6jv3-5f52-599m","PYSEC-2026-3037"],"published":"2026-06-15T20:22:25Z","modified":"2026-09-10T03:51:07.925895532Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599m"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6jv3-5f52-599m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53538"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-6mq8-rvhq-8wgg","slug":"ghsa-6mq8-rvhq-8wgg-d94d738f","dossier":false,"summary":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","aliases":["CVE-2025-69223","PYSEC-2026-1101"],"sourceIds":["GHSA-6mq8-rvhq-8wgg","PYSEC-2026-1101"],"published":"2026-01-05T22:58:41Z","modified":"2026-09-10T03:50:32.830751052Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6mq8-rvhq-8wgg"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6p8h-3wgx-97gf","slug":"ghsa-6p8h-3wgx-97gf-635a010c","dossier":false,"summary":"GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks","aliases":["CVE-2026-73623","PYSEC-2026-3952"],"sourceIds":["GHSA-6p8h-3wgx-97gf","PYSEC-2026-3952"],"published":"2026-07-24T16:42:09Z","modified":"2026-09-10T13:11:03.995690741Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-6p8h-3wgx-97gf"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-template"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-6pq8-jhm2-2vcw","slug":"ghsa-6pq8-jhm2-2vcw-7a7bd087","dossier":false,"summary":"qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)","aliases":["CVE-2026-110816"],"sourceIds":["GHSA-6pq8-jhm2-2vcw"],"published":"2026-10-27T16:10:55Z","modified":"2026-10-27T16:15:05.324423680Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110816"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"},{"type":"WEB","url":"https://github.com/ljharb/qs/releases/tag/v6.16.1"}],"versionKeys":["npm:qs@6.13.0","npm:qs@6.14.1","npm:qs@6.16.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-6q48-6c7w-9gw2","slug":"ghsa-6q48-6c7w-9gw2-05036ff0","dossier":true,"summary":"certifi bundles emSign root CAs with compromised intermediate CA keys","aliases":["PYSEC-2026-4320"],"sourceIds":["GHSA-6q48-6c7w-9gw2","PYSEC-2026-4320"],"published":"2026-10-20T19:35:05Z","modified":"2026-10-30T14:00:02.590922333Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2"},{"type":"WEB","url":"https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576"},{"type":"WEB","url":"https://emudhra.we-have-a-problem.com/"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"PACKAGE","url":"https://pypi.org/project/certifi"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2"}],"versionKeys":["pypi:certifi@2024.12.14","pypi:certifi@2024.6.2","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17"],"packageCount":1,"repositoryCount":21},{"id":"GHSA-6r8x-57c9-28j4","slug":"ghsa-6r8x-57c9-28j4-3a620dbf","dossier":false,"summary":"Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow","aliases":["BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451"],"sourceIds":["GHSA-6r8x-57c9-28j4","PYSEC-2026-3451"],"published":"2026-07-14T16:17:01.937Z","modified":"2026-09-10T03:51:10.822199342Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59199"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-6rw7-vpxm-498p","slug":"ghsa-6rw7-vpxm-498p-92461380","dossier":false,"summary":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","aliases":["CVE-2025-15284"],"sourceIds":["GHSA-6rw7-vpxm-498p"],"published":"2025-12-30T21:02:54Z","modified":"2026-09-10T03:50:31.670581449Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"versionKeys":["npm:qs@6.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-6w3r-xr62-4xcp","slug":"ghsa-6w3r-xr62-4xcp-69d1732a","dossier":false,"summary":"virtualenv: Bash prompt values can change meaning under older compatibility modes","aliases":["BIT-virtualenv-2026-113723","CVE-2026-113723"],"sourceIds":["GHSA-6w3r-xr62-4xcp"],"published":"2026-10-23T22:21:57Z","modified":"2026-10-29T10:55:32.039209236Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113723"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3418"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6w46-j5rx-g56g","slug":"ghsa-6w46-j5rx-g56g-5324d549","dossier":false,"summary":"pytest has vulnerable tmpdir handling","aliases":["CVE-2025-71176","PYSEC-2026-1845"],"sourceIds":["GHSA-6w46-j5rx-g56g","PYSEC-2026-1845"],"published":"2026-01-22T06:30:29Z","modified":"2026-09-10T03:50:32.768043789Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71176"},{"type":"WEB","url":"https://github.com/pytest-dev/pytest/issues/13669"},{"type":"WEB","url":"https://github.com/pytest-dev/pytest/pull/14343"},{"type":"WEB","url":"https://github.com/pytest-dev/pytest/commit/95d8423bd24992deea5b9df32555fa1741679e2c"},{"type":"PACKAGE","url":"https://github.com/pytest-dev/pytes"},{"type":"WEB","url":"https://github.com/pytest-dev/pytest/releases/tag/9.0.3"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/01/21/5"},{"type":"PACKAGE","url":"https://pypi.org/project/pytest"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6w46-j5rx-g56g"}],"versionKeys":["pypi:pytest@7.2.2","pypi:pytest@7.4.4","pypi:pytest@8.3.2","pypi:pytest@8.4.2","pypi:pytest@9.0.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-73rr-hh4g-fpgx","slug":"ghsa-73rr-hh4g-fpgx-9d9e2d44","dossier":false,"summary":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","aliases":["CVE-2026-24001"],"sourceIds":["GHSA-73rr-hh4g-fpgx"],"published":"2026-01-14T21:34:12Z","modified":"2026-09-10T03:50:32.703687207Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001"},{"type":"WEB","url":"https://github.com/kpdecker/jsdiff/issues/653"},{"type":"WEB","url":"https://github.com/kpdecker/jsdiff/pull/649"},{"type":"WEB","url":"https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5"},{"type":"PACKAGE","url":"https://github.com/kpdecker/jsdiff"}],"versionKeys":["npm:diff@5.2.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-73wf-gq98-2v4g","slug":"ghsa-73wf-gq98-2v4g-759c3c89","dossier":false,"summary":"Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.json custom stats (normalizeStats)","aliases":["CVE-2026-73088"],"sourceIds":["GHSA-73wf-gq98-2v4g"],"published":"2026-09-01T16:41:54Z","modified":"2026-09-10T03:51:15.295037659Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-73wf-gq98-2v4g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73088"},{"type":"WEB","url":"https://github.com/browserslist/browserslist/commit/f9914ad9effc865ccc27d816255625890b31ca51"},{"type":"PACKAGE","url":"https://github.com/browserslist/browserslist"},{"type":"WEB","url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7"}],"versionKeys":["npm:browserslist@4.24.4"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-74r2-7ff9-mjj2","slug":"ghsa-74r2-7ff9-mjj2-9127f170","dossier":true,"summary":"Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()","aliases":["BIT-pillow-2026-112401","CVE-2026-112401"],"sourceIds":["GHSA-74r2-7ff9-mjj2"],"published":"2026-10-21T20:42:11Z","modified":"2026-10-26T08:56:13.792431880Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112401"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-752w-5fwx-jx9f","slug":"ghsa-752w-5fwx-jx9f-389afa77","dossier":false,"summary":"PyJWT accepts unknown `crit` header extensions","aliases":["CVE-2026-32597","PYSEC-2026-120"],"sourceIds":["GHSA-752w-5fwx-jx9f","PYSEC-2026-120"],"published":"2026-03-13T19:55:09.500Z","modified":"2026-09-10T03:50:59.993704484Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32597"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-120.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-7545-fcxq-7j24","slug":"ghsa-7545-fcxq-7j24-84dd19fd","dossier":false,"summary":"GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository","aliases":["CVE-2026-44243","PYSEC-2026-2162"],"sourceIds":["GHSA-7545-fcxq-7j24","PYSEC-2026-2162"],"published":"2026-05-06T19:38:48Z","modified":"2026-09-10T03:50:45.903378498Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44243"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.48"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-768j-98cg-p3fv","slug":"ghsa-768j-98cg-p3fv-0815ff07","dossier":false,"summary":"fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib","aliases":["CVE-2025-66034","PYSEC-2026-1389"],"sourceIds":["GHSA-768j-98cg-p3fv","PYSEC-2026-1389"],"published":"2025-12-01T19:07:00Z","modified":"2026-09-10T03:50:31.754255627Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66034"},{"type":"WEB","url":"https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"},{"type":"PACKAGE","url":"https://github.com/fonttools/fonttools"},{"type":"PACKAGE","url":"https://pypi.org/project/fonttools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-768j-98cg-p3fv"}],"versionKeys":["pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-777c-7fjr-54vf","slug":"ghsa-777c-7fjr-54vf-79940191","dossier":false,"summary":"Allocation of Resources Without Limits or Throttling in Axios","aliases":["CVE-2026-44488"],"sourceIds":["GHSA-777c-7fjr-54vf"],"published":"2026-06-04T14:21:37Z","modified":"2026-09-10T03:50:48.738717543Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44488"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10795"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10796"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.16.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-7833-fr7j-v32q","slug":"ghsa-7833-fr7j-v32q-fd003872","dossier":false,"summary":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","aliases":["CVE-2026-78675","PYSEC-2026-3785"],"sourceIds":["GHSA-7833-fr7j-v32q","PYSEC-2026-3785"],"published":"2026-08-25T02:16:51.887Z","modified":"2026-09-23T05:15:05.931147061Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7833-fr7j-v32q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78675"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2211"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/ef7568e3b317ce617eacda39b8b54dcdff8c3b5c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3785.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-local-file-content-disclosure-via-gitmodules"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-78g4-xqwv-q3g8","slug":"ghsa-78g4-xqwv-q3g8-95d38591","dossier":false,"summary":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()","aliases":[],"sourceIds":["GHSA-78g4-xqwv-q3g8"],"published":"2026-10-22T17:01:08Z","modified":"2026-10-22T17:15:04.326552524Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0"},{"type":"WEB","url":"https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"WEB","url":"https://osv.dev/vulnerability/OSV-2025-219"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-79v4-65xg-pq4g","slug":"ghsa-79v4-65xg-pq4g-b911b371","dossier":false,"summary":"Vulnerable OpenSSL included in cryptography wheels","aliases":["CVE-2024-12797","PYSEC-2026-1284"],"sourceIds":["GHSA-79v4-65xg-pq4g","PYSEC-2026-1284"],"published":"2025-02-11T18:06:42Z","modified":"2026-09-10T03:50:22.501671988Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-79v4-65xg-pq4g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12797"},{"type":"WEB","url":"https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9"},{"type":"WEB","url":"https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7"},{"type":"WEB","url":"https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://openssl-library.org/news/secadv/20250211.txt"},{"type":"PACKAGE","url":"https://pypi.org/project/cryptography"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-79v4-65xg-pq4g"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-7f5h-v6xp-fcq8","slug":"ghsa-7f5h-v6xp-fcq8-9393173e","dossier":false,"summary":"Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``","aliases":["CVE-2025-62727","PYSEC-2026-1942"],"sourceIds":["GHSA-7f5h-v6xp-fcq8","PYSEC-2026-1942"],"published":"2025-10-28T20:38:01Z","modified":"2026-09-10T03:50:29.490992457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62727"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"},{"type":"INTRODUCED","url":"https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/Kludex/starlette/releases/tag/0.49.1"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7f5h-v6xp-fcq8"}],"versionKeys":["pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-7gcm-g887-7qv7","slug":"ghsa-7gcm-g887-7qv7-55bb9ff1","dossier":false,"summary":"protobuf affected by a JSON recursion depth bypass","aliases":["CVE-2026-0994","PYSEC-2026-1805"],"sourceIds":["GHSA-7gcm-g887-7qv7","PYSEC-2026-1805"],"published":"2026-01-23T15:31:35Z","modified":"2026-09-10T03:50:32.795512159Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0994"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/issues/25070"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/pull/25239"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gcm-g887-7qv7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-7mwm-ghpf-9vrm","slug":"ghsa-7mwm-ghpf-9vrm-446e4269","dossier":true,"summary":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","aliases":["BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331"],"sourceIds":["GHSA-7mwm-ghpf-9vrm","PYSEC-2026-4331"],"published":"2026-10-19T22:17:07.633Z","modified":"2026-10-28T11:10:35.587185673Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112402"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-7q8q-rj6j-mhjq","slug":"ghsa-7q8q-rj6j-mhjq-b9d31f9e","dossier":false,"summary":"Axios: Nested axios option objects can consume polluted prototype values","aliases":["CVE-2026-67319"],"sourceIds":["GHSA-7q8q-rj6j-mhjq"],"published":"2026-07-20T22:37:31Z","modified":"2026-09-10T03:51:10.872027953Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-7q8q-rj6j-mhjq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67319"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69123"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11001"},{"type":"WEB","url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.33.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-nested-option-objects"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-7r86-cg39-jmmj","slug":"ghsa-7r86-cg39-jmmj-b67be21b","dossier":false,"summary":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","aliases":["CVE-2026-27903"],"sourceIds":["GHSA-7r86-cg39-jmmj"],"published":"2026-02-26T22:10:18Z","modified":"2026-09-10T03:50:34.376990726Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"},{"type":"PACKAGE","url":"https://github.com/isaacs/minimatch"}],"versionKeys":["npm:minimatch@10.0.3","npm:minimatch@10.1.1","npm:minimatch@3.1.2","npm:minimatch@9.0.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-7rv5-mrxv-xcr9","slug":"ghsa-7rv5-mrxv-xcr9-8fcf3ecf","dossier":false,"summary":"Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check","aliases":["CVE-2026-116580"],"sourceIds":["GHSA-7rv5-mrxv-xcr9"],"published":"2026-10-28T21:17:15Z","modified":"2026-10-28T21:30:03.899348358Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116580"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d"},{"type":"PACKAGE","url":"https://github.com/lxsmnsyc/seroval"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8"}],"versionKeys":["npm:seroval@1.6.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-82r6-8w77-94w6","slug":"ghsa-82r6-8w77-94w6-217253d8","dossier":false,"summary":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","aliases":["CVE-2026-63374","PYSEC-2026-4025"],"sourceIds":["GHSA-82r6-8w77-94w6","PYSEC-2026-4025"],"published":"2026-09-18T17:17:18Z","modified":"2026-10-01T17:56:11.058322399Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1208"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/anyio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-82r6-8w77-94w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63374"}],"versionKeys":["pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-82w8-qh3p-5jfq","slug":"ghsa-82w8-qh3p-5jfq-a05ef51e","dossier":false,"summary":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","aliases":["CVE-2026-54283","PYSEC-2026-249"],"sourceIds":["GHSA-82w8-qh3p-5jfq","PYSEC-2026-249"],"published":"2026-06-15T20:39:53Z","modified":"2026-09-10T03:51:08.156199030Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-836r-79rf-4m37","slug":"ghsa-836r-79rf-4m37-54a23e8e","dossier":false,"summary":"Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser","aliases":["CVE-2026-49477","PYSEC-2026-3072"],"sourceIds":["GHSA-836r-79rf-4m37","PYSEC-2026-3072"],"published":"2026-07-09T13:37:46Z","modified":"2026-09-10T03:51:10.949295830Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-836r-79rf-4m37"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"PACKAGE","url":"https://pypi.org/project/soupsieve"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-836r-79rf-4m37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49477"}],"versionKeys":["pypi:soupsieve@2.6","pypi:soupsieve@2.7","pypi:soupsieve@2.8"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-83vg-56qc-22m7","slug":"ghsa-83vg-56qc-22m7-6ad99a7a","dossier":false,"summary":"GitPython validates a submodule's \".git\" path only after cloning into it (RCE)","aliases":["CVE-2026-114145"],"sourceIds":["GHSA-83vg-56qc-22m7"],"published":"2026-10-22T16:41:14Z","modified":"2026-10-22T16:45:04.297463159Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-83vg-56qc-22m7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114145"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2264"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/97eadb888d2f99567e3113f4e455be4ca128f697"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.1"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-8436-99hf-9mmv","slug":"ghsa-8436-99hf-9mmv-7d937725","dossier":false,"summary":"undici vulnerable to caching and replay of unsafe HTTP method responses","aliases":["CVE-2026-85008"],"sourceIds":["GHSA-8436-99hf-9mmv"],"published":"2026-09-29T18:16:28Z","modified":"2026-09-29T18:28:12.530229215Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85008"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2be07bf97b3022e0324142d31f99f6e019d815e3"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b61d9432bac7caac51273ad209862e4c0bf935ae"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-847f-9342-265h","slug":"ghsa-847f-9342-265h-4ea27b92","dossier":false,"summary":"h2 allows HTTP Request Smuggling due to illegal characters in headers","aliases":["CVE-2025-57804","PYSEC-2026-1435"],"sourceIds":["GHSA-847f-9342-265h","PYSEC-2026-1435"],"published":"2025-08-25T20:44:43Z","modified":"2026-09-10T03:50:26.965133425Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-57804"},{"type":"WEB","url":"https://github.com/python-hyper/h2/commit/035e9899f95e3709af098f578bfc3cd302298e3a"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h2"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00004.html"},{"type":"PACKAGE","url":"https://pypi.org/project/h2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-847f-9342-265h"}],"versionKeys":["pypi:h2@4.1.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-84m7-p3x7-pcfv","slug":"ghsa-84m7-p3x7-pcfv-fb980c8b","dossier":false,"summary":"MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion","aliases":["CVE-2026-59951"],"sourceIds":["GHSA-84m7-p3x7-pcfv"],"published":"2026-10-15T20:13:13Z","modified":"2026-10-15T20:30:08.565001293Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59951"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3395"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3426"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0","pypi:mcp@1.28.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-86qp-5c8j-p5mr","slug":"ghsa-86qp-5c8j-p5mr-13e563cb","dossier":false,"summary":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","aliases":["CVE-2026-48710","PYSEC-2026-161","X41-2026-002"],"sourceIds":["GHSA-86qp-5c8j-p5mr","PYSEC-2026-161"],"published":"2026-05-22T13:10:03Z","modified":"2026-09-10T03:51:08.121685407Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"type":"WEB","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"type":"ARTICLE","url":"https://www.secwest.net/starlette"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"type":"WEB","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"type":"DETECTION","url":"https://badhost.org/"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"type":"ARTICLE","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"},{"type":"ADVISORY","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-8988-9cw3-xx77","slug":"ghsa-8988-9cw3-xx77-ee9c660c","dossier":true,"summary":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","aliases":["CVE-2026-97687","PYSEC-2026-4175"],"sourceIds":["GHSA-8988-9cw3-xx77","PYSEC-2026-4175"],"published":"2026-09-30T14:46:04Z","modified":"2026-10-01T17:55:53.793608550Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/pull/5093"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8988-9cw3-xx77"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-898c-q2cr-xwhg","slug":"ghsa-898c-q2cr-xwhg-6a541ace","dossier":false,"summary":"axios has DoS & Header Injection via Prototype Pollution Read-Side Gadgets in axios merge functions","aliases":["CVE-2026-44490"],"sourceIds":["GHSA-898c-q2cr-xwhg"],"published":"2026-05-29T15:54:57Z","modified":"2026-09-10T03:51:04.811379218Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-898c-q2cr-xwhg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44490"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-8g5g-8vmr-9782","slug":"ghsa-8g5g-8vmr-9782-3b73f6ca","dossier":false,"summary":"Pillow: Heap buffer overflow in ImagingJpegDecode","aliases":["BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332"],"sourceIds":["GHSA-8g5g-8vmr-9782","PYSEC-2026-4332"],"published":"2026-10-19T22:17:07.770Z","modified":"2026-10-28T11:10:51.788355157Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112403"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-8mcc-hrx5-hvxc","slug":"ghsa-8mcc-hrx5-hvxc-9da62a9f","dossier":false,"summary":"GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","aliases":["CVE-2026-78677","PYSEC-2026-3787"],"sourceIds":["GHSA-8mcc-hrx5-hvxc","PYSEC-2026-3787"],"published":"2026-08-25T02:16:52.173Z","modified":"2026-09-08T19:00:06.914140693Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-8mcc-hrx5-hvxc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-78677"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2210"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/b68afff45af0f49e79a3e2d2162018986b37ad5d"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.59"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3787.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-separate-git-dir"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-8mx5-7m5m-r77g","slug":"ghsa-8mx5-7m5m-r77g-03e425ff","dossier":false,"summary":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","aliases":["CVE-2026-112910"],"sourceIds":["GHSA-8mx5-7m5m-r77g"],"published":"2026-10-28T21:08:55Z","modified":"2026-10-28T21:15:05.688436299Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3","pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-8qvm-5x2c-j2w7","slug":"ghsa-8qvm-5x2c-j2w7-8a075519","dossier":false,"summary":"protobuf-python has a potential Denial of Service issue","aliases":["CVE-2025-4565","PYSEC-2026-1806"],"sourceIds":["GHSA-8qvm-5x2c-j2w7","PYSEC-2026-1806"],"published":"2025-06-16T16:02:58Z","modified":"2026-09-10T03:50:25.255076549Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8qvm-5x2c-j2w7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-8rjx-v5ww-45pp","slug":"ghsa-8rjx-v5ww-45pp-d32996f1","dossier":false,"summary":"virtualenv activation scripts run code from a path that contains a placeholder name","aliases":["BIT-virtualenv-2026-113776","CVE-2026-113776"],"sourceIds":["GHSA-8rjx-v5ww-45pp"],"published":"2026-10-21T16:39:38Z","modified":"2026-10-29T10:55:59.336337258Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113776"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.2"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-8v84-f9pq-wr9x","slug":"ghsa-8v84-f9pq-wr9x-6c1b185f","dossier":false,"summary":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","aliases":["BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253"],"sourceIds":["GHSA-8v84-f9pq-wr9x","PYSEC-2026-2253"],"published":"2026-07-06T19:17:08.127Z","modified":"2026-09-10T03:51:11.229114807Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-8v8h-hg4w-mvq2","slug":"ghsa-8v8h-hg4w-mvq2-aca160b2","dossier":false,"summary":"hpack: Unbounded variable integer decoding can cause run-away computation on malformed input","aliases":["CVE-2026-59980","PYSEC-2026-4053"],"sourceIds":["GHSA-8v8h-hg4w-mvq2","PYSEC-2026-4053"],"published":"2026-09-24T19:43:26Z","modified":"2026-10-01T17:55:38.238084125Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59980"},{"type":"WEB","url":"https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c"},{"type":"WEB","url":"https://cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a"},{"type":"WEB","url":"https://docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html#403"},{"type":"PACKAGE","url":"https://github.com/python-hyper/hpack"},{"type":"WEB","url":"https://github.com/python-hyper/hpack/releases/tag/v4.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/hpack"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8v8h-hg4w-mvq2"}],"versionKeys":["pypi:hpack@4.0.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-8wjv-2p76-3863","slug":"ghsa-8wjv-2p76-3863-60244895","dossier":false,"summary":"PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header","aliases":["CVE-2026-102265","PYSEC-2026-4142"],"sourceIds":["GHSA-8wjv-2p76-3863","PYSEC-2026-4142"],"published":"2026-09-29T23:43:06Z","modified":"2026-10-01T17:55:45.157085612Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102265"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8wjv-2p76-3863"}],"versionKeys":["pypi:pyjwt@2.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-8xcm-r25x-g524","slug":"ghsa-8xcm-r25x-g524-9e9c51a0","dossier":false,"summary":"undici vulnerable to downstream response desynchronization via retry interceptor","aliases":["CVE-2026-16728"],"sourceIds":["GHSA-8xcm-r25x-g524"],"published":"2026-08-03T19:24:33Z","modified":"2026-09-10T03:51:13.567076059Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-8xcm-r25x-g524"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16728"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/1b5a5312c3a7d7a30c31bf0d000b39a8a2531e1c"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2b3f749336d356bbbc50192f87f6cf7bc714721a"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/4a9dafb16ff43880cf590e6d9c2aeee25fbff6d7"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/4fd5a0c61e627f928b7003adc4ffe1e55ec63420"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cba3a52ac2e7abcc4e656d82af8579ea82c2bb9e"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/e11a68ed4ff345c79402476f7a00d473443e318d"},{"type":"WEB","url":"https://hackerone.com/reports/3828685"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-93m4-6634-74q7","slug":"ghsa-93m4-6634-74q7-557bfeeb","dossier":false,"summary":"vite allows server.fs.deny bypass via backslash on Windows","aliases":["CVE-2025-62522"],"sourceIds":["GHSA-93m4-6634-74q7"],"published":"2025-10-20T19:54:28Z","modified":"2026-09-10T03:50:29.574857832Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62522"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"versionKeys":["npm:vite@6.3.5"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-94p4-4cq8-9g67","slug":"ghsa-94p4-4cq8-9g67-9a288a09","dossier":false,"summary":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","aliases":["CVE-2026-73622","PYSEC-2026-3951"],"sourceIds":["GHSA-94p4-4cq8-9g67","PYSEC-2026-3951"],"published":"2026-07-24T21:45:16Z","modified":"2026-09-24T14:45:07.411775302Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-94p4-4cq8-9g67"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/863417457a0633db7ea5aed4fd01e0b291a41162"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3951.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-remote-add"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-94p9-xgh2-xp45","slug":"ghsa-94p9-xgh2-xp45-1ed45366","dossier":false,"summary":"virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use","aliases":["BIT-virtualenv-2026-102930","CVE-2026-102930","PYSEC-2026-4011"],"sourceIds":["GHSA-94p9-xgh2-xp45","PYSEC-2026-4011"],"published":"2026-09-18T01:41:45Z","modified":"2026-10-06T15:26:06.490658879Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102930"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3251"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4011.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.7.12"},{"type":"PACKAGE","url":"https://pypi.org/project/virtualenv"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-9548-qrrj-x5pj","slug":"ghsa-9548-qrrj-x5pj-6121f213","dossier":false,"summary":"AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","aliases":["CVE-2025-53643","PYSEC-2026-1104"],"sourceIds":["GHSA-9548-qrrj-x5pj","PYSEC-2026-1104"],"published":"2025-07-14T19:33:31Z","modified":"2026-09-10T03:50:26.231846188Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9548-qrrj-x5pj"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-956x-8gvw-wg5v","slug":"ghsa-956x-8gvw-wg5v-f5d32b2d","dossier":false,"summary":"GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`","aliases":["CVE-2026-67323","PYSEC-2026-3839"],"sourceIds":["GHSA-956x-8gvw-wg5v","PYSEC-2026-3839"],"published":"2026-07-21T20:10:06Z","modified":"2026-09-10T12:25:39.217544351Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-956x-8gvw-wg5v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67323"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2163"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/701ce32fe5ba8cb622c0e0342a376a6beb47d738"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.51"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-injection-via-unguarded-git-options"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-956x-8gvw-wg5v"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-966j-vmvw-g2g9","slug":"ghsa-966j-vmvw-g2g9-dad9a989","dossier":false,"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","aliases":["CVE-2026-34518","PYSEC-2026-2100"],"sourceIds":["GHSA-966j-vmvw-g2g9","PYSEC-2026-2100"],"published":"2026-04-01T21:17:00.020Z","modified":"2026-09-10T03:51:01.374434696Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-97r2-qh9m-474h","slug":"ghsa-97r2-qh9m-474h-644e1396","dossier":false,"summary":"Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)","aliases":["CVE-2026-116581"],"sourceIds":["GHSA-97r2-qh9m-474h"],"published":"2026-10-28T21:17:27Z","modified":"2026-10-28T21:30:06.799577215Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116581"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728"},{"type":"PACKAGE","url":"https://github.com/lxsmnsyc/seroval"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8"}],"versionKeys":["npm:seroval@1.6.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-983w-rhvv-gwmv","slug":"ghsa-983w-rhvv-gwmv-c6b60e52","dossier":false,"summary":"WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect","aliases":["CVE-2025-68616","PYSEC-2026-2034"],"sourceIds":["GHSA-983w-rhvv-gwmv","PYSEC-2026-2034"],"published":"2026-01-20T16:29:53Z","modified":"2026-07-07T17:57:32.367800639Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-983w-rhvv-gwmv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68616"},{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/commit/b6a14f0f3f4ce9c0c75c1a2d73cb1c5d43f0e565"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2025-68616"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2430858"},{"type":"PACKAGE","url":"https://github.com/Kozea/WeasyPrint"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-68616.json"},{"type":"PACKAGE","url":"https://pypi.org/project/weasyprint"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-983w-rhvv-gwmv"}],"versionKeys":["pypi:weasyprint@64.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-993g-76c3-p5m4","slug":"ghsa-993g-76c3-p5m4-f823cd66","dossier":false,"summary":"PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemes","aliases":["CVE-2026-48522","PYSEC-2026-175"],"sourceIds":["GHSA-993g-76c3-p5m4","PYSEC-2026-175"],"published":"2026-05-28T16:16:29.150Z","modified":"2026-09-10T03:50:49.179286182Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48522"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/8521"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-175.yaml"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-9fm3-97px-rjf6","slug":"ghsa-9fm3-97px-rjf6-8587a763","dossier":false,"summary":"undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering","aliases":["CVE-2026-109932"],"sourceIds":["GHSA-9fm3-97px-rjf6"],"published":"2026-10-27T19:02:15Z","modified":"2026-10-27T19:15:22.400702743Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109932"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/39f93e142df03e559fe7c3d1fc7fba9beee2c185"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/53944624462b6797560288c55dbd8c66857bb495"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b217373bb024cd93f85eb5b3ffd25684855f60f8"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-9fr6-4gfg-395g","slug":"ghsa-9fr6-4gfg-395g-dd20f37d","dossier":false,"summary":"Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method","aliases":["CVE-2026-101902"],"sourceIds":["GHSA-9fr6-4gfg-395g"],"published":"2026-09-30T15:12:49Z","modified":"2026-09-30T15:30:03.718390401Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-9fr6-4gfg-395g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101902"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.34.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9h52-p55h-vw2f","slug":"ghsa-9h52-p55h-vw2f-fc4c91e7","dossier":false,"summary":"Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default","aliases":["CVE-2025-66416","PYSEC-2026-1617"],"sourceIds":["GHSA-9h52-p55h-vw2f","PYSEC-2026-1617"],"published":"2025-12-02T16:52:08Z","modified":"2026-09-10T03:50:31.741008234Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66416"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9h52-p55h-vw2f"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mcp/PYSEC-2026-1617.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-9h9j-4vrj-gf7g","slug":"ghsa-9h9j-4vrj-gf7g-c50a1cd4","dossier":false,"summary":"virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection","aliases":["BIT-virtualenv-2026-102938","CVE-2026-102938","PYSEC-2026-4012"],"sourceIds":["GHSA-9h9j-4vrj-gf7g","PYSEC-2026-4012"],"published":"2026-09-17T16:42:47Z","modified":"2026-10-06T15:25:56.172772842Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102938"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3247"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4012.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.7.11"},{"type":"PACKAGE","url":"https://pypi.org/project/virtualenv"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-9hjg-9r4m-mvj7","slug":"ghsa-9hjg-9r4m-mvj7-32d7b63e","dossier":false,"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","aliases":["CVE-2024-47081","PYSEC-2026-1872"],"sourceIds":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"published":"2025-06-09T19:06:08Z","modified":"2026-10-19T20:00:04.716114530Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"FIX","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.32.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-9hw9-ch79-4vh6","slug":"ghsa-9hw9-ch79-4vh6-1ebda54f","dossier":false,"summary":"Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch","aliases":["BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453"],"sourceIds":["GHSA-9hw9-ch79-4vh6","PYSEC-2026-3453"],"published":"2026-07-14T16:17:02.370Z","modified":"2026-09-10T03:51:11.334365483Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59205"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-9j54-fg26-wv3r","slug":"ghsa-9j54-fg26-wv3r-7789d387","dossier":false,"summary":"PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","aliases":["CVE-2026-102266","PYSEC-2026-4143"],"sourceIds":["GHSA-9j54-fg26-wv3r","PYSEC-2026-4143"],"published":"2026-09-29T23:43:19Z","modified":"2026-10-01T17:56:01.035847258Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102266"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9j54-fg26-wv3r"}],"versionKeys":["pypi:pyjwt@2.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9jrq-w75r-8gcw","slug":"ghsa-9jrq-w75r-8gcw-21865588","dossier":false,"summary":"Vite: Cross origin script execution through Vite custom middleware","aliases":["CVE-2026-112945"],"sourceIds":["GHSA-9jrq-w75r-8gcw"],"published":"2026-10-21T16:48:14Z","modified":"2026-10-21T17:00:26.569382874Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-9jrq-w75r-8gcw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112945"},{"type":"WEB","url":"https://github.com/vitejs/vite/pull/23653"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-9rj7-rf2p-w77r","slug":"ghsa-9rj7-rf2p-w77r-996a0359","dossier":false,"summary":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","aliases":["CVE-2026-76218","PYSEC-2026-3840"],"sourceIds":["GHSA-9rj7-rf2p-w77r","PYSEC-2026-3840"],"published":"2026-08-07T15:36:43Z","modified":"2026-09-10T12:25:55.324487522Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-9rj7-rf2p-w77r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76218"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/d9ddb55bdc66"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-repo-init"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9rj7-rf2p-w77r"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-9v7f-9g4p-ffgj","slug":"ghsa-9v7f-9g4p-ffgj-61cfc8ce","dossier":false,"summary":"PyJWT: PyJWKClient follows redirects when fetching JWKS","aliases":["CVE-2026-102267","PYSEC-2026-4144"],"sourceIds":["GHSA-9v7f-9g4p-ffgj","PYSEC-2026-4144"],"published":"2026-09-29T23:15:00Z","modified":"2026-10-01T17:56:19.395032954Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102267"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9v7f-9g4p-ffgj"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-9v8h-qqgm-4m35","slug":"ghsa-9v8h-qqgm-4m35-781aec0d","dossier":false,"summary":"Brotli: Out-of-bounds write in the Brotli decoder (\"Node2Shell\") also affects the PyPI Brotli package","aliases":["BIT-brotli-2026-111497","BIT-dotnet-2026-111497","BIT-dotnet-sdk-2026-111497","BIT-node-2026-111497","BIT-node-min-2026-111497","BIT-powershell-2026-111497","CVE-2026-111497","GHSA-c9gr-gmg4-2vqv","GO-2026-6888","PYSEC-2026-4322","PYSEC-2026-4323"],"sourceIds":["GHSA-9v8h-qqgm-4m35","PYSEC-2026-4322","PYSEC-2026-4323"],"published":"2026-10-22T15:32:49Z","modified":"2026-11-05T23:25:49.434824566Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/494"},{"type":"WEB","url":"https://github.com/google/brotli/commit/da9806362874b9bd4b552a3af360b5d6347beb12"},{"type":"WEB","url":"https://github.com/google/brotli/commit/b418fa81c48262a86a95332b0bc6d62c30aa78b6"},{"type":"WEB","url":"https://github.com/google/brotli/commit/50a9b70a4d5e1443fc40927952276b68fffa83a0"},{"type":"FIX","url":"https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/brotlicffi/PYSEC-2026-4323.yaml"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/10/msg00049.html"},{"type":"WEB","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"},{"type":"WEB","url":"https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"},{"type":"WEB","url":"https://opensourcemalware.com/blog/node2shell-affects-python"},{"type":"WEB","url":"https://patchtheplanet.org/brotli"},{"type":"WEB","url":"https://pypi.org/project/Brotli"},{"type":"WEB","url":"https://pypi.org/project/brotlicffi"},{"type":"WEB","url":"https://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497"},{"type":"ADVISORY","url":"https://www.cve.org/CVERecord?id=CVE-2026-111497"},{"type":"WEB","url":"https://github.com/google/brotli/releases/tag/v1.2.1"},{"type":"PACKAGE","url":"https://pypi.org/project/Brotli/"},{"type":"PACKAGE","url":"https://pypi.org/project/brotlicffi/"}],"versionKeys":["pypi:brotli@1.1.0","pypi:brotlicffi@1.1.0.0"],"packageCount":2,"repositoryCount":1},{"id":"GHSA-9v9v-9qvf-h2hj","slug":"ghsa-9v9v-9qvf-h2hj-0344c250","dossier":false,"summary":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)","aliases":["BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343"],"sourceIds":["GHSA-9v9v-9qvf-h2hj","PYSEC-2026-4343"],"published":"2026-10-21T21:20:32.943Z","modified":"2026-10-29T10:55:35.129178084Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96644"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10120"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-9vhv-jxww-xfm5","slug":"ghsa-9vhv-jxww-xfm5-e19a009a","dossier":false,"summary":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","aliases":["CVE-2026-112913"],"sourceIds":["GHSA-9vhv-jxww-xfm5"],"published":"2026-10-23T22:28:19Z","modified":"2026-10-23T22:45:03.439584635Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-9wx4-h78v-vm56","slug":"ghsa-9wx4-h78v-vm56-6a334c57","dossier":false,"summary":"Requests `Session` object does not verify requests after making first request with verify=False","aliases":["CVE-2024-35195","PYSEC-2026-1873"],"sourceIds":["GHSA-9wx4-h78v-vm56","PYSEC-2026-1873"],"published":"2024-05-20T20:15:00Z","modified":"2026-09-10T03:50:13.740879755Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"FIX","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wx4-h78v-vm56"}],"versionKeys":["pypi:requests@2.31.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9wx9-5pv9-3349","slug":"ghsa-9wx9-5pv9-3349-f9ad6b42","dossier":false,"summary":"Seroval: Script injection through RegExp sources in serialized output","aliases":["CVE-2026-116582"],"sourceIds":["GHSA-9wx9-5pv9-3349"],"published":"2026-10-28T21:17:31Z","modified":"2026-10-28T21:30:04.992414732Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116582"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6"},{"type":"PACKAGE","url":"https://github.com/lxsmnsyc/seroval"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10"}],"versionKeys":["npm:seroval@1.6.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9x8q-7h8h-wcw9","slug":"ghsa-9x8q-7h8h-wcw9-af94166e","dossier":false,"summary":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect","aliases":["CVE-2026-54280","PYSEC-2026-2113"],"sourceIds":["GHSA-9x8q-7h8h-wcw9","PYSEC-2026-2113"],"published":"2026-06-15T20:10:44Z","modified":"2026-09-10T03:50:55.382836820Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-9xw5-w5jj-pvcg","slug":"ghsa-9xw5-w5jj-pvcg-5b93a500","dossier":false,"summary":"AIOHTTP: File descriptor exhaustion in multipart requests","aliases":["CVE-2026-111066"],"sourceIds":["GHSA-9xw5-w5jj-pvcg"],"published":"2026-10-20T19:52:09Z","modified":"2026-10-20T20:00:04.692319554Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-9xwg-3r6f-jcx2","slug":"ghsa-9xwg-3r6f-jcx2-8434e377","dossier":false,"summary":"PyMdown Extensions: Path traversal in the b64 extension lets <img src> read files outside base_path","aliases":["CVE-2026-61632","PYSEC-2026-3609"],"sourceIds":["GHSA-9xwg-3r6f-jcx2","PYSEC-2026-3609"],"published":"2026-07-24T16:18:33Z","modified":"2026-09-10T03:51:11.365684709Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-9xwg-3r6f-jcx2"},{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/commit/edce35586d11a1ef78bb187bc60497fe6dbf3b64"},{"type":"PACKAGE","url":"https://github.com/facelessuser/pymdown-extensions"},{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/releases/tag/11.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pymdown-extensions"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9xwg-3r6f-jcx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61632"}],"versionKeys":["pypi:pymdown-extensions@10.21.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-c2c7-rcm5-vvqj","slug":"ghsa-c2c7-rcm5-vvqj-6ccdec4e","dossier":false,"summary":"Picomatch has a ReDoS vulnerability via extglob quantifiers","aliases":["CVE-2026-33671"],"sourceIds":["GHSA-c2c7-rcm5-vvqj"],"published":"2026-03-25T21:12:07Z","modified":"2026-09-10T03:51:00.292614896Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33671"},{"type":"WEB","url":"https://github.com/micromatch/picomatch/commit/5eceecd27543b8e056b9307d69e105ea03618a7d"},{"type":"PACKAGE","url":"https://github.com/micromatch/picomatch"}],"versionKeys":["npm:picomatch@2.3.1","npm:picomatch@4.0.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-c427-h43c-vf67","slug":"ghsa-c427-h43c-vf67-fa5b38aa","dossier":false,"summary":"AIOHTTP accepts duplicate Host headers","aliases":["CVE-2026-34525","PYSEC-2026-2103"],"sourceIds":["GHSA-c427-h43c-vf67","PYSEC-2026-2103"],"published":"2026-04-01T21:17:00.490Z","modified":"2026-09-10T03:51:01.505705751Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-c6hw-5grf-ff96","slug":"ghsa-c6hw-5grf-ff96-1e7aec72","dossier":false,"summary":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","aliases":["BIT-pillow-2026-112404","CVE-2026-112404"],"sourceIds":["GHSA-c6hw-5grf-ff96"],"published":"2026-10-20T20:42:00Z","modified":"2026-10-26T08:55:55.669563065Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112404"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-c83g-rgw3-j3cx","slug":"ghsa-c83g-rgw3-j3cx-c08d66e8","dossier":false,"summary":"Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM","aliases":["CVE-2026-73089"],"sourceIds":["GHSA-c83g-rgw3-j3cx"],"published":"2026-09-01T16:42:13Z","modified":"2026-09-10T03:50:54.622936829Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/browserslist/browserslist/security/advisories/GHSA-c83g-rgw3-j3cx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73089"},{"type":"WEB","url":"https://github.com/browserslist/browserslist/commit/f2931a3ff2a3a31abf84ef01a7400b270aad6405"},{"type":"PACKAGE","url":"https://github.com/browserslist/browserslist"},{"type":"WEB","url":"https://github.com/browserslist/browserslist/releases/tag/4.28.7"}],"versionKeys":["npm:browserslist@4.24.4"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-c947-3pg5-gm8q","slug":"ghsa-c947-3pg5-gm8q-45da7664","dossier":false,"summary":"virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote","aliases":["BIT-virtualenv-2026-113732","CVE-2026-113732"],"sourceIds":["GHSA-c947-3pg5-gm8q"],"published":"2026-10-21T16:39:58Z","modified":"2026-10-29T10:55:30.348006947Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113732"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.2"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-c978-59m8-c77v","slug":"ghsa-c978-59m8-c77v-420aeea3","dossier":false,"summary":"virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax","aliases":["BIT-virtualenv-2026-113722","CVE-2026-113722"],"sourceIds":["GHSA-c978-59m8-c77v"],"published":"2026-10-21T21:30:12Z","modified":"2026-10-29T10:55:46.719521464Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113722"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3417"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-cfh3-3jmp-rvhc","slug":"ghsa-cfh3-3jmp-rvhc-4e95572c","dossier":false,"summary":"Pillow affected by out-of-bounds write when loading PSD images","aliases":["BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"sourceIds":["GHSA-cfh3-3jmp-rvhc","PYSEC-2026-2249"],"published":"2026-02-11T14:22:50Z","modified":"2026-09-10T03:50:59.393816085Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-25990"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4942"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-cp9v-662q-vvx9","slug":"ghsa-cp9v-662q-vvx9-b0a60d48","dossier":false,"summary":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","aliases":["BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333"],"sourceIds":["GHSA-cp9v-662q-vvx9","PYSEC-2026-4333"],"published":"2026-10-19T22:17:08.027Z","modified":"2026-10-28T11:10:36.014536437Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112405"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-cpwx-vrp4-4pq7","slug":"ghsa-cpwx-vrp4-4pq7-799bdc98","dossier":false,"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","aliases":["CVE-2025-27516","PYSEC-2026-1471"],"sourceIds":["GHSA-cpwx-vrp4-4pq7","PYSEC-2026-1471"],"published":"2025-03-05T20:40:14Z","modified":"2026-09-10T03:49:48.526758681Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cpwx-vrp4-4pq7"}],"versionKeys":["pypi:jinja2@3.1.3","pypi:jinja2@3.1.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-cq5v-8q36-5273","slug":"ghsa-cq5v-8q36-5273-b5e8d025","dossier":false,"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","aliases":["CVE-2026-69244","PYSEC-2026-3545"],"sourceIds":["GHSA-cq5v-8q36-5273","PYSEC-2026-3545"],"published":"2026-08-03T20:51:13Z","modified":"2026-09-10T03:51:13.983479281Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cq5v-8q36-5273"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-cw65-gx24-rc82","slug":"ghsa-cw65-gx24-rc82-d2d30a51","dossier":false,"summary":"virtualenv: Builtin creation follows linked environment directories","aliases":["BIT-virtualenv-2026-113716","CVE-2026-113716"],"sourceIds":["GHSA-cw65-gx24-rc82"],"published":"2026-10-21T21:35:56Z","modified":"2026-10-29T10:55:59.838026441Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113716"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3429"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-cwqr-hh33-gh44","slug":"ghsa-cwqr-hh33-gh44-4ee53d3a","dossier":false,"summary":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","aliases":["CVE-2026-112915"],"sourceIds":["GHSA-cwqr-hh33-gh44"],"published":"2026-10-28T21:08:49Z","modified":"2026-10-28T21:15:04.923553251Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112915"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-cx28-75q4-x26q","slug":"ghsa-cx28-75q4-x26q-bb017595","dossier":false,"summary":"virtualenv: Pip seeding with download omits wheel digest verification","aliases":["BIT-virtualenv-2026-113717","CVE-2026-113717"],"sourceIds":["GHSA-cx28-75q4-x26q"],"published":"2026-10-23T22:26:04Z","modified":"2026-10-29T10:55:56.839709622Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113717"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3430"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-f269-vfmq-vjvj","slug":"ghsa-f269-vfmq-vjvj-ae91eae7","dossier":false,"summary":"Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client","aliases":["CVE-2026-1528"],"sourceIds":["GHSA-f269-vfmq-vjvj"],"published":"2026-03-13T20:07:26Z","modified":"2026-09-10T03:50:38.848760381Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-f269-vfmq-vjvj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1528"},{"type":"WEB","url":"https://hackerone.com/reports/3537648"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f2g6-542v-9j58","slug":"ghsa-f2g6-542v-9j58-1b810101","dossier":false,"summary":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","aliases":["BIT-pillow-2026-112406","CVE-2026-112406"],"sourceIds":["GHSA-f2g6-542v-9j58"],"published":"2026-10-21T21:21:07Z","modified":"2026-10-26T08:56:13.538142549Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112406"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-f72v-6w45-q472","slug":"ghsa-f72v-6w45-q472-bdbac4d6","dossier":false,"summary":"undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens","aliases":["CVE-2026-109841"],"sourceIds":["GHSA-f72v-6w45-q472"],"published":"2026-10-23T22:12:57Z","modified":"2026-10-23T22:30:04.094314933Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109841"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/18bc8a1e09d15bc45815154a289dcf6fd5254d00"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/4f7ef6806e532ab9e29ccd6229b1b9d241e1b1f0"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-f86p-h4j2-7qgj","slug":"ghsa-f86p-h4j2-7qgj-9355f720","dossier":false,"summary":"Seroval: Code injection through a typed array's own constructor property","aliases":["CVE-2026-116583"],"sourceIds":["GHSA-f86p-h4j2-7qgj"],"published":"2026-10-28T21:17:36Z","modified":"2026-10-28T21:30:05.897308225Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116583"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1"},{"type":"PACKAGE","url":"https://github.com/lxsmnsyc/seroval"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11"}],"versionKeys":["npm:seroval@1.6.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f886-m6hf-6m8v","slug":"ghsa-f886-m6hf-6m8v-159d3b25","dossier":false,"summary":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","aliases":["CVE-2026-33750"],"sourceIds":["GHSA-f886-m6hf-6m8v"],"published":"2026-03-26T18:29:42Z","modified":"2026-09-10T03:51:00.342356761Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/issues/98"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/95"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/96"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/97"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@2.0.2"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-f96h-pmfr-66vw","slug":"ghsa-f96h-pmfr-66vw-6763f20e","dossier":false,"summary":"Starlette Denial of service (DoS) via multipart/form-data","aliases":["CVE-2024-47874","PYSEC-2026-1943"],"sourceIds":["GHSA-f96h-pmfr-66vw","PYSEC-2026-1943"],"published":"2024-10-15T18:12:57Z","modified":"2026-09-10T03:50:19.756287586Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47874"},{"type":"FIX","url":"https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733"},{"type":"PACKAGE","url":"https://github.com/encode/starlette"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f96h-pmfr-66vw"}],"versionKeys":["pypi:starlette@0.37.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f9j4-qggq-h239","slug":"ghsa-f9j4-qggq-h239-968ed9a4","dossier":false,"summary":"GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution","aliases":["CVE-2026-110858"],"sourceIds":["GHSA-f9j4-qggq-h239"],"published":"2026-10-27T15:26:50Z","modified":"2026-10-27T15:47:24.258288646Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-f9j4-qggq-h239"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2247"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/790bb3164948625ffb043d2a162425d55923fe9a"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-f9xw-jh8m-3mwq","slug":"ghsa-f9xw-jh8m-3mwq-43205cf6","dossier":false,"summary":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","aliases":["CVE-2026-111748"],"sourceIds":["GHSA-f9xw-jh8m-3mwq"],"published":"2026-10-20T20:01:40Z","modified":"2026-10-20T20:15:05.218624757Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-fc2g-4w5p-6whm","slug":"ghsa-fc2g-4w5p-6whm-f875e0d2","dossier":false,"summary":"virtualenv: Seeded files retain permissions from an older cache","aliases":["BIT-virtualenv-2026-113720","CVE-2026-113720"],"sourceIds":["GHSA-fc2g-4w5p-6whm"],"published":"2026-10-23T22:23:11Z","modified":"2026-10-29T10:55:56.743073990Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113720"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3425"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-fc9g-5qg7-mf45","slug":"ghsa-fc9g-5qg7-mf45-6ce92387","dossier":false,"summary":"Pillow: Quadratic GIF comment copying during save","aliases":["BIT-pillow-2026-112891","CVE-2026-112891"],"sourceIds":["GHSA-fc9g-5qg7-mf45"],"published":"2026-10-21T20:38:43Z","modified":"2026-10-26T08:56:06.483214483Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112891"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-ffc3-869f-jxw9","slug":"ghsa-ffc3-869f-jxw9-318ae071","dossier":false,"summary":"PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard","aliases":["CVE-2026-102268","PYSEC-2026-4145"],"sourceIds":["GHSA-ffc3-869f-jxw9","PYSEC-2026-4145"],"published":"2026-09-29T23:17:33Z","modified":"2026-10-01T17:55:42.096970476Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102268"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-ffc3-869f-jxw9"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-fh55-r93g-j68g","slug":"ghsa-fh55-r93g-j68g-a231bc8e","dossier":false,"summary":"AIOHTTP Vulnerable to Cookie Parser Warning Storm","aliases":["CVE-2025-69230","PYSEC-2026-1105"],"sourceIds":["GHSA-fh55-r93g-j68g","PYSEC-2026-1105"],"published":"2026-01-05T23:13:46Z","modified":"2026-09-10T03:50:33.047685052Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fh55-r93g-j68g"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-fhv5-28vv-h8m8","slug":"ghsa-fhv5-28vv-h8m8-c54a3f91","dossier":false,"summary":"PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)","aliases":["CVE-2026-48524","PYSEC-2026-177"],"sourceIds":["GHSA-fhv5-28vv-h8m8","PYSEC-2026-177"],"published":"2026-05-28T16:16:29.403Z","modified":"2026-09-10T03:50:49.375741307Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48524"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/8522"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-177.yaml"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-fj7v-r99m-22gq","slug":"ghsa-fj7v-r99m-22gq-e36cfebd","dossier":false,"summary":"Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images","aliases":["BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494"],"sourceIds":["GHSA-fj7v-r99m-22gq","PYSEC-2026-3494"],"published":"2026-07-20T23:09:36Z","modified":"2026-09-10T03:50:51.891240357Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59198"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9709"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fj7v-r99m-22gq"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-fjr4-x663-mwxc","slug":"ghsa-fjr4-x663-mwxc-324b7aa5","dossier":false,"summary":"GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)","aliases":["CVE-2026-73624","PYSEC-2026-3995"],"sourceIds":["GHSA-fjr4-x663-mwxc","PYSEC-2026-3995"],"published":"2026-07-24T16:41:20Z","modified":"2026-09-29T09:10:55.738617943Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fjr4-x663-mwxc"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-via-diff"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-fq56-3cx3-fjxp","slug":"ghsa-fq56-3cx3-fjxp-d2885806","dossier":false,"summary":"filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders","aliases":["CVE-2026-112935"],"sourceIds":["GHSA-fq56-3cx3-fjxp"],"published":"2026-10-28T21:08:08Z","modified":"2026-10-28T21:15:04.933315565Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112935"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/843"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-fvcv-3m26-pcqx","slug":"ghsa-fvcv-3m26-pcqx-aa71c009","dossier":false,"summary":"Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain","aliases":["CVE-2026-40175"],"sourceIds":["GHSA-fvcv-3m26-pcqx"],"published":"2026-04-10T19:47:16Z","modified":"2026-09-10T03:50:44.273401032Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-fvcv-3m26-pcqx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40175"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10660"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10660#issuecomment-4224168081"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10688"},{"type":"WEB","url":"https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c"},{"type":"WEB","url":"https://github.com/axios/axios/commit/363185461b90b1b78845dc8a99a1f103d9b122a1"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-876049.html"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.31.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.15.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-fx2h-pf6j-xcff","slug":"ghsa-fx2h-pf6j-xcff-156ab351","dossier":false,"summary":"vite: `server.fs.deny` bypass on Windows alternate paths","aliases":["CVE-2026-53571"],"sourceIds":["GHSA-fx2h-pf6j-xcff"],"published":"2026-06-15T17:17:45Z","modified":"2026-10-27T15:15:07.885624041Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-fx2h-pf6j-xcff"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53571"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-fx3j-rwgx-fr94","slug":"ghsa-fx3j-rwgx-fr94-14d75c26","dossier":false,"summary":"GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name","aliases":["CVE-2026-110855"],"sourceIds":["GHSA-fx3j-rwgx-fr94"],"published":"2026-10-27T15:26:32Z","modified":"2026-10-27T15:47:24.291028301Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-fx3j-rwgx-fr94"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2255"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/9349ff58ee00c9fb14d515c8e693f33b2144b238"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-fxqj-rqcc-2cmp","slug":"ghsa-fxqj-rqcc-2cmp-34c312ef","dossier":false,"summary":"PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset","aliases":["CVE-2026-69153"],"sourceIds":["GHSA-fxqj-rqcc-2cmp"],"published":"2026-08-03T17:11:39Z","modified":"2026-09-10T03:50:53.572374167Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/postcss/postcss/security/advisories/GHSA-fxqj-rqcc-2cmp"},{"type":"WEB","url":"https://github.com/postcss/postcss/commit/7beca139e70f9075c6b19700fcb00dd8033e5da8"},{"type":"PACKAGE","url":"https://github.com/postcss/postcss"},{"type":"WEB","url":"https://github.com/postcss/postcss/releases/tag/8.5.19"}],"versionKeys":["npm:postcss@8.4.49","npm:postcss@8.5.3","npm:postcss@8.5.6"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-g3cq-j2xw-wf74","slug":"ghsa-g3cq-j2xw-wf74-4475e17b","dossier":false,"summary":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup","aliases":["CVE-2026-54278","PYSEC-2026-2111"],"sourceIds":["GHSA-g3cq-j2xw-wf74","PYSEC-2026-2111"],"published":"2026-06-15T20:09:51Z","modified":"2026-09-10T03:51:08.751749295Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-g3hv-75wg-m249","slug":"ghsa-g3hv-75wg-m249-8b521a59","dossier":false,"summary":"minimatch has potential denial of service via globparts amplification","aliases":["CVE-2026-118764"],"sourceIds":["GHSA-g3hv-75wg-m249"],"published":"2026-10-30T23:09:55Z","modified":"2026-11-04T17:01:25.850114200Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118764"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/297b6c1a01f2410b3ba1ebed14ba222d0c3c1033"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/commit/fd0b3ab9cbc5bf1aff1c99f1f46e413c2b3340da"},{"type":"PACKAGE","url":"https://github.com/isaacs/minimatch"},{"type":"WEB","url":"https://github.com/isaacs/minimatch/releases/tag/v11.0.1"}],"versionKeys":["npm:minimatch@10.0.3","npm:minimatch@10.1.1","npm:minimatch@10.2.5","npm:minimatch@10.2.6","npm:minimatch@9.0.5"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-g4jq-h2w9-997c","slug":"ghsa-g4jq-h2w9-997c-b5be310c","dossier":false,"summary":"Vite middleware may serve files starting with the same name with the public directory","aliases":["CVE-2025-58751"],"sourceIds":["GHSA-g4jq-h2w9-997c"],"published":"2025-09-09T20:55:56Z","modified":"2026-09-10T03:50:28.405024248Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-g4jq-h2w9-997c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58751"},{"type":"WEB","url":"https://github.com/lukeed/sirv/commit/f0113f3f8266328d804ee808f763a3c11f8997eb"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/09f2b52e8d5907f26602653caf41b3a56692600d"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/4f1c35bcbb5830290c694aa14b6789e07450f069"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/63e2a5d232218f3f8d852056751e609a5367aaec"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/e11d24008b97d4ca731ecc1a3b95260a6d12e7e0"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"versionKeys":["npm:vite@6.3.5"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-g4qv-2jxx-769h","slug":"ghsa-g4qv-2jxx-769h-01f137f2","dossier":false,"summary":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","aliases":["BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342"],"sourceIds":["GHSA-g4qv-2jxx-769h","PYSEC-2026-4342"],"published":"2026-10-21T21:20:32.797Z","modified":"2026-10-29T10:55:44.091799759Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96643"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10073"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-g5vv-9gxw-82hx","slug":"ghsa-g5vv-9gxw-82hx-203070a6","dossier":false,"summary":"GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing","aliases":["CVE-2026-87819","PYSEC-2026-3984"],"sourceIds":["GHSA-g5vv-9gxw-82hx","PYSEC-2026-3984"],"published":"2026-09-09T12:17:17.120Z","modified":"2026-09-30T23:45:04.037560336Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-g5vv-9gxw-82hx"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2215"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/751473a5f3221d6f989291cbebcc404353fd3ba8"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.60"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3984.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-3.1.60-denial-of-service-via-redos"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-g6cj-pr64-35w5","slug":"ghsa-g6cj-pr64-35w5-fd75eedf","dossier":false,"summary":"cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing","aliases":["CVE-2026-69247","PYSEC-2026-3552"],"sourceIds":["GHSA-g6cj-pr64-35w5","PYSEC-2026-3552"],"published":"2026-08-03T21:17:00Z","modified":"2026-09-10T03:50:53.610446769Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-g6cj-pr64-35w5"},{"type":"WEB","url":"https://github.com/pyca/cryptography/pull/15369"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"PACKAGE","url":"https://pypi.org/project/cryptography"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g6cj-pr64-35w5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69247"}],"versionKeys":["pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3","pypi:cryptography@49.0.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-g7cr-3p24-7wf7","slug":"ghsa-g7cr-3p24-7wf7-568f0c0a","dossier":false,"summary":"Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","aliases":["BIT-pillow-2026-96778","CVE-2026-96778"],"sourceIds":["GHSA-g7cr-3p24-7wf7"],"published":"2026-10-22T16:05:39Z","modified":"2026-10-29T10:56:05.933422167Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96778"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10124"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-g7vv-2v7x-gj9p","slug":"ghsa-g7vv-2v7x-gj9p-5ef970c3","dossier":false,"summary":"tqdm CLI arguments injection attack","aliases":["CVE-2024-34062","PYSEC-2026-1976"],"sourceIds":["GHSA-g7vv-2v7x-gj9p","PYSEC-2026-1976"],"published":"2024-05-03T19:33:28Z","modified":"2026-09-10T03:50:13.776534451Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"type":"WEB","url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"type":"PACKAGE","url":"https://github.com/tqdm/tqdm"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"},{"type":"PACKAGE","url":"https://pypi.org/project/tqdm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g7vv-2v7x-gj9p"}],"versionKeys":["pypi:tqdm@4.66.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-g842-9rc4-69pw","slug":"ghsa-g842-9rc4-69pw-38a3cbdb","dossier":false,"summary":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","aliases":["BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338"],"sourceIds":["GHSA-g842-9rc4-69pw","PYSEC-2026-4338"],"published":"2026-10-21T21:20:31.927Z","modified":"2026-10-29T10:55:56.102454725Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96637"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10076"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-g84x-mcqj-x9qq","slug":"ghsa-g84x-mcqj-x9qq-fc677e5d","dossier":false,"summary":"AIOHTTP vulnerable to DoS through chunked messages","aliases":["CVE-2025-69229","PYSEC-2026-1106"],"sourceIds":["GHSA-g84x-mcqj-x9qq","PYSEC-2026-1106"],"published":"2026-01-05T23:13:29Z","modified":"2026-09-10T03:50:33.073865205Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g84x-mcqj-x9qq"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-g8m3-5g58-fq7m","slug":"ghsa-g8m3-5g58-fq7m-ea928b69","dossier":false,"summary":"undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching","aliases":["CVE-2026-11525"],"sourceIds":["GHSA-g8m3-5g58-fq7m"],"published":"2026-06-19T14:34:46Z","modified":"2026-09-10T03:51:08.663204806Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11525"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-g9mf-h72j-4rw9","slug":"ghsa-g9mf-h72j-4rw9-2ea01f94","dossier":false,"summary":"Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion","aliases":["CVE-2026-22036"],"sourceIds":["GHSA-g9mf-h72j-4rw9"],"published":"2026-01-14T21:06:08Z","modified":"2026-09-10T03:50:33.216915457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-g9mf-h72j-4rw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22036"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b04e3cbb569c1596f86c108e9b52c79d8475dcb3"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gc5v-m9x4-r6x2","slug":"ghsa-gc5v-m9x4-r6x2-b9828ad8","dossier":false,"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","aliases":["CVE-2026-25645","PYSEC-2026-2275"],"sourceIds":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"published":"2026-03-25T16:56:28Z","modified":"2026-09-10T03:50:39.207922076Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"FIX","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"ADVISORY","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3","pypi:requests@2.32.4","pypi:requests@2.32.5"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-gcqx-w48m-w2h4","slug":"ghsa-gcqx-w48m-w2h4-1fcaae43","dossier":false,"summary":"deepmerge mergeObject() allows prototype poisoning of returned objects","aliases":["CVE-2026-93753"],"sourceIds":["GHSA-gcqx-w48m-w2h4"],"published":"2026-09-18T18:31:44Z","modified":"2026-10-27T21:45:04.256048049Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93753"},{"type":"WEB","url":"https://github.com/TehShrike/deepmerge/issues/273"},{"type":"PACKAGE","url":"https://github.com/TehShrike/deepmerge"},{"type":"WEB","url":"https://github.com/TehShrike/deepmerge/blob/5b87756a5671635679001cbac72aa42f23472c81/index.js#L39-L60"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/deepmerge-through-4.3.1-prototype-poisoning-via-mergeobject"}],"versionKeys":["npm:deepmerge@4.3.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-gg2r-wvfm-q9rx","slug":"ghsa-gg2r-wvfm-q9rx-9e34ef8d","dossier":false,"summary":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","aliases":["BIT-pillow-2026-112892","CVE-2026-112892"],"sourceIds":["GHSA-gg2r-wvfm-q9rx"],"published":"2026-10-21T21:12:56Z","modified":"2026-10-26T08:55:54.537605973Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-gh4c-6fx4-qh6g","slug":"ghsa-gh4c-6fx4-qh6g-a56f6cb1","dossier":false,"summary":"urllib3: Chunked Deflate streaming can enter an infinite loop","aliases":["CVE-2026-97688","PYSEC-2026-4176"],"sourceIds":["GHSA-gh4c-6fx4-qh6g","PYSEC-2026-4176"],"published":"2026-09-30T15:00:38Z","modified":"2026-10-01T17:55:40.608255720Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g"}],"versionKeys":["pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-gjv8-xp57-g29c","slug":"ghsa-gjv8-xp57-g29c-0bfb5cb1","dossier":false,"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` / `VALUE` selector sub-patterns","aliases":["CVE-2026-86000","PYSEC-2026-4170"],"sourceIds":["GHSA-gjv8-xp57-g29c","PYSEC-2026-4170"],"published":"2026-09-17T20:32:58Z","modified":"2026-10-01T17:56:08.291385035Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-gjv8-xp57-g29c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86000"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/ce44e4996e6632871c18cdd7a7fb641be8ef34ef"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"},{"type":"PACKAGE","url":"https://pypi.org/project/soupsieve"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gjv8-xp57-g29c"}],"versionKeys":["pypi:soupsieve@2.6","pypi:soupsieve@2.7","pypi:soupsieve@2.8","pypi:soupsieve@2.8.4"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-gm37-52c6-37mw","slug":"ghsa-gm37-52c6-37mw-5e0593eb","dossier":false,"summary":"pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors","aliases":["CVE-2026-67422","PYSEC-2026-3654"],"sourceIds":["GHSA-gm37-52c6-37mw","PYSEC-2026-3654"],"published":"2026-08-07T18:26:07Z","modified":"2026-09-10T03:51:14.089911270Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-gm37-52c6-37mw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67422"},{"type":"WEB","url":"https://github.com/facelessuser/pymdown-extensions/commit/c68498598d7b13011bb4571350b6e3612a4ce44b"},{"type":"PACKAGE","url":"https://github.com/facelessuser/pymdown-extensions"},{"type":"PACKAGE","url":"https://pypi.org/project/pymdown-extensions"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gm37-52c6-37mw"}],"versionKeys":["pypi:pymdown-extensions@10.21.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gm62-xv2j-4w53","slug":"ghsa-gm62-xv2j-4w53-5befa184","dossier":false,"summary":"urllib3 allows an unbounded number of links in the decompression chain","aliases":["CVE-2025-66418","PYSEC-2026-1998"],"sourceIds":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"published":"2025-12-05T18:15:19Z","modified":"2026-09-10T03:50:58.741847479Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gm62-xv2j-4w53"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-gmj6-6f8f-6699","slug":"ghsa-gmj6-6f8f-6699-e3e02f35","dossier":false,"summary":"Jinja has a sandbox breakout through malicious filenames","aliases":["CVE-2024-56201","PYSEC-2026-1472"],"sourceIds":["GHSA-gmj6-6f8f-6699","PYSEC-2026-1472"],"published":"2024-12-23T17:54:12Z","modified":"2026-09-10T03:50:56.152882717Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gmj6-6f8f-6699"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gq48-pqfc-9p58","slug":"ghsa-gq48-pqfc-9p58-0aa8d93f","dossier":false,"summary":"GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree","aliases":["CVE-2026-110860"],"sourceIds":["GHSA-gq48-pqfc-9p58"],"published":"2026-10-27T15:26:57Z","modified":"2026-10-27T15:47:24.379897252Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-gq48-pqfc-9p58"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2232"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/24b6f95d4b90ab1483fb601c736ac6e7c059cd61"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-gvp8-978c-rx2q","slug":"ghsa-gvp8-978c-rx2q-c33a029f","dossier":false,"summary":"PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse","aliases":["CVE-2026-103001","PYSEC-2026-4146"],"sourceIds":["GHSA-gvp8-978c-rx2q","PYSEC-2026-4146"],"published":"2026-09-30T23:53:17Z","modified":"2026-10-01T17:55:53.001409325Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gvp8-978c-rx2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103001"}],"versionKeys":["pypi:pyjwt@2.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gx76-c99x-2c96","slug":"ghsa-gx76-c99x-2c96-30159937","dossier":false,"summary":"AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","aliases":["CVE-2026-111749"],"sourceIds":["GHSA-gx76-c99x-2c96"],"published":"2026-10-20T19:58:14Z","modified":"2026-10-20T20:15:05.188135798Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111749"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-h4gh-qq45-vh27","slug":"ghsa-h4gh-qq45-vh27-43490265","dossier":false,"summary":"pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels","aliases":[],"sourceIds":["GHSA-h4gh-qq45-vh27"],"published":"2024-09-03T21:59:48Z","modified":"2026-09-10T03:50:18.241644273Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-h4gh-qq45-vh27"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://openssl-library.org/news/secadv/20240903.txt"}],"versionKeys":["pypi:cryptography@42.0.8"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-h67p-54hq-rp68","slug":"ghsa-h67p-54hq-rp68-7c13d245","dossier":false,"summary":"JS-YAML: Quadratic-complexity DoS in merge key handling via repeated aliases","aliases":["CVE-2026-53550"],"sourceIds":["GHSA-h67p-54hq-rp68"],"published":"2026-06-15T17:15:07Z","modified":"2026-09-10T03:50:49.729923880Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53550"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"}],"versionKeys":["npm:js-yaml@3.14.1","npm:js-yaml@3.14.2","npm:js-yaml@4.1.0","npm:js-yaml@4.1.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-h75v-3vvj-5mfj","slug":"ghsa-h75v-3vvj-5mfj-d8fc6bb7","dossier":false,"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","aliases":["CVE-2024-34064","PYSEC-2026-1474"],"sourceIds":["GHSA-h75v-3vvj-5mfj","PYSEC-2026-1474"],"published":"2024-05-06T14:20:59Z","modified":"2026-09-10T03:50:13.786450101Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h75v-3vvj-5mfj"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hcc4-c3v8-rx92","slug":"ghsa-hcc4-c3v8-rx92-ddf32b5c","dossier":false,"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector","aliases":["CVE-2026-34513","PYSEC-2026-2095"],"sourceIds":["GHSA-hcc4-c3v8-rx92","PYSEC-2026-2095"],"published":"2026-04-01T21:16:59.267Z","modified":"2026-09-10T03:51:02.067006429Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-hfxv-24rg-xrqf","slug":"ghsa-hfxv-24rg-xrqf-abdaa203","dossier":false,"summary":"Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection","aliases":["CVE-2026-44496"],"sourceIds":["GHSA-hfxv-24rg-xrqf"],"published":"2026-06-04T14:24:06Z","modified":"2026-09-10T03:50:49.732285826Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.32.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.16.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hg6j-4rv6-33pg","slug":"ghsa-hg6j-4rv6-33pg-d0ac8db0","dossier":false,"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","aliases":["CVE-2026-47265","PYSEC-2026-2105"],"sourceIds":["GHSA-hg6j-4rv6-33pg","PYSEC-2026-2105"],"published":"2026-06-02T20:16:37.903Z","modified":"2026-09-10T03:50:49.888335735Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-hh9p-6wh2-4mfc","slug":"ghsa-hh9p-6wh2-4mfc-8e33cff1","dossier":false,"summary":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","aliases":["CVE-2026-76217","PYSEC-2026-3841"],"sourceIds":["GHSA-hh9p-6wh2-4mfc","PYSEC-2026-3841"],"published":"2026-08-07T15:43:56Z","modified":"2026-09-10T12:26:07.095223621Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hh9p-6wh2-4mfc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76217"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/f2550b65bf60ca087190981e2c7b6865e201f40c"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-read-via-pathspec-from-file"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hh9p-6wh2-4mfc"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-hhxq-47xx-j5xx","slug":"ghsa-hhxq-47xx-j5xx-b7469e94","dossier":false,"summary":"virtualenv: Seed replacement does not contain metadata deletion paths","aliases":["BIT-virtualenv-2026-113719","CVE-2026-113719"],"sourceIds":["GHSA-hhxq-47xx-j5xx"],"published":"2026-10-23T22:19:15Z","modified":"2026-10-29T10:56:02.747342068Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113719"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3428"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-hmq2-w58f-27jc","slug":"ghsa-hmq2-w58f-27jc-f0b0fe70","dossier":false,"summary":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","aliases":["CVE-2026-76222","PYSEC-2026-3784"],"sourceIds":["GHSA-hmq2-w58f-27jc","PYSEC-2026-3784"],"published":"2026-08-07T15:45:39Z","modified":"2026-09-08T21:00:05.149418166Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-hmq2-w58f-27jc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76222"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2202"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/4299c990e1ca21896f9485277caf7bb0ae5b404c"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e4b8e7d026ca6abb4cf604f8e77093432ce23c06"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3784.yaml"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-path-traversal-via-gitmodules-submodule-name"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-hmw2-7cc7-3qxx","slug":"ghsa-hmw2-7cc7-3qxx-52e715a7","dossier":false,"summary":"form-data: CRLF injection in form-data via unescaped multipart field names and filenames","aliases":["CVE-2026-12143"],"sourceIds":["GHSA-hmw2-7cc7-3qxx"],"published":"2026-06-15T17:26:26Z","modified":"2026-09-10T03:50:49.785679067Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12143"},{"type":"WEB","url":"https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"},{"type":"WEB","url":"https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"},{"type":"WEB","url":"https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"},{"type":"PACKAGE","url":"https://github.com/form-data/form-data"},{"type":"WEB","url":"https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"},{"type":"WEB","url":"https://www.npmjs.com/package/form-data"}],"versionKeys":["npm:form-data@4.0.4","npm:form-data@4.0.5"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hpj7-wq8m-9hgp","slug":"ghsa-hpj7-wq8m-9hgp-fac25647","dossier":false,"summary":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges","aliases":["CVE-2026-54276","PYSEC-2026-2109"],"sourceIds":["GHSA-hpj7-wq8m-9hgp","PYSEC-2026-2109"],"published":"2026-06-15T20:09:06Z","modified":"2026-09-10T03:50:49.899674354Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-hxm8-2xgr-2p9m","slug":"ghsa-hxm8-2xgr-2p9m-bfcf1f86","dossier":false,"summary":"PyJWT: Non-canonical signature segments enable raw-token revocation bypass","aliases":["CVE-2026-102269","PYSEC-2026-4147"],"sourceIds":["GHSA-hxm8-2xgr-2p9m","PYSEC-2026-4147"],"published":"2026-09-29T23:17:55Z","modified":"2026-10-01T17:55:59.204638768Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102269"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxm8-2xgr-2p9m"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-j4m9-6w36-pw47","slug":"ghsa-j4m9-6w36-pw47-8a42e0dd","dossier":false,"summary":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","aliases":["BIT-pillow-2026-112893","CVE-2026-112893"],"sourceIds":["GHSA-j4m9-6w36-pw47"],"published":"2026-10-21T20:06:34Z","modified":"2026-10-26T08:55:43.891551666Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112893"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-j5f8-grm9-p9fc","slug":"ghsa-j5f8-grm9-p9fc-10eaf767","dossier":false,"summary":"Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection","aliases":["CVE-2026-44486"],"sourceIds":["GHSA-j5f8-grm9-p9fc"],"published":"2026-06-04T14:15:01Z","modified":"2026-09-10T03:50:50.017253448Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44486"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10794"},{"type":"WEB","url":"https://github.com/axios/axios/commit/afca61a070728e717203c2bc21e7b589b59b858b"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.32.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.16.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-j8f7-rjxc-mr56","slug":"ghsa-j8f7-rjxc-mr56-f1c144ea","dossier":false,"summary":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","aliases":["CVE-2026-112936"],"sourceIds":["GHSA-j8f7-rjxc-mr56"],"published":"2026-10-28T21:08:30Z","modified":"2026-10-28T21:15:04.169983430Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112936"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.0.9"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-j8rh-479h-cp32","slug":"ghsa-j8rh-479h-cp32-7ee21635","dossier":false,"summary":"Axios: Header Injection via Inherited headers After Minimal Interceptor","aliases":["CVE-2026-101904"],"sourceIds":["GHSA-j8rh-479h-cp32"],"published":"2026-09-30T15:35:14Z","modified":"2026-09-30T15:46:18.108444439Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-j8rh-479h-cp32"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101904"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-j934-xhv5-fg8f","slug":"ghsa-j934-xhv5-fg8f-f3395fba","dossier":false,"summary":"Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)","aliases":["CVE-2026-85999","PYSEC-2026-4171"],"sourceIds":["GHSA-j934-xhv5-fg8f","PYSEC-2026-4171"],"published":"2026-09-17T20:32:53Z","modified":"2026-10-01T17:56:03.541286563Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/security/advisories/GHSA-j934-xhv5-fg8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85999"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/commit/cf198fcddc9230f06ed39f974eba0ce076b85cda"},{"type":"PACKAGE","url":"https://github.com/facelessuser/soupsieve"},{"type":"WEB","url":"https://github.com/facelessuser/soupsieve/releases/tag/2.9"},{"type":"PACKAGE","url":"https://pypi.org/project/soupsieve"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-j934-xhv5-fg8f"}],"versionKeys":["pypi:soupsieve@2.6","pypi:soupsieve@2.7","pypi:soupsieve@2.8","pypi:soupsieve@2.8.4"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-jf6q-chmf-3h3v","slug":"ghsa-jf6q-chmf-3h3v-4ec82825","dossier":false,"summary":"weasyprint Has Server-Side Request Forgery (SSRF)","aliases":["CVE-2026-55073","PYSEC-2026-3940"],"sourceIds":["GHSA-jf6q-chmf-3h3v","PYSEC-2026-3940"],"published":"2026-09-09T18:06:38Z","modified":"2026-09-10T12:26:05.802944622Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v"},{"type":"PACKAGE","url":"https://github.com/Kozea/WeasyPrint"},{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/releases/tag/v70.0"},{"type":"PACKAGE","url":"https://pypi.org/project/weasyprint"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jf6q-chmf-3h3v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55073"}],"versionKeys":["pypi:weasyprint@64.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jg22-mg44-37j8","slug":"ghsa-jg22-mg44-37j8-b8064c77","dossier":false,"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","aliases":["CVE-2026-34993","PYSEC-2026-2104"],"sourceIds":["GHSA-jg22-mg44-37j8","PYSEC-2026-2104"],"published":"2026-06-02T20:16:34.857Z","modified":"2026-09-10T03:51:08.847676311Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-34993"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-jg86-v3jv-hrpm","slug":"ghsa-jg86-v3jv-hrpm-1380c45f","dossier":false,"summary":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","aliases":["BIT-pillow-2026-112894","CVE-2026-112894"],"sourceIds":["GHSA-jg86-v3jv-hrpm"],"published":"2026-10-21T21:11:44Z","modified":"2026-10-26T08:56:08.669907131Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112894"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-jhhc-3hcp-qhm5","slug":"ghsa-jhhc-3hcp-qhm5-310e06ea","dossier":false,"summary":"WeasyPrint has CSS Injection via Presentational Hints","aliases":["CVE-2026-49452","PYSEC-2026-3412"],"sourceIds":["GHSA-jhhc-3hcp-qhm5","PYSEC-2026-3412"],"published":"2026-07-06T17:29:53Z","modified":"2026-07-13T16:42:26.449768536Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jhhc-3hcp-qhm5"},{"type":"PACKAGE","url":"https://github.com/Kozea/WeasyPrint"},{"type":"PACKAGE","url":"https://pypi.org/project/weasyprint"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jhhc-3hcp-qhm5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49452"}],"versionKeys":["pypi:weasyprint@64.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jj3x-wxrx-4x23","slug":"ghsa-jj3x-wxrx-4x23-407bafac","dossier":false,"summary":"AIOHTTP vulnerable to DoS when bypassing asserts","aliases":["CVE-2025-69227","PYSEC-2026-1107"],"sourceIds":["GHSA-jj3x-wxrx-4x23","PYSEC-2026-1107"],"published":"2026-01-05T23:10:15Z","modified":"2026-09-10T03:50:33.308966616Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69227"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jj3x-wxrx-4x23"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-jjj6-mw9f-p565","slug":"ghsa-jjj6-mw9f-p565-ed2d1f46","dossier":false,"summary":"Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()","aliases":["BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495"],"sourceIds":["GHSA-jjj6-mw9f-p565","PYSEC-2026-3495"],"published":"2026-07-20T23:11:29Z","modified":"2026-09-10T03:50:12.341825852Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59200"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9718"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjj6-mw9f-p565"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-jm66-cg57-jjv5","slug":"ghsa-jm66-cg57-jjv5-ddb86d58","dossier":false,"summary":"Azure Core is vulnerable to deserialization of untrusted data","aliases":["CVE-2026-21226","PYSEC-2026-1208"],"sourceIds":["GHSA-jm66-cg57-jjv5","PYSEC-2026-1208"],"published":"2026-01-13T21:31:44Z","modified":"2026-09-10T03:50:33.330380695Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21226"},{"type":"PACKAGE","url":"https://github.com/Azure/azure-sdk-for-python"},{"type":"WEB","url":"https://github.com/Azure/azure-sdk-for-python/blob/6d2e6431ea0991861640e449e51e894247a7771a/sdk/core/azure-core/CHANGELOG.md#1380-2026-01-12"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226"},{"type":"PACKAGE","url":"https://pypi.org/project/azure-core"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jm66-cg57-jjv5"}],"versionKeys":["pypi:azure-core@1.33.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jm78-9fvv-mhgr","slug":"ghsa-jm78-9fvv-mhgr-2c167ddc","dossier":false,"summary":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)","aliases":["CVE-2026-76221","PYSEC-2026-3783"],"sourceIds":["GHSA-jm78-9fvv-mhgr","PYSEC-2026-3783"],"published":"2026-08-07T15:46:35Z","modified":"2026-09-10T03:51:14.296736368Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-jm78-9fvv-mhgr"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/a495ccd3b547ccd60b2187215823b72a9c0188bf"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-config-injection-via-option-name"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-jp82-jpqv-5vv3","slug":"ghsa-jp82-jpqv-5vv3-4d50530e","dossier":false,"summary":"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname","aliases":["CVE-2026-54282","PYSEC-2026-248"],"sourceIds":["GHSA-jp82-jpqv-5vv3","PYSEC-2026-248"],"published":"2026-06-15T20:38:08Z","modified":"2026-09-10T03:50:50.050800090Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54282"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-jpw9-pfvf-9f58","slug":"ghsa-jpw9-pfvf-9f58-39682a8f","dossier":false,"summary":"MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal","aliases":["CVE-2026-52869","PYSEC-2026-3482"],"sourceIds":["GHSA-jpw9-pfvf-9f58","PYSEC-2026-3482"],"published":"2026-07-16T19:58:53Z","modified":"2026-09-10T03:50:52.526763662Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-jpw9-pfvf-9f58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52869"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/2690"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/2719"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/1abcca2408a6b50e10ec601181f63f9978705c00"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/ce267b6fc515dc4efc1dc70b6975b16ff0feef0a"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.27.2"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jpw9-pfvf-9f58"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-jq35-7prp-9v3f","slug":"ghsa-jq35-7prp-9v3f-75660907","dossier":false,"summary":"PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys","aliases":["CVE-2026-48523","PYSEC-2026-176"],"sourceIds":["GHSA-jq35-7prp-9v3f","PYSEC-2026-176"],"published":"2026-05-28T16:16:29.280Z","modified":"2026-09-10T03:51:08.776007275Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48523"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-176.yaml"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-jqcg-44mw-7w3h","slug":"ghsa-jqcg-44mw-7w3h-470fbe53","dossier":false,"summary":"proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet","aliases":["CVE-2026-90711"],"sourceIds":["GHSA-jqcg-44mw-7w3h"],"published":"2026-10-05T23:30:26Z","modified":"2026-10-05T23:45:07.322157228Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90711"},{"type":"WEB","url":"https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/jshttp/proxy-addr"},{"type":"WEB","url":"https://github.com/jshttp/proxy-addr/releases/tag/v2.0.8"}],"versionKeys":["npm:proxy-addr@2.0.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jqfw-vq24-v9c3","slug":"ghsa-jqfw-vq24-v9c3-2de51aa4","dossier":false,"summary":"Vite's `server.fs` settings were not applied to HTML files","aliases":["CVE-2025-58752"],"sourceIds":["GHSA-jqfw-vq24-v9c3"],"published":"2025-09-09T20:54:42Z","modified":"2026-09-10T03:50:28.597734404Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-jqfw-vq24-v9c3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58752"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/0ab19ea9fcb66f544328f442cf6e70f7c0528d5f"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/14015d794f69accba68798bd0e15135bc51c9c1e"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/482000f57f56fe6ff2e905305100cfe03043ddea"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/6f01ff4fe072bcfcd4e2a84811772b818cd51fe6"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"},{"type":"WEB","url":"https://github.com/vitejs/vite/blob/v7.1.5/packages/vite/CHANGELOG.md"}],"versionKeys":["npm:vite@6.3.5"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jqh4-m9w3-8hp9","slug":"ghsa-jqh4-m9w3-8hp9-bdf7a3b1","dossier":false,"summary":"Axios: Fetch adapter `ReadableStream` uploads bypass `maxBodyLength`","aliases":["CVE-2026-67317"],"sourceIds":["GHSA-jqh4-m9w3-8hp9"],"published":"2026-07-20T22:27:12Z","modified":"2026-09-10T03:50:52.448472902Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67317"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68947"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jr45-8vmc-qm54","slug":"ghsa-jr45-8vmc-qm54-bee699ea","dossier":false,"summary":"undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives","aliases":["CVE-2026-14643"],"sourceIds":["GHSA-jr45-8vmc-qm54"],"published":"2026-08-03T19:32:12Z","modified":"2026-09-10T03:51:14.245060345Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-jr45-8vmc-qm54"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14643"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/85a240551c9feb8b8a0ecc56c84b2b3015add8a9"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cb105d7c79069150982fa11acada0dd94a60dbbc"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jwrc-g2q2-pq5p","slug":"ghsa-jwrc-g2q2-pq5p-dfb984e1","dossier":false,"summary":"PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.","aliases":["CVE-2026-102270","PYSEC-2026-4148"],"sourceIds":["GHSA-jwrc-g2q2-pq5p","PYSEC-2026-4148"],"published":"2026-09-30T14:40:25Z","modified":"2026-10-01T17:55:44.209063147Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102270"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jwrc-g2q2-pq5p"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-jwv3-5hgf-82ww","slug":"ghsa-jwv3-5hgf-82ww-d34fc541","dossier":false,"summary":"python-cryptography: Duplicate self-signed intermediates can cause exponential path-building","aliases":["CVE-2026-69249","PYSEC-2026-3553"],"sourceIds":["GHSA-jwv3-5hgf-82ww","PYSEC-2026-3553"],"published":"2026-08-03T21:26:50Z","modified":"2026-09-24T14:45:10.238420831Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-jwv3-5hgf-82ww"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69249"},{"type":"WEB","url":"https://github.com/pyca/cryptography/pull/14960"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/3763aa79b"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/4a12cf49675a184e47f912b00b04f3a629283582"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3553.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/cryptography"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jwv3-5hgf-82ww"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-m2h6-j472-rp4c","slug":"ghsa-m2h6-j472-rp4c-112d8b91","dossier":false,"summary":"python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees","aliases":["CVE-2026-69248","PYSEC-2026-3554"],"sourceIds":["GHSA-m2h6-j472-rp4c","PYSEC-2026-3554"],"published":"2026-08-03T21:26:57Z","modified":"2026-09-24T15:00:04.719975807Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m2h6-j472-rp4c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69248"},{"type":"WEB","url":"https://github.com/pyca/cryptography/pull/14888"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/286c89128"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/4d035a4225965edeffd312079a510ef25fcfdcb2"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-3554.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/cryptography"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-m2h6-j472-rp4c"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-m5qp-6w8w-w647","slug":"ghsa-m5qp-6w8w-w647-495897bd","dossier":false,"summary":"AIOHTTP has a Multipart Header Size Bypass","aliases":["CVE-2026-34516","PYSEC-2026-2098"],"sourceIds":["GHSA-m5qp-6w8w-w647","PYSEC-2026-2098"],"published":"2026-04-01T21:16:59.723Z","modified":"2026-09-10T03:51:02.372876858Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-m64x-33q8-m5h7","slug":"ghsa-m64x-33q8-m5h7-491ad59c","dossier":false,"summary":"GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines","aliases":["CVE-2026-110856"],"sourceIds":["GHSA-m64x-33q8-m5h7"],"published":"2026-10-27T15:26:24Z","modified":"2026-10-27T15:47:24.576766638Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-m64x-33q8-m5h7"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2253"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8290c98d35465a38090cdcc1b17be69967092a15"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-m6qw-4cw2-hm4m","slug":"ghsa-m6qw-4cw2-hm4m-3f6d3ee7","dossier":false,"summary":"aiohttp: CRLF injection in multipart headers","aliases":["CVE-2026-50269","PYSEC-2026-2106"],"sourceIds":["GHSA-m6qw-4cw2-hm4m","PYSEC-2026-2106"],"published":"2026-06-15T20:07:26Z","modified":"2026-09-10T03:51:09.078868018Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-m7pr-hjqh-92cm","slug":"ghsa-m7pr-hjqh-92cm-bddd7aa6","dossier":false,"summary":"Axios: no_proxy bypass via IP alias allows SSRF","aliases":["CVE-2026-42038"],"sourceIds":["GHSA-m7pr-hjqh-92cm"],"published":"2026-05-05T00:40:17Z","modified":"2026-09-10T03:51:06.293033204Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42038"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-m8rv-5g2x-5cg5","slug":"ghsa-m8rv-5g2x-5cg5-5c5846d7","dossier":false,"summary":"undici vulnerable to CRLF Injection via blob-like body 'type' property","aliases":["CVE-2026-15157"],"sourceIds":["GHSA-m8rv-5g2x-5cg5"],"published":"2026-08-03T19:33:53Z","modified":"2026-09-10T03:51:14.281925419Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-m8rv-5g2x-5cg5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15157"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/33928bc24f742ea8422ed90d17f2e0cc83e4d09d"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/740a0b7c173cb4a83a5b693e96e8f3a116cfc400"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/7d3cf924c262c486bc77f951348f4e5c847b7b42"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-m959-cc7f-wv43","slug":"ghsa-m959-cc7f-wv43-3b497c67","dossier":false,"summary":"cryptography has incomplete DNS name constraint enforcement on peer names","aliases":["CVE-2026-34073","PYSEC-2026-35"],"sourceIds":["GHSA-m959-cc7f-wv43","PYSEC-2026-35"],"published":"2026-03-27T19:56:21Z","modified":"2026-09-10T03:51:00.592317622Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"ADVISORY","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-m959-cc7f-wv43"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34073"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-35.yaml"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-mf9v-mfxr-j63j","slug":"ghsa-mf9v-mfxr-j63j-1a7db6d4","dossier":false,"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","aliases":["CVE-2026-44432","PYSEC-2026-142"],"sourceIds":["GHSA-mf9v-mfxr-j63j","PYSEC-2026-142"],"published":"2026-05-11T14:51:45Z","modified":"2026-09-10T03:51:06.409994465Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-mf9w-mj56-hr94","slug":"ghsa-mf9w-mj56-hr94-a492e0f4","dossier":false,"summary":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","aliases":["CVE-2026-28684","PYSEC-2026-2270"],"sourceIds":["GHSA-mf9w-mj56-hr94","PYSEC-2026-2270"],"published":"2026-04-20T17:16:33.087Z","modified":"2026-09-10T03:51:02.363430883Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch"},{"type":"PACKAGE","url":"https://github.com/theskumar/python-dotenv"},{"type":"ADVISORY","url":"https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"}],"versionKeys":["pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-mfx4-hv73-q22v","slug":"ghsa-mfx4-hv73-q22v-b33d9650","dossier":false,"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","aliases":["CVE-2026-69243","PYSEC-2026-3546"],"sourceIds":["GHSA-mfx4-hv73-q22v","PYSEC-2026-3546"],"published":"2026-08-03T20:46:10Z","modified":"2026-09-10T03:51:14.385788837Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13017"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mfx4-hv73-q22v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-mh29-5h37-fv8m","slug":"ghsa-mh29-5h37-fv8m-16304e4f","dossier":false,"summary":"js-yaml has prototype pollution in merge (<<)","aliases":["CVE-2025-64718"],"sourceIds":["GHSA-mh29-5h37-fv8m"],"published":"2025-11-14T14:29:48Z","modified":"2026-09-10T03:50:58.469126910Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879"},{"type":"WEB","url":"https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mh29-5h37-fv8m"},{"type":"PACKAGE","url":"https://github.com/nodeca/js-yaml"}],"versionKeys":["npm:js-yaml@3.14.1","npm:js-yaml@4.1.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-mh99-v99m-4gvg","slug":"ghsa-mh99-v99m-4gvg-c377fa63","dossier":false,"summary":"brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash","aliases":["CVE-2026-14257"],"sourceIds":["GHSA-mh99-v99m-4gvg"],"published":"2026-07-24T21:53:14Z","modified":"2026-09-10T03:50:12.282849322Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-mh99-v99m-4gvg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14257"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/129"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/130"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/pull/136"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/a1bd33999ea75262c4749fff3bbb0d1372bd07b5"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/d13ff455a58b0d56704f0111e3c2a0b16ceb06eb"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"},{"type":"WEB","url":"https://www.npmjs.com/package/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@1.1.16","npm:brace-expansion@2.0.2"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-mj87-hwqh-73pj","slug":"ghsa-mj87-hwqh-73pj-92a4d569","dossier":false,"summary":"python-multipart affected by Denial of Service via large multipart preamble or epilogue data","aliases":["CVE-2026-40347","PYSEC-2026-3038"],"sourceIds":["GHSA-mj87-hwqh-73pj","PYSEC-2026-3038"],"published":"2026-04-15T19:45:44Z","modified":"2026-09-10T03:51:02.322677211Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40347"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.26"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mj87-hwqh-73pj"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-mmx7-hfxf-jppx","slug":"ghsa-mmx7-hfxf-jppx-5a5fa72c","dossier":false,"summary":"Axios: Prototype pollution gadgets can alter axios request construction","aliases":["CVE-2026-67316"],"sourceIds":["GHSA-mmx7-hfxf-jppx"],"published":"2026-07-20T22:25:07Z","modified":"2026-09-10T03:50:52.753640421Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-mmx7-hfxf-jppx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67316"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68944"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11001"},{"type":"WEB","url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.33.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/axios-before-prototype-pollution-via-bodyless-methods"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mq44-7p77-q5h7","slug":"ghsa-mq44-7p77-q5h7-6bd0337a","dossier":false,"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","aliases":["CVE-2026-59881","PYSEC-2026-3547"],"sourceIds":["GHSA-mq44-7p77-q5h7","PYSEC-2026-3547"],"published":"2026-08-03T20:40:55Z","modified":"2026-09-10T03:51:14.489650589Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mq44-7p77-q5h7"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-mqqc-3gqh-h2x8","slug":"ghsa-mqqc-3gqh-h2x8-6d702daf","dossier":false,"summary":"AIOHTTP has unicode match groups in regexes for ASCII protocol elements","aliases":["CVE-2025-69225","PYSEC-2026-1109"],"sourceIds":["GHSA-mqqc-3gqh-h2x8","PYSEC-2026-1109"],"published":"2026-01-05T23:09:30Z","modified":"2026-09-10T03:50:33.538693726Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mqqc-3gqh-h2x8"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-mrfp-p49p-3hf2","slug":"ghsa-mrfp-p49p-3hf2-6cfe1cba","dossier":false,"summary":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","aliases":["BIT-pillow-2026-96640","CVE-2026-96640"],"sourceIds":["GHSA-mrfp-p49p-3hf2"],"published":"2026-10-22T16:00:47Z","modified":"2026-10-29T10:55:39.916451864Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96640"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10093"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-mrhx-c7xc-m3w5","slug":"ghsa-mrhx-c7xc-m3w5-08924c2f","dossier":false,"summary":"Zod can exhaust memory while validating oversized constrained collections","aliases":["CVE-2023-54404"],"sourceIds":["GHSA-mrhx-c7xc-m3w5"],"published":"2026-10-01T18:32:46Z","modified":"2026-10-23T18:30:09.376405885Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-54404"},{"type":"WEB","url":"https://github.com/colinhacks/zod/issues/1872"},{"type":"WEB","url":"https://github.com/colinhacks/zod/pull/6475"},{"type":"WEB","url":"https://github.com/colinhacks/zod/pull/6652"},{"type":"WEB","url":"https://github.com/colinhacks/zod/commit/a0ebf970f2d752e5f58527cd2942ff48be4f46bd"},{"type":"PACKAGE","url":"https://github.com/colinhacks/zod"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/zod-uncontrolled-resource-consumption-via-array-validation"}],"versionKeys":["npm:zod@3.25.76","npm:zod@4.6.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-mrwp-f3q8-3g9p","slug":"ghsa-mrwp-f3q8-3g9p-0e2f9363","dossier":false,"summary":"follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects","aliases":["CVE-2026-116689"],"sourceIds":["GHSA-mrwp-f3q8-3g9p"],"published":"2026-10-30T22:59:33Z","modified":"2026-10-30T23:15:06.315251750Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116689"},{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8"},{"type":"PACKAGE","url":"https://github.com/follow-redirects/follow-redirects"},{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.2"}],"versionKeys":["npm:follow-redirects@1.16.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mv93-w799-cj2w","slug":"ghsa-mv93-w799-cj2w-4413137a","dossier":false,"summary":"GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath","aliases":["CVE-2026-67326","PYSEC-2026-3980"],"sourceIds":["GHSA-mv93-w799-cj2w","PYSEC-2026-3980"],"published":"2026-05-08T23:19:02Z","modified":"2026-09-17T09:10:55.928803360Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-mv93-w799-cj2w"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-newline-injection-via-config-writer-section"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-mwf2-3pr3-8698","slug":"ghsa-mwf2-3pr3-8698-6b8bfc0a","dossier":false,"summary":"Axios: HTTP/2 streamed uploads bypass `maxBodyLength`","aliases":["CVE-2026-67318"],"sourceIds":["GHSA-mwf2-3pr3-8698"],"published":"2026-07-20T22:37:03Z","modified":"2026-09-10T03:50:12.260991190Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-mwf2-3pr3-8698"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67318"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68948"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"}],"versionKeys":["npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mwh4-6h8g-pg8w","slug":"ghsa-mwh4-6h8g-pg8w-881420d8","dossier":false,"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","aliases":["CVE-2026-34519","PYSEC-2026-2101"],"sourceIds":["GHSA-mwh4-6h8g-pg8w","PYSEC-2026-2101"],"published":"2026-04-01T21:17:00.170Z","modified":"2026-09-10T03:50:44.819886754Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-p423-j2cm-9vmq","slug":"ghsa-p423-j2cm-9vmq-1455bc4c","dossier":false,"summary":"Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs","aliases":["CVE-2026-39892","PYSEC-2026-36"],"sourceIds":["GHSA-p423-j2cm-9vmq","PYSEC-2026-36"],"published":"2026-04-08T19:23:08Z","modified":"2026-11-04T03:30:50.401534783Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39892"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/c09d38ae52de7d95fe683b7a7c496f5751616f27"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43651"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43670"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43851"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43853"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43854"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:43855"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:46956"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:7295"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-39892"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456735"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cryptography/PYSEC-2026-36.yaml"}],"versionKeys":["pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-p498-v437-472g","slug":"ghsa-p498-v437-472g-007a67ac","dossier":false,"summary":"humanfs: Recursive copy follows symlinked files and copies data from outside the source tree","aliases":[],"sourceIds":["GHSA-p498-v437-472g"],"published":"2026-09-02T14:27:16Z","modified":"2026-09-10T03:50:54.516902811Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/humanwhocodes/humanfs/security/advisories/GHSA-p498-v437-472g"},{"type":"WEB","url":"https://github.com/humanwhocodes/humanfs/commit/22bbaa4487a3e6c1197ca619840de4615d0c3404"},{"type":"PACKAGE","url":"https://github.com/humanwhocodes/humanfs"},{"type":"WEB","url":"https://github.com/humanwhocodes/humanfs/releases/tag/node-v0.16.8"}],"versionKeys":["npm:@humanfs/node@0.16.6"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-p4g4-x82p-q773","slug":"ghsa-p4g4-x82p-q773-9c537199","dossier":false,"summary":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","aliases":["CVE-2026-102271","PYSEC-2026-4149"],"sourceIds":["GHSA-p4g4-x82p-q773","PYSEC-2026-4149"],"published":"2026-09-29T23:14:33Z","modified":"2026-10-01T17:55:49.051187883Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102271"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-p4g4-x82p-q773"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-p4wg-p73j-c528","slug":"ghsa-p4wg-p73j-c528-fd1a8a19","dossier":false,"summary":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","aliases":["BIT-pillow-2026-112895","CVE-2026-112895"],"sourceIds":["GHSA-p4wg-p73j-c528"],"published":"2026-10-20T20:50:49Z","modified":"2026-10-26T08:55:38.434240536Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112895"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-p538-c434-8v24","slug":"ghsa-p538-c434-8v24-c303e516","dossier":false,"summary":"GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count","aliases":["CVE-2026-73621","PYSEC-2026-3950"],"sourceIds":["GHSA-p538-c434-8v24","PYSEC-2026-3950"],"published":"2026-08-03T20:23:17Z","modified":"2026-09-10T13:10:55.177009469Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-p538-c434-8v24"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2184"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/38553b6fddc7f6a667cdb45a6762343a08fc72b2"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.56"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-arbitrary-file-truncation-via-commit-count"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-p58f-9548-mpm2","slug":"ghsa-p58f-9548-mpm2-3c2c8280","dossier":false,"summary":"virtualenv bash and fish activation scripts execute commands embedded in paths","aliases":["BIT-virtualenv-2026-102925","CVE-2026-102925","PYSEC-2026-4013"],"sourceIds":["GHSA-p58f-9548-mpm2","PYSEC-2026-4013"],"published":"2026-09-18T04:37:14Z","modified":"2026-10-06T15:25:40.633713827Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102925"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3252"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4013.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.7.13"},{"type":"PACKAGE","url":"https://pypi.org/project/virtualenv"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-p88m-4jfj-68fv","slug":"ghsa-p88m-4jfj-68fv-1bddddbb","dossier":false,"summary":"undici vulnerable to HTTP header injection via Set-Cookie percent-decoding","aliases":["CVE-2026-9679"],"sourceIds":["GHSA-p88m-4jfj-68fv"],"published":"2026-06-19T14:21:30Z","modified":"2026-09-10T03:51:09.228344843Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9679"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-p8hx-v2p6-rp84","slug":"ghsa-p8hx-v2p6-rp84-525428cb","dossier":false,"summary":"Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)","aliases":["BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337"],"sourceIds":["GHSA-p8hx-v2p6-rp84","PYSEC-2026-4337"],"published":"2026-10-21T21:20:31.760Z","modified":"2026-10-29T10:55:49.521326948Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96636"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10011"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-p92q-9vqr-4j8v","slug":"ghsa-p92q-9vqr-4j8v-02bcef7f","dossier":false,"summary":"Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter","aliases":["CVE-2026-44487"],"sourceIds":["GHSA-p92q-9vqr-4j8v"],"published":"2026-06-04T14:19:53Z","modified":"2026-09-10T03:51:09.218790313Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44487"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.32.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.16.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-p998-jp59-783m","slug":"ghsa-p998-jp59-783m-17c88f0d","dossier":false,"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows","aliases":["CVE-2026-34515","PYSEC-2026-2097"],"sourceIds":["GHSA-p998-jp59-783m","PYSEC-2026-2097"],"published":"2026-04-01T21:16:59.570Z","modified":"2026-09-10T03:51:02.565661873Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34515"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-p9ff-h696-f583","slug":"ghsa-p9ff-h696-f583-155b7820","dossier":false,"summary":"Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket","aliases":["CVE-2026-39363"],"sourceIds":["GHSA-p9ff-h696-f583"],"published":"2026-04-06T18:03:24Z","modified":"2026-09-10T03:51:02.521776335Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-p9ff-h696-f583"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39363"},{"type":"WEB","url":"https://github.com/vitejs/vite/pull/22159"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v6.4.2"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v7.3.2"},{"type":"WEB","url":"https://github.com/vitejs/vite/releases/tag/v8.0.5"}],"versionKeys":["npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-pchr-8j38-3x4p","slug":"ghsa-pchr-8j38-3x4p-42f3b4df","dossier":false,"summary":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","aliases":["BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334"],"sourceIds":["GHSA-pchr-8j38-3x4p","PYSEC-2026-4334"],"published":"2026-10-19T22:17:09.760Z","modified":"2026-10-28T11:10:41.233140457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112896"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-pf86-5x62-jrwf","slug":"ghsa-pf86-5x62-jrwf-32e5be84","dossier":false,"summary":"Axios: Prototype Pollution Gadgets - Response Tampering, Data Exfiltration, and Request Hijacking","aliases":["CVE-2026-42033"],"sourceIds":["GHSA-pf86-5x62-jrwf"],"published":"2026-05-05T00:26:29Z","modified":"2026-09-10T03:51:06.658921258Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-pf86-5x62-jrwf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42033"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pg7v-jwj7-p798","slug":"ghsa-pg7v-jwj7-p798-7c77aab5","dossier":false,"summary":"Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service","aliases":["BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452"],"sourceIds":["GHSA-pg7v-jwj7-p798","PYSEC-2026-3452"],"published":"2026-07-14T16:17:02.063Z","modified":"2026-09-10T03:50:52.876709782Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59203"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-phc3-fgpg-7m6h","slug":"ghsa-phc3-fgpg-7m6h-96f66464","dossier":false,"summary":"Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS","aliases":["CVE-2026-2581"],"sourceIds":["GHSA-phc3-fgpg-7m6h"],"published":"2026-03-13T20:37:58Z","modified":"2026-09-10T03:50:40.209102192Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2581"},{"type":"WEB","url":"https://hackerone.com/reports/3513473"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-phj9-mv4w-65pm","slug":"ghsa-phj9-mv4w-65pm-481e7dc3","dossier":false,"summary":"Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256"],"sourceIds":["GHSA-phj9-mv4w-65pm","PYSEC-2026-2256"],"published":"2026-07-06T19:17:08.703Z","modified":"2026-09-10T03:51:11.734605509Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-pmjh-fq2x-6v4x","slug":"ghsa-pmjh-fq2x-6v4x-39901fe8","dossier":false,"summary":"undici vulnerable to Denial of Service via orphaned RetryHandler response body","aliases":["CVE-2026-18149"],"sourceIds":["GHSA-pmjh-fq2x-6v4x"],"published":"2026-09-29T18:22:34Z","modified":"2026-09-29T18:30:41.164240105Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18149"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/3c6726599cea8646384dde846c97d630da472a74"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/e905b5b87e6953bcc542af90557b2fee5b7b5974"},{"type":"WEB","url":"https://hackerone.com/reports/3892751"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pmv8-rq9r-6j72","slug":"ghsa-pmv8-rq9r-6j72-24188f6f","dossier":false,"summary":"Axios: Deep formToJSON Key Recursion Can Cause Denial of Service","aliases":["CVE-2026-67312"],"sourceIds":["GHSA-pmv8-rq9r-6j72"],"published":"2026-07-20T17:48:18Z","modified":"2026-09-10T03:51:11.689184227Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-pmv8-rq9r-6j72"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67312"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68941"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11000"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11001"},{"type":"WEB","url":"https://github.com/axios/axios/commit/1417285c69344bbcc6420a021f67dee0c6fedb2d"},{"type":"WEB","url":"https://github.com/axios/axios/commit/32fc489632377d214db55bfa4e2c48486a7d7ce2"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v0.33.0"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.18.0"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/axios-before-denial-of-service-via-formtojson"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pmwg-cvhr-8vh7","slug":"ghsa-pmwg-cvhr-8vh7-f0462413","dossier":false,"summary":"Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0","aliases":["CVE-2026-42043"],"sourceIds":["GHSA-pmwg-cvhr-8vh7"],"published":"2026-05-05T00:20:58Z","modified":"2026-09-10T03:51:06.691311805Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42043"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pp6c-gr5w-3c5g","slug":"ghsa-pp6c-gr5w-3c5g-de40aafe","dossier":false,"summary":"python-multipart has Denial of Service via unbounded multipart part headers","aliases":["CVE-2026-42561","PYSEC-2026-3039"],"sourceIds":["GHSA-pp6c-gr5w-3c5g","PYSEC-2026-3039"],"published":"2026-05-06T21:56:14Z","modified":"2026-09-10T03:50:47.215892833Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42561"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pp6c-gr5w-3c5g"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-pq67-6m6q-mj2v","slug":"ghsa-pq67-6m6q-mj2v-3522d1d4","dossier":false,"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","aliases":["CVE-2025-50181","PYSEC-2026-1999"],"sourceIds":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"published":"2025-06-18T17:50:00Z","modified":"2026-09-10T03:50:25.299291456Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-pqxq-w44r-73xw","slug":"ghsa-pqxq-w44r-73xw-f260bc82","dossier":false,"summary":"AIOHTTP: Pure-Python parser request smuggling","aliases":["CVE-2026-111750"],"sourceIds":["GHSA-pqxq-w44r-73xw"],"published":"2026-10-20T19:52:21Z","modified":"2026-10-20T20:00:04.694820004Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111750"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-pr7r-676h-xcf6","slug":"ghsa-pr7r-676h-xcf6-7103c229","dossier":false,"summary":"undici vulnerable to cross-user information disclosure via shared cache whitespace bypass","aliases":["CVE-2026-9678"],"sourceIds":["GHSA-pr7r-676h-xcf6"],"published":"2026-06-18T14:28:13Z","modified":"2026-09-10T03:51:09.340567236Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pwv6-vv43-88gr","slug":"ghsa-pwv6-vv43-88gr-c5f811d0","dossier":false,"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","aliases":["BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"sourceIds":["GHSA-pwv6-vv43-88gr","PYSEC-2026-2252"],"published":"2026-05-04T20:20:31Z","modified":"2026-09-10T03:50:47.242104143Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-pxh4-856f-4h89","slug":"ghsa-pxh4-856f-4h89-682cbd7f","dossier":false,"summary":"PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery","aliases":[],"sourceIds":["GHSA-pxh4-856f-4h89"],"published":"2026-10-22T15:48:04Z","modified":"2026-10-22T16:00:09.127222029Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-pxh4-856f-4h89"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/af8181ca0bec5e6b372fbba9afbe23702b787ceb"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-q2hr-2g5m-vwhr","slug":"ghsa-q2hr-2g5m-vwhr-67a18b1f","dossier":false,"summary":"brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service","aliases":["CVE-2026-102277"],"sourceIds":["GHSA-q2hr-2g5m-vwhr"],"published":"2026-09-29T23:45:39Z","modified":"2026-09-30T00:00:03.849541183Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102277"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@1.1.16","npm:brace-expansion@2.0.2","npm:brace-expansion@5.0.8"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-q2x7-8rv6-6q7h","slug":"ghsa-q2x7-8rv6-6q7h-1113a288","dossier":false,"summary":"Jinja has a sandbox breakout through indirect reference to format method","aliases":["CVE-2024-56326","PYSEC-2026-1475"],"sourceIds":["GHSA-q2x7-8rv6-6q7h","PYSEC-2026-1475"],"published":"2024-12-23T17:56:08Z","modified":"2026-09-10T03:50:21.662855250Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2x7-8rv6-6q7h"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q45j-58j2-45rg","slug":"ghsa-q45j-58j2-45rg-cd238628","dossier":false,"summary":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","aliases":["BIT-pillow-2026-112897","CVE-2026-112897"],"sourceIds":["GHSA-q45j-58j2-45rg"],"published":"2026-10-20T20:52:43Z","modified":"2026-10-26T08:56:08.265781051Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112897"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-q8mj-m7cp-5q26","slug":"ghsa-q8mj-m7cp-5q26-f97ac731","dossier":false,"summary":"qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set","aliases":["CVE-2026-8723"],"sourceIds":["GHSA-q8mj-m7cp-5q26"],"published":"2026-05-22T17:27:19Z","modified":"2026-09-10T03:50:55.285123128Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"versionKeys":["npm:qs@6.13.0","npm:qs@6.14.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q8qp-cvcw-x6jj","slug":"ghsa-q8qp-cvcw-x6jj-6d29e5dc","dossier":false,"summary":"Axios has prototype pollution read-side gadgets in HTTP adapter that allow credential injection and request hijacking","aliases":["CVE-2026-42264"],"sourceIds":["GHSA-q8qp-cvcw-x6jj"],"published":"2026-05-05T00:18:38Z","modified":"2026-09-10T03:50:55.280623838Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-q8qp-cvcw-x6jj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42264"},{"type":"WEB","url":"https://github.com/axios/axios/pull/10779"},{"type":"WEB","url":"https://github.com/axios/axios/commit/47915144662f2733e6c051bdcb895a8c8f0586aa"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.15.2"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qccp-gfcp-xxvc","slug":"ghsa-qccp-gfcp-xxvc-0d988969","dossier":false,"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","aliases":["CVE-2026-44431","PYSEC-2026-141"],"sourceIds":["GHSA-qccp-gfcp-xxvc","PYSEC-2026-141"],"published":"2026-05-11T14:51:20Z","modified":"2026-09-10T03:50:47.272765640Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-qhr7-859c-m2p7","slug":"ghsa-qhr7-859c-m2p7-bdea2658","dossier":false,"summary":"brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion","aliases":["CVE-2026-102278"],"sourceIds":["GHSA-qhr7-859c-m2p7"],"published":"2026-09-29T23:45:17Z","modified":"2026-09-30T00:00:04.402763332Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102278"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@1.1.16","npm:brace-expansion@2.0.2","npm:brace-expansion@5.0.8"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-qmgc-5h2g-mvrw","slug":"ghsa-qmgc-5h2g-mvrw-199eacc8","dossier":false,"summary":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","aliases":["CVE-2026-22701","PYSEC-2026-1374"],"sourceIds":["GHSA-qmgc-5h2g-mvrw","PYSEC-2026-1374"],"published":"2026-01-13T18:44:55Z","modified":"2026-09-10T03:50:33.702580779Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qmgc-5h2g-mvrw"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-qmx5-4p3x-wvqf","slug":"ghsa-qmx5-4p3x-wvqf-aef88856","dossier":false,"summary":"virtualenv: Venv configuration readback can reinterpret path boundaries","aliases":["BIT-virtualenv-2026-113715","CVE-2026-113715"],"sourceIds":["GHSA-qmx5-4p3x-wvqf"],"published":"2026-10-23T22:20:43Z","modified":"2026-10-29T10:55:39.718166145Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113715"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3426"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.9"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-qrxm-fqhp-jwvm","slug":"ghsa-qrxm-fqhp-jwvm-ac20ce75","dossier":false,"summary":"undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation","aliases":["CVE-2026-87018"],"sourceIds":["GHSA-qrxm-fqhp-jwvm"],"published":"2026-10-27T19:02:21Z","modified":"2026-10-27T19:15:22.403573595Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87018"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/12cfd96c3f430897656e3edc1c5e02be8c1cd309"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b40fbfc0651703cf9fa9f6ced68b679f28d8bb28"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/e257e9f8fb42eedd50727b9cf65e548c8925e4a8"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-qx2v-qp2m-jg93","slug":"ghsa-qx2v-qp2m-jg93-0a55e142","dossier":false,"summary":"PostCSS has XSS via Unescaped </style> in its CSS Stringify Output","aliases":["CVE-2026-41305"],"sourceIds":["GHSA-qx2v-qp2m-jg93"],"published":"2026-04-24T15:31:42Z","modified":"2026-09-10T03:51:02.916463871Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/postcss/postcss/security/advisories/GHSA-qx2v-qp2m-jg93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41305"},{"type":"PACKAGE","url":"https://github.com/postcss/postcss"},{"type":"WEB","url":"https://github.com/postcss/postcss/releases/tag/8.5.10"}],"versionKeys":["npm:postcss@8.4.49","npm:postcss@8.5.3","npm:postcss@8.5.6"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-r28c-9q8g-f849","slug":"ghsa-r28c-9q8g-f849-c8b68fa5","dossier":false,"summary":"PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure","aliases":["CVE-2026-73646"],"sourceIds":["GHSA-r28c-9q8g-f849"],"published":"2026-07-24T16:24:55Z","modified":"2026-09-10T03:50:52.854537677Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/postcss/postcss/security/advisories/GHSA-r28c-9q8g-f849"},{"type":"WEB","url":"https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c"},{"type":"PACKAGE","url":"https://github.com/postcss/postcss"},{"type":"WEB","url":"https://github.com/postcss/postcss/releases/tag/8.5.18"}],"versionKeys":["npm:postcss@8.4.49","npm:postcss@8.5.3","npm:postcss@8.5.6"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-r4q5-vmmm-2653","slug":"ghsa-r4q5-vmmm-2653-87ff1faa","dossier":false,"summary":"follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets","aliases":["CVE-2026-40895"],"sourceIds":["GHSA-r4q5-vmmm-2653"],"published":"2026-04-14T01:11:11Z","modified":"2026-11-02T23:30:04.262099247Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-r4q5-vmmm-2653"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40895"},{"type":"WEB","url":"https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9"},{"type":"PACKAGE","url":"https://github.com/follow-redirects/follow-redirects"}],"versionKeys":["npm:follow-redirects@1.15.11"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r53p-7pc4-xj5r","slug":"ghsa-r53p-7pc4-xj5r-a9aaae9b","dossier":false,"summary":"undici vulnerable to downstream response splitting via retry interceptor","aliases":["CVE-2026-18540"],"sourceIds":["GHSA-r53p-7pc4-xj5r"],"published":"2026-09-29T18:22:07Z","modified":"2026-09-29T18:30:41.154532067Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18540"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/0160a719063fb0a77f4fdf9500b9166b91e14329"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/cd8af90b38ae33c2838d54a2d629774122effe95"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/ce31bc824b578008faae5d3350da66c1b5f71548"},{"type":"WEB","url":"https://hackerone.com/reports/3900104"},{"type":"WEB","url":"https://hackerone.com/reports/3900615"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r543-q48m-4c9j","slug":"ghsa-r543-q48m-4c9j-6471b319","dossier":false,"summary":"WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE","aliases":["CVE-2026-106443","PYSEC-2026-4311"],"sourceIds":["GHSA-r543-q48m-4c9j","PYSEC-2026-4311"],"published":"2026-10-07T18:05:49Z","modified":"2026-10-15T14:56:08.607638818Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106443"},{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542"},{"type":"PACKAGE","url":"https://github.com/Kozea/WeasyPrint"},{"type":"WEB","url":"https://github.com/Kozea/WeasyPrint/releases/tag/v70.0"},{"type":"PACKAGE","url":"https://pypi.org/project/weasyprint"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r543-q48m-4c9j"}],"versionKeys":["pypi:weasyprint@64.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r6ph-v2qm-q3c2","slug":"ghsa-r6ph-v2qm-q3c2-c75907df","dossier":false,"summary":"cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves","aliases":["CVE-2026-26007","PYSEC-2026-2141"],"sourceIds":["GHSA-r6ph-v2qm-q3c2","PYSEC-2026-2141"],"published":"2026-02-10T21:27:06Z","modified":"2026-09-10T03:50:59.750965345Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26007"},{"type":"WEB","url":"https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"},{"type":"PACKAGE","url":"https://github.com/pyca/cryptography"},{"type":"WEB","url":"https://github.com/pyca/cryptography/releases/tag/46.0.5"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-26007"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26007.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12176"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13512"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13672"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19355"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21431"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21517"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22330"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22993"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:2694"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:cryptography@42.0.8","pypi:cryptography@43.0.3","pypi:cryptography@44.0.0","pypi:cryptography@44.0.3","pypi:cryptography@45.0.7","pypi:cryptography@46.0.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-r6x4-923q-g947","slug":"ghsa-r6x4-923q-g947-b796420c","dossier":false,"summary":"PyJWT BOM Bypass","aliases":["CVE-2026-102272","PYSEC-2026-4150"],"sourceIds":["GHSA-r6x4-923q-g947","PYSEC-2026-4150"],"published":"2026-09-29T23:14:00Z","modified":"2026-10-01T17:56:05.452379838Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102272"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r6x4-923q-g947"}],"versionKeys":["pypi:pyjwt@2.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r73j-pqj5-w3x7","slug":"ghsa-r73j-pqj5-w3x7-8d4d543f","dossier":false,"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","aliases":["BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"sourceIds":["GHSA-r73j-pqj5-w3x7","PYSEC-2026-2874"],"published":"2026-05-04T20:19:30Z","modified":"2026-09-10T03:50:55.309086884Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r73j-pqj5-w3x7"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-r825-w8mm-5pxw","slug":"ghsa-r825-w8mm-5pxw-2a8236ea","dossier":false,"summary":"launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors","aliases":["CVE-2026-112944"],"sourceIds":["GHSA-r825-w8mm-5pxw"],"published":"2026-10-20T19:51:52Z","modified":"2026-10-20T20:00:04.608907013Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-r825-w8mm-5pxw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112944"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/pull/156"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/commit/f6e6701bb1f16f2dd242b321374f1b6cca6eb6d4"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"},{"type":"WEB","url":"https://github.com/vitejs/launch-editor/releases/tag/v2.14.2"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-r9mr-m37c-5fr3","slug":"ghsa-r9mr-m37c-5fr3-d43000fc","dossier":false,"summary":"GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution","aliases":["CVE-2026-73625","PYSEC-2026-3953"],"sourceIds":["GHSA-r9mr-m37c-5fr3","PYSEC-2026-3953"],"published":"2026-07-24T16:42:57Z","modified":"2026-09-10T13:10:47.448946391Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-r9mr-m37c-5fr3"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2180"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.54"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gitpython-before-remote-code-execution-via-kwarg-value-smuggling"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-rf6f-7fwh-wjgh","slug":"ghsa-rf6f-7fwh-wjgh-21853d08","dossier":false,"summary":"Prototype Pollution via parse() in NodeJS flatted","aliases":["CVE-2026-33228"],"sourceIds":["GHSA-rf6f-7fwh-wjgh"],"published":"2026-03-19T17:43:54Z","modified":"2026-10-05T16:00:04.586755982Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"WEB","url":"https://github.com/WebReflection/flatted/security/advisories/GHSA-rf6f-7fwh-wjgh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33228"},{"type":"WEB","url":"https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-33228"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449872"},{"type":"PACKAGE","url":"https://github.com/WebReflection/flatted"},{"type":"WEB","url":"https://github.com/WebReflection/flatted/releases/tag/v3.4.2"}],"versionKeys":["npm:flatted@3.3.3"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-rfgq-q3w2-pmv2","slug":"ghsa-rfgq-q3w2-pmv2-908c42cd","dossier":false,"summary":"Pillow: Image.quantize() with empty palette leaks uninitialized stack memory","aliases":["BIT-pillow-2026-112898","CVE-2026-112898"],"sourceIds":["GHSA-rfgq-q3w2-pmv2"],"published":"2026-10-21T20:44:07Z","modified":"2026-10-26T08:55:50.383984569Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-rfgq-q3w2-pmv2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112898"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-rfgv-xxqx-mfg5","slug":"ghsa-rfgv-xxqx-mfg5-2b1e2f6b","dossier":false,"summary":"undici vulnerable to Denial of Service via unrequested WebSocket subprotocol","aliases":["CVE-2026-19534"],"sourceIds":["GHSA-rfgv-xxqx-mfg5"],"published":"2026-09-29T18:21:33Z","modified":"2026-09-29T18:30:41.167602268Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19534"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/2af0faf88b906d3127a360c3ac75164c0f95e5a5"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/6615e0175e9b635bcd2e3e87a47daa82f6f5b728"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/66e12816064cf3068f63bd134748b7fc4e779bad"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-rfpc-qcw5-3pc4","slug":"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","dossier":false,"summary":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","aliases":["CVE-2026-112939"],"sourceIds":["GHSA-rfpc-qcw5-3pc4"],"published":"2026-10-28T21:08:45Z","modified":"2026-10-28T21:15:05.584943666Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112939"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/836"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-rgw5-rvv9-x895","slug":"ghsa-rgw5-rvv9-x895-7800c7f2","dossier":false,"summary":"brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation","aliases":["CVE-2026-69152"],"sourceIds":["GHSA-rgw5-rvv9-x895"],"published":"2026-08-03T16:35:32Z","modified":"2026-09-10T03:51:14.535270857Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-rgw5-rvv9-x895"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69152"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/139d015104e71433ad52a41d19467c48ecbb2c7d"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/1e30c930238d7162802d88a94189182def178dac"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/688a99eeaab02627c2b89ba8ba4821fecfa659cf"},{"type":"WEB","url":"https://github.com/juliangruber/brace-expansion/commit/cb4b9e47cc2ec777c14b2b4492fb431a56f6a031"},{"type":"PACKAGE","url":"https://github.com/juliangruber/brace-expansion"}],"versionKeys":["npm:brace-expansion@1.1.12","npm:brace-expansion@1.1.16","npm:brace-expansion@2.0.2","npm:brace-expansion@5.0.8"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-rmxm-3fg6-px4f","slug":"ghsa-rmxm-3fg6-px4f-eb1ad711","dossier":false,"summary":"@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths","aliases":["CVE-2026-118663"],"sourceIds":["GHSA-rmxm-3fg6-px4f"],"published":"2026-10-28T21:05:00Z","modified":"2026-10-28T21:15:04.153052864Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/honojs/node-server/security/advisories/GHSA-rmxm-3fg6-px4f"},{"type":"WEB","url":"https://github.com/honojs/node-server/commit/982179278529d5673812116b042829f27794966f"},{"type":"PACKAGE","url":"https://github.com/honojs/node-server"},{"type":"WEB","url":"https://github.com/honojs/node-server/releases/tag/v2.1.3"}],"versionKeys":["npm:@hono/node-server@1.19.17"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-rpm5-65cw-6hj4","slug":"ghsa-rpm5-65cw-6hj4-6c97dd77","dossier":false,"summary":"GitPython has Command Injection via Git options bypass","aliases":["CVE-2026-42215","PYSEC-2026-2160"],"sourceIds":["GHSA-rpm5-65cw-6hj4","PYSEC-2026-2160"],"published":"2026-04-25T23:42:16Z","modified":"2026-09-10T03:51:03.167884784Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42215"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-rq7h-c2jc-7f22","slug":"ghsa-rq7h-c2jc-7f22-e139dfcc","dossier":false,"summary":"Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine","aliases":["CVE-2026-112946"],"sourceIds":["GHSA-rq7h-c2jc-7f22"],"published":"2026-10-21T16:47:42Z","modified":"2026-10-21T17:00:06.336868869Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/vite/security/advisories/GHSA-rq7h-c2jc-7f22"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112946"},{"type":"WEB","url":"https://github.com/vitejs/vite/pull/23656"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/170b92791421bcd484f7325936d989a82d6bd4aa"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/45c0e3392a298626955a0ab93a8e51232daac721"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/e570d8d016096b5f8f6f09808376ca6cf73f27d0"},{"type":"WEB","url":"https://github.com/vitejs/vite/commit/f0d76c7da13d5e794807b82f0b86c1931a8438e3"},{"type":"PACKAGE","url":"https://github.com/vitejs/vite"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-rwj8-pgh3-r573","slug":"ghsa-rwj8-pgh3-r573-0bf779f8","dossier":false,"summary":"GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL","aliases":["CVE-2026-67322","PYSEC-2026-3842"],"sourceIds":["GHSA-rwj8-pgh3-r573","PYSEC-2026-3842"],"published":"2026-07-21T22:06:09Z","modified":"2026-09-24T18:28:17.149390188Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67322"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2172"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/8ac5a30519b6f4af85398b9b9d7064ff4d452da2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rwj8-pgh3-r573"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.52"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/gitpython/PYSEC-2026-3842.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-environment-variable-exfiltration-via-clone-from"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-rwrf-2pqf-9j8j","slug":"ghsa-rwrf-2pqf-9j8j-e3036e5e","dossier":false,"summary":"Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas","aliases":["CVE-2026-116686"],"sourceIds":["GHSA-rwrf-2pqf-9j8j"],"published":"2026-10-27T21:05:29Z","modified":"2026-10-27T21:15:03.830660129Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-rwrf-2pqf-9j8j"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3394"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3396"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/5ebdfed4060d8e5b11b8e2348f86bad4d1fb8836"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/6705402e246dc4eb1fcdf4d9902b78d3c9c36e1b"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0","pypi:mcp@1.28.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-rx4f-c7p8-82vq","slug":"ghsa-rx4f-c7p8-82vq-f334add1","dossier":false,"summary":"undici vulnerable to Denial of Service via WebSocketStream unclean close","aliases":["CVE-2026-85014"],"sourceIds":["GHSA-rx4f-c7p8-82vq"],"published":"2026-09-29T18:10:32Z","modified":"2026-09-29T18:15:04.711653428Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85014"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/1858656ebb1e919311c1f31613dfd581b7214349"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/662d0ea671fe64139e79533c913fce412765e1d7"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.10.2"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-rxp7-6hxx-x8q5","slug":"ghsa-rxp7-6hxx-x8q5-afd81b2a","dossier":false,"summary":"ip-address: Address6 matches a zone identifier in quadratic time ahead of its length limit, allowing a single long string to stall the process","aliases":["CVE-2026-111997"],"sourceIds":["GHSA-rxp7-6hxx-x8q5"],"published":"2026-10-22T16:19:39Z","modified":"2026-10-22T16:30:30.129356757Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111997"},{"type":"WEB","url":"https://github.com/beaugunderson/ip-address/commit/ec80fcd5d7b97defecfd39717d782a9f9f8b89dd"},{"type":"PACKAGE","url":"https://github.com/beaugunderson/ip-address"},{"type":"WEB","url":"https://github.com/beaugunderson/ip-address/releases/tag/v10.7.4"}],"versionKeys":["npm:ip-address@10.7.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-v3r7-h72x-cjcm","slug":"ghsa-v3r7-h72x-cjcm-ff28b499","dossier":false,"summary":"undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields","aliases":["CVE-2026-16729"],"sourceIds":["GHSA-v3r7-h72x-cjcm"],"published":"2026-08-03T19:30:52Z","modified":"2026-09-10T03:51:14.535204629Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-v3r7-h72x-cjcm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16729"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/10d93fc332f2c8c161982dec3833201de29891b5"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/3bf91ddb493e853957f3a58e155326a668ab8aef"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/af7484043ee075a6f216da0ad77e1dac55199235"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.28.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-v422-hmwv-36x6","slug":"ghsa-v422-hmwv-36x6-3d8c5fa3","dossier":false,"summary":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement","aliases":["CVE-2026-12590"],"sourceIds":["GHSA-v422-hmwv-36x6"],"published":"2026-07-20T23:23:26Z","modified":"2026-09-10T03:50:53.014509971Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12590"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/pull/698"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/pull/741"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/expressjs/body-parser"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/releases/tag/1.20.6"},{"type":"WEB","url":"https://github.com/expressjs/body-parser/releases/tag/v2.3.0"}],"versionKeys":["npm:body-parser@1.20.3","npm:body-parser@1.20.4"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-v4x8-3wr5-3wq8","slug":"ghsa-v4x8-3wr5-3wq8-fa48bf99","dossier":false,"summary":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","aliases":["CVE-2026-112940"],"sourceIds":["GHSA-v4x8-3wr5-3wq8"],"published":"2026-10-23T21:59:08Z","modified":"2026-10-23T22:15:04.432475030Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112940"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-v6wh-96g9-6wx3","slug":"ghsa-v6wh-96g9-6wx3-0e881d08","dossier":false,"summary":"launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows","aliases":["CVE-2026-53632"],"sourceIds":["GHSA-v6wh-96g9-6wx3"],"published":"2026-06-15T17:18:31Z","modified":"2026-09-10T03:50:50.705036566Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/vitejs/launch-editor/security/advisories/GHSA-v6wh-96g9-6wx3"},{"type":"PACKAGE","url":"https://github.com/vitejs/launch-editor"}],"versionKeys":["npm:vite@5.4.21","npm:vite@6.3.5","npm:vite@6.4.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-v87r-6q3f-2j67","slug":"ghsa-v87r-6q3f-2j67-81913ca6","dossier":false,"summary":"GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath","aliases":["CVE-2026-44244","PYSEC-2026-2163"],"sourceIds":["GHSA-v87r-6q3f-2j67","PYSEC-2026-2163"],"published":"2026-05-06T21:58:00Z","modified":"2026-09-10T03:50:47.691444343Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44244"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.49"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-v92g-xgxw-vvmm","slug":"ghsa-v92g-xgxw-vvmm-8ea08169","dossier":false,"summary":"Mako: Path traversal via double-slash URI prefix in TemplateLookup","aliases":["CVE-2026-41205","PYSEC-2026-88"],"sourceIds":["GHSA-v92g-xgxw-vvmm","PYSEC-2026-88"],"published":"2026-04-16T21:16:40Z","modified":"2026-09-10T03:51:03.377000392Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41205"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-v9p9-hfj2-hcw8","slug":"ghsa-v9p9-hfj2-hcw8-f7515df3","dossier":false,"summary":"Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation","aliases":["CVE-2026-2229"],"sourceIds":["GHSA-v9p9-hfj2-hcw8"],"published":"2026-03-13T20:41:41Z","modified":"2026-09-10T03:50:41.228925580Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2229"},{"type":"WEB","url":"https://hackerone.com/reports/3487486"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc7692"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://nodejs.org/api/zlib.html#class-zlibinflateraw"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-v9pg-7xvm-68hf","slug":"ghsa-v9pg-7xvm-68hf-bd9c7524","dossier":false,"summary":"python-multipart: Negative Content-Length in parse_form buffers the entire body in memory","aliases":["CVE-2026-53540","PYSEC-2026-3040"],"sourceIds":["GHSA-v9pg-7xvm-68hf","PYSEC-2026-3040"],"published":"2026-06-15T20:23:45Z","modified":"2026-09-10T03:50:50.590441047Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v9pg-7xvm-68hf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53540"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-v9pv-5gc8-w2m6","slug":"ghsa-v9pv-5gc8-w2m6-ece1573e","dossier":false,"summary":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","aliases":["BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339"],"sourceIds":["GHSA-v9pv-5gc8-w2m6","PYSEC-2026-4339"],"published":"2026-10-21T21:20:32.217Z","modified":"2026-10-29T10:55:37.663049285Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96639"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10105"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-vf2m-468p-8v99","slug":"ghsa-vf2m-468p-8v99-2cc482e8","dossier":false,"summary":"Axios: HTTP adapter streamed responses bypass maxContentLength","aliases":["CVE-2026-42036"],"sourceIds":["GHSA-vf2m-468p-8v99"],"published":"2026-05-05T00:26:57Z","modified":"2026-09-10T03:50:47.671121168Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-vf2m-468p-8v99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42036"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-vffw-93wf-4j4q","slug":"ghsa-vffw-93wf-4j4q-3828c302","dossier":false,"summary":"python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters","aliases":["CVE-2026-53537","PYSEC-2026-3041"],"sourceIds":["GHSA-vffw-93wf-4j4q","PYSEC-2026-3041"],"published":"2026-06-15T20:20:51Z","modified":"2026-09-10T03:50:50.585695996Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53537"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vffw-93wf-4j4q"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/blob/main/vulns/python-multipart/PYSEC-2026-3041.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-vh66-26gq-q6x8","slug":"ghsa-vh66-26gq-q6x8-7005b54d","dossier":false,"summary":"Axios: Prototype pollution gadget in fetch adapter can alter outbound requests","aliases":["CVE-2026-101908"],"sourceIds":["GHSA-vh66-26gq-q6x8"],"published":"2026-09-30T15:13:16Z","modified":"2026-09-30T15:30:04.438497820Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-vh66-26gq-q6x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101908"},{"type":"WEB","url":"https://github.com/axios/axios/pull/11141"},{"type":"WEB","url":"https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"},{"type":"PACKAGE","url":"https://github.com/axios/axios"},{"type":"WEB","url":"https://github.com/axios/axios/releases/tag/v1.20.0"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-vj7q-gjh5-988w","slug":"ghsa-vj7q-gjh5-988w-54882ae8","dossier":false,"summary":"MCP Python SDK: WebSocket server transport does not support Host/Origin validation","aliases":["CVE-2026-59950","PYSEC-2026-3483"],"sourceIds":["GHSA-vj7q-gjh5-988w","PYSEC-2026-3483"],"published":"2026-07-16T20:14:34Z","modified":"2026-09-10T03:50:53.083568399Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-vj7q-gjh5-988w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59950"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/2992"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.28.1"},{"type":"PACKAGE","url":"https://pypi.org/project/mcp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vj7q-gjh5-988w"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-vjc4-5qp5-m44j","slug":"ghsa-vjc4-5qp5-m44j-08063b19","dossier":false,"summary":"Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service","aliases":["BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496"],"sourceIds":["GHSA-vjc4-5qp5-m44j","PYSEC-2026-3496"],"published":"2026-07-20T23:18:32Z","modified":"2026-09-10T03:50:53.107920034Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59204"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9704"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vjc4-5qp5-m44j"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-vqfr-h8mv-ghfj","slug":"ghsa-vqfr-h8mv-ghfj-49515033","dossier":false,"summary":"h11 accepts some malformed Chunked-Encoding bodies","aliases":["CVE-2025-43859","PYSEC-2026-348"],"sourceIds":["GHSA-vqfr-h8mv-ghfj","PYSEC-2026-348"],"published":"2025-04-24T16:07:56Z","modified":"2026-10-27T16:45:03.535584040Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43859"},{"type":"WEB","url":"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/h11/PYSEC-2026-348.yaml"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h11"},{"type":"PACKAGE","url":"https://pypi.org/project/h11"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vqfr-h8mv-ghfj"}],"versionKeys":["pypi:h11@0.14.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-vrm6-8vpv-qv8q","slug":"ghsa-vrm6-8vpv-qv8q-6d6340eb","dossier":false,"summary":"Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression","aliases":["CVE-2026-1526"],"sourceIds":["GHSA-vrm6-8vpv-qv8q"],"published":"2026-03-13T20:41:56Z","modified":"2026-09-10T03:50:41.264792574Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-vrm6-8vpv-qv8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1526"},{"type":"WEB","url":"https://hackerone.com/reports/3481206"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"WEB","url":"https://datatracker.ietf.org/doc/html/rfc7692"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://owasp.org/www-community/attacks/Denial_of_Service"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-vx6w-vv9f-6gvg","slug":"ghsa-vx6w-vv9f-6gvg-f0d0a86e","dossier":false,"summary":"Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit","aliases":["CVE-2026-112899"],"sourceIds":["GHSA-vx6w-vv9f-6gvg"],"published":"2026-10-20T20:53:21Z","modified":"2026-10-20T21:00:04.428653055Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vx6w-vv9f-6gvg"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3e8cc105588d1dfe062fcada0b6058c1b5f14b65"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-vxj4-q4g9-crj7","slug":"ghsa-vxj4-q4g9-crj7-3e25d39d","dossier":false,"summary":"virtualenv bash activate runs commands from an environment name with a backslash before $","aliases":["BIT-virtualenv-2026-113725","CVE-2026-113725"],"sourceIds":["GHSA-vxj4-q4g9-crj7"],"published":"2026-10-21T16:49:01Z","modified":"2026-10-29T10:55:53.696944055Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113725"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.14.7"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-vxpw-j846-p89q","slug":"ghsa-vxpw-j846-p89q-aec4e427","dossier":false,"summary":"undici WebSocket client vulnerable to denial of service via fragment count bypass","aliases":["CVE-2026-12151"],"sourceIds":["GHSA-vxpw-j846-p89q"],"published":"2026-06-19T14:22:01Z","modified":"2026-11-04T03:45:10.197249081Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12151"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/32dbf0b3dd93daf6d87badf506d52e89f2e20e78"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:56431"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:57013"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:62260"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:66488"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:66545"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-12151"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489980"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.27.0"}],"versionKeys":["npm:undici@7.13.0","npm:undici@7.18.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-vxq7-64xx-v4gw","slug":"ghsa-vxq7-64xx-v4gw-3e875898","dossier":true,"summary":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","aliases":["CVE-2026-97689","PYSEC-2026-4177"],"sourceIds":["GHSA-vxq7-64xx-v4gw","PYSEC-2026-4177"],"published":"2026-09-30T14:46:18Z","modified":"2026-10-01T17:55:57.514829071Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-w2cx-738m-mc7w","slug":"ghsa-w2cx-738m-mc7w-6741b272","dossier":false,"summary":"PyJWT accepts public JWK containers as HMAC secrets","aliases":["CVE-2026-102273","PYSEC-2026-4151"],"sourceIds":["GHSA-w2cx-738m-mc7w","PYSEC-2026-4151"],"published":"2026-09-29T23:16:55Z","modified":"2026-10-01T17:56:17.439454528Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102273"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w2cx-738m-mc7w"}],"versionKeys":["pypi:pyjwt@2.13.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-w2fm-2cpv-w7v5","slug":"ghsa-w2fm-2cpv-w7v5-c2f7701a","dossier":false,"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","aliases":["CVE-2026-22815","PYSEC-2026-2094"],"sourceIds":["GHSA-w2fm-2cpv-w7v5","PYSEC-2026-2094"],"published":"2026-04-01T19:45:17Z","modified":"2026-09-10T03:51:03.588955358Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-w4fh-qvv9-3v23","slug":"ghsa-w4fh-qvv9-3v23-5d99e159","dossier":false,"summary":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","aliases":["CVE-2026-116684"],"sourceIds":["GHSA-w4fh-qvv9-3v23"],"published":"2026-10-27T21:06:59Z","modified":"2026-10-27T21:15:03.825987077Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-w4fh-qvv9-3v23"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3447"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/pull/3451"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/0c9136841ff092987a20700ff9c2c9789bda2f40"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/commit/8c2fa6eabacde869d75568e33b9d466b58c2f512"},{"type":"PACKAGE","url":"https://github.com/modelcontextprotocol/python-sdk"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0"}],"versionKeys":["pypi:mcp@1.10.0","pypi:mcp@1.14.1","pypi:mcp@1.19.0","pypi:mcp@1.28.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-w6j9-cwv2-h6wq","slug":"ghsa-w6j9-cwv2-h6wq-1e6b5139","dossier":false,"summary":"PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set","aliases":["CVE-2026-102274","PYSEC-2026-4152"],"sourceIds":["GHSA-w6j9-cwv2-h6wq","PYSEC-2026-4152"],"published":"2026-09-29T18:23:01Z","modified":"2026-10-01T17:55:45.889604470Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102274"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pyjwt"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w6j9-cwv2-h6wq"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-w74x-v6f9-j3xg","slug":"ghsa-w74x-v6f9-j3xg-294b9b29","dossier":false,"summary":"fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding","aliases":["CVE-2026-110306"],"sourceIds":["GHSA-w74x-v6f9-j3xg"],"published":"2026-10-23T21:41:36Z","modified":"2026-10-23T21:45:04.896137439Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-w74x-v6f9-j3xg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110306"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/39933a1f1422986f14e2d844f552238feb40f5d4"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/597f254c86d151568511eeb9a1df761fd12520b3"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/e60e716f41d1d73717e2d803d20b68d2c6d20a0f"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"}],"versionKeys":["npm:fast-uri@3.1.8"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-w7fw-mjwx-w883","slug":"ghsa-w7fw-mjwx-w883-ad60beb3","dossier":false,"summary":"qs's arrayLimit bypass in comma parsing allows denial of service","aliases":["CVE-2026-2391"],"sourceIds":["GHSA-w7fw-mjwx-w883"],"published":"2026-02-12T17:04:39Z","modified":"2026-09-10T03:50:35.973235487Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391"},{"type":"WEB","url":"https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"},{"type":"PACKAGE","url":"https://github.com/ljharb/qs"}],"versionKeys":["npm:qs@6.13.0","npm:qs@6.14.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-w7vc-732c-9m39","slug":"ghsa-w7vc-732c-9m39-90a52664","dossier":false,"summary":"PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWS","aliases":["CVE-2026-48525","PYSEC-2026-178"],"sourceIds":["GHSA-w7vc-732c-9m39","PYSEC-2026-178"],"published":"2026-05-28T16:16:29.533Z","modified":"2026-09-10T03:50:50.801195449Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48525"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-178.yaml"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-w853-jp5j-5j7f","slug":"ghsa-w853-jp5j-5j7f-2786386f","dossier":false,"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","aliases":["CVE-2025-68146","PYSEC-2026-1375"],"sourceIds":["GHSA-w853-jp5j-5j7f","PYSEC-2026-1375"],"published":"2025-12-16T20:52:55Z","modified":"2026-09-10T03:50:32.252960082Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/3.20.1"},{"type":"WEB","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants"},{"type":"WEB","url":"https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w853-jp5j-5j7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68146"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-w889-685w-c8fh","slug":"ghsa-w889-685w-c8fh-9dd63a47","dossier":false,"summary":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","aliases":["BIT-pillow-2026-112900","CVE-2026-112900"],"sourceIds":["GHSA-w889-685w-c8fh"],"published":"2026-10-21T19:58:44Z","modified":"2026-10-26T08:55:37.091976147Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112900"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-w8jc-g24h-crhw","slug":"ghsa-w8jc-g24h-crhw-5553514f","dossier":false,"summary":"GitPython command wrappers omit unsafe protocol and option checks","aliases":["CVE-2026-110857"],"sourceIds":["GHSA-w8jc-g24h-crhw"],"published":"2026-10-27T15:26:43Z","modified":"2026-10-27T15:47:24.947223105Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-w8jc-g24h-crhw"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2251"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/9ad28cc4c7176d22cd6181d69805058a719dd03b"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-w9j2-pvgh-6h63","slug":"ghsa-w9j2-pvgh-6h63-6eec34b1","dossier":false,"summary":"Axios: Authentication Bypass via Prototype Pollution Gadget in `validateStatus` Merge Strategy","aliases":["CVE-2026-42041"],"sourceIds":["GHSA-w9j2-pvgh-6h63"],"published":"2026-05-05T00:21:39Z","modified":"2026-09-10T03:50:47.772907977Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-w9j2-pvgh-6h63"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42041"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-whj4-6x5x-4v2j","slug":"ghsa-whj4-6x5x-4v2j-eb5fc6a1","dossier":false,"summary":"FITS GZIP decompression bomb in Pillow","aliases":["BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"sourceIds":["GHSA-whj4-6x5x-4v2j","PYSEC-2026-2250"],"published":"2026-04-13T19:22:35Z","modified":"2026-09-10T03:51:03.847830288Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40192"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-wjr9-j795-jxcr","slug":"ghsa-wjr9-j795-jxcr-36e44760","dossier":false,"summary":"fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization","aliases":["CVE-2026-110180"],"sourceIds":["GHSA-wjr9-j795-jxcr"],"published":"2026-10-23T21:37:59Z","modified":"2026-10-23T21:45:04.892054666Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-wjr9-j795-jxcr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110180"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/58c183d0b168ad87f98773266444ce1f6375803a"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/ddfc6a51122dfce0365655f04479fc3adb7f6b3c"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/f6d46dfeab025d0c440485f4ae29fa4f14707646"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"}],"versionKeys":["npm:fast-uri@3.1.8"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-wjx4-4jcj-g98j","slug":"ghsa-wjx4-4jcj-g98j-e937161b","dossier":false,"summary":"Pillow has an integer overflow when processing fonts","aliases":["BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"sourceIds":["GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"published":"2026-05-04T20:18:45Z","modified":"2026-09-10T03:50:47.950262681Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-wp53-j4wj-2cfg","slug":"ghsa-wp53-j4wj-2cfg-22cec3c5","dossier":false,"summary":"Python-Multipart has Arbitrary File Write via Non-Default Configuration","aliases":["CVE-2026-24486","PYSEC-2026-1852"],"sourceIds":["GHSA-wp53-j4wj-2cfg","PYSEC-2026-1852"],"published":"2026-01-26T23:28:05Z","modified":"2026-09-10T03:50:59.359593372Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24486"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.22"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wp53-j4wj-2cfg"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-wp97-x4hv-qvhp","slug":"ghsa-wp97-x4hv-qvhp-4b75019d","dossier":false,"summary":"Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length","aliases":["CVE-2026-116584"],"sourceIds":["GHSA-wp97-x4hv-qvhp"],"published":"2026-10-28T21:17:20Z","modified":"2026-10-28T21:30:05.906685921Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-wp97-x4hv-qvhp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116584"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69"},{"type":"PACKAGE","url":"https://github.com/lxsmnsyc/seroval"},{"type":"WEB","url":"https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8"}],"versionKeys":["npm:seroval@1.6.7"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-wqp7-x3pw-xc5r","slug":"ghsa-wqp7-x3pw-xc5r-4caabf81","dossier":false,"summary":"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows","aliases":["CVE-2026-48818","PYSEC-2026-2281"],"sourceIds":["GHSA-wqp7-x3pw-xc5r","PYSEC-2026-2281"],"published":"2026-06-15T20:16:30Z","modified":"2026-09-10T03:50:51.079936646Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48818"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/releases/tag/1.1.0"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490020"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5"},{"type":"FIX","url":"https://github.com/Kludex/starlette/pull/3287"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-wvpp-8hx9-p66j","slug":"ghsa-wvpp-8hx9-p66j-188b3951","dossier":false,"summary":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","aliases":["CVE-2026-76220","PYSEC-2026-3843"],"sourceIds":["GHSA-wvpp-8hx9-p66j","PYSEC-2026-3843"],"published":"2026-08-07T15:49:07Z","modified":"2026-09-10T12:26:01.792035310Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-wvpp-8hx9-p66j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76220"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/pull/2204"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/commit/96a888f4d782cb2f80452148e48e60ce4af6d541"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"WEB","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.58"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/gitpython-before-command-execution-via-split-single-char-options"},{"type":"PACKAGE","url":"https://pypi.org/project/gitpython"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wvpp-8hx9-p66j"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-x2qx-6953-8485","slug":"ghsa-x2qx-6953-8485-107f8fe2","dossier":false,"summary":"GitPython: Unsafe option check validates multi_options before shlex.split transformation","aliases":["CVE-2026-42284","PYSEC-2026-2161"],"sourceIds":["GHSA-x2qx-6953-8485","PYSEC-2026-2161"],"published":"2026-04-25T23:41:49Z","modified":"2026-09-10T03:51:03.787491179Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42284"},{"type":"PACKAGE","url":"https://github.com/gitpython-developers/GitPython"},{"type":"FIX","url":"https://github.com/gitpython-developers/GitPython/releases/tag/3.1.47"},{"type":"WEB","url":"https://www.tenable.com/cve/CVE-2026-32686"}],"versionKeys":["pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-x33g-cr3x-6449","slug":"ghsa-x33g-cr3x-6449-e42d7ec6","dossier":false,"summary":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","aliases":["CVE-2026-102275","PYSEC-2026-4183"],"sourceIds":["GHSA-x33g-cr3x-6449","PYSEC-2026-4183"],"published":"2026-09-28T21:17:15.857Z","modified":"2026-10-07T10:11:04.862065390Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275"},{"type":"FIX","url":"https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"ADVISORY","url":"https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.13.0","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-x746-7m8f-x49c","slug":"ghsa-x746-7m8f-x49c-c0349d3f","dossier":false,"summary":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","aliases":["CVE-2026-48817","PYSEC-2026-2280"],"sourceIds":["GHSA-x746-7m8f-x49c","PYSEC-2026-2280"],"published":"2026-06-15T20:16:05Z","modified":"2026-09-10T03:50:12.272722043Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48817"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/releases/tag/1.1.0"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-x78j-v8h9-3j2q","slug":"ghsa-x78j-v8h9-3j2q-0741325d","dossier":false,"summary":"virtualenv: Command injection via --prompt in activate.bat (batch activator)","aliases":["BIT-virtualenv-2026-102937","CVE-2026-102937","PYSEC-2026-4014"],"sourceIds":["GHSA-x78j-v8h9-3j2q","PYSEC-2026-4014"],"published":"2026-09-18T01:41:45Z","modified":"2026-10-06T15:26:00.196757436Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102937"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/pull/3250"},{"type":"FIX","url":"https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/virtualenv/PYSEC-2026-4014.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/virtualenv"},{"type":"WEB","url":"https://github.com/pypa/virtualenv/releases/tag/21.7.12"},{"type":"PACKAGE","url":"https://pypi.org/project/virtualenv"}],"versionKeys":["pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-xcgm-r5h9-7989","slug":"ghsa-xcgm-r5h9-7989-77bcbc26","dossier":false,"summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits","aliases":["CVE-2026-54274","PYSEC-2026-2108"],"sourceIds":["GHSA-xcgm-r5h9-7989","PYSEC-2026-2108"],"published":"2026-06-15T20:11:22Z","modified":"2026-09-10T03:50:12.346397944Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-xcq7-p3pf-p88h","slug":"ghsa-xcq7-p3pf-p88h-7e00dc8e","dossier":false,"summary":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","aliases":["CVE-2026-114603"],"sourceIds":["GHSA-xcq7-p3pf-p88h"],"published":"2026-10-22T16:22:07Z","modified":"2026-10-22T16:30:40.999595074Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5749"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-python"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"}],"versionKeys":["pypi:opentelemetry-api@1.25.0","pypi:opentelemetry-api@1.26.0","pypi:opentelemetry-api@1.28.2","pypi:opentelemetry-api@1.34.1","pypi:opentelemetry-api@1.36.0","pypi:opentelemetry-api@1.38.0","pypi:opentelemetry-api@1.39.1","pypi:opentelemetry-api@1.43.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-xg8h-j46f-w952","slug":"ghsa-xg8h-j46f-w952-da36a616","dossier":false,"summary":"Pillow vulnerability can cause write buffer overflow on BCn encoding","aliases":["BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61"],"sourceIds":["GHSA-xg8h-j46f-w952","PYSEC-2025-61"],"published":"2025-07-01T17:29:37Z","modified":"2026-09-10T03:50:26.431657121Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9041"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/11.3.0"}],"versionKeys":["pypi:pillow@11.2.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-xgh8-jp6q-p5x8","slug":"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","dossier":false,"summary":"Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes","aliases":["BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335"],"sourceIds":["GHSA-xgh8-jp6q-p5x8","PYSEC-2026-4335"],"published":"2026-10-19T22:17:10.293Z","modified":"2026-10-28T11:10:55.647541842Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112901"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-xgmm-8j9v-c9wx","slug":"ghsa-xgmm-8j9v-c9wx-bc6db7ad","dossier":false,"summary":"PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed","aliases":["CVE-2026-48526","PYSEC-2026-179"],"sourceIds":["GHSA-xgmm-8j9v-c9wx","PYSEC-2026-179"],"published":"2026-05-28T16:16:29.657Z","modified":"2026-09-10T03:51:09.678127621Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48526"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyjwt/PYSEC-2026-179.yaml"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-xhjh-pmcv-23jw","slug":"ghsa-xhjh-pmcv-23jw-575003a0","dossier":false,"summary":"Axios: Null Byte Injection via Reverse-Encoding in AxiosURLSearchParams","aliases":["CVE-2026-42040"],"sourceIds":["GHSA-xhjh-pmcv-23jw"],"published":"2026-05-05T00:18:03Z","modified":"2026-09-10T03:50:48.032269033Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-xhjh-pmcv-23jw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42040"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-xhq7-xmqj-769h","slug":"ghsa-xhq7-xmqj-769h-0a50f1d8","dossier":false,"summary":"fast-uri vulnerable to improper path equivalence in relative reference normalization","aliases":["CVE-2026-110095"],"sourceIds":["GHSA-xhq7-xmqj-769h"],"published":"2026-10-23T21:39:34Z","modified":"2026-10-23T21:45:04.902389903Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110095"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/048bbd0a252971be86d6579f0dfc87f8de5b9c47"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/52774a5c35df36b0bbe439cd4c12c3dc0e50e3b9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/7c19f8b97ec51f1f20b4e3d9d5820cb8d5176058"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/9eb8759a9825c046f57f7f695f1944bc39b88abd"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/acc5c5d60c4209571789496e1732468911c7e12a"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/commit/b110a3571c37dfcf9d1c72ce2e2e178c78d1a424"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/fastify/fast-uri"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v2.4.8"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v3.1.9"},{"type":"WEB","url":"https://github.com/fastify/fast-uri/releases/tag/v4.2.3"}],"versionKeys":["npm:fast-uri@3.1.8"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-xj96-63gp-2gmr","slug":"ghsa-xj96-63gp-2gmr-85e1cf15","dossier":false,"summary":"Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`","aliases":["BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454"],"sourceIds":["GHSA-xj96-63gp-2gmr","PYSEC-2026-3454"],"published":"2026-07-14T17:17:14.487Z","modified":"2026-09-10T03:50:53.192759645Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9695"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-xjj6-f33q-929c","slug":"ghsa-xjj6-f33q-929c-e46b746e","dossier":false,"summary":"undici vulnerable to Denial of Service via unhandled error on excessive content-encodings","aliases":["CVE-2026-109869"],"sourceIds":["GHSA-xjj6-f33q-929c"],"published":"2026-10-23T22:14:31Z","modified":"2026-10-23T22:30:05.007687918Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109869"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/07ded4941b1e72afec862958c3b8ddf468f3b429"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/1325a87dfb3492f8e87e6b0a84b3bda4e82e3436"},{"type":"WEB","url":"https://github.com/nodejs/undici/commit/b5084c7dc239172d75c336b1cd51ddac023938a5"},{"type":"WEB","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"PACKAGE","url":"https://github.com/nodejs/undici"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v6.29.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v7.30.1"},{"type":"WEB","url":"https://github.com/nodejs/undici/releases/tag/v8.12.2"}],"versionKeys":["npm:undici@7.18.2","npm:undici@7.29.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-xvh5-g6gv-559v","slug":"ghsa-xvh5-g6gv-559v-e12340aa","dossier":false,"summary":"Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags","aliases":["CVE-2026-112902","PYSEC-2026-4363"],"sourceIds":["GHSA-xvh5-g6gv-559v","PYSEC-2026-4363"],"published":"2026-10-21T21:29:16Z","modified":"2026-11-11T10:20:03.066593346Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112902"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/10903"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/10227"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-xwg4-73v4-xw9w","slug":"ghsa-xwg4-73v4-xw9w-e114930d","dossier":false,"summary":"nanoid: Integer Overflow or Wraparound","aliases":["CVE-2026-73086"],"sourceIds":["GHSA-xwg4-73v4-xw9w"],"published":"2026-09-01T19:23:45Z","modified":"2026-09-01T19:30:08.615560716Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73086"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3"},{"type":"WEB","url":"https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac"},{"type":"PACKAGE","url":"https://github.com/ai/nanoid"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/3.3.12"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/5.1.11"}],"versionKeys":["npm:nanoid@3.3.11"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-xx6v-rp6x-q39c","slug":"ghsa-xx6v-rp6x-q39c-44625a35","dossier":false,"summary":"Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion","aliases":["CVE-2026-42042"],"sourceIds":["GHSA-xx6v-rp6x-q39c"],"published":"2026-05-05T00:25:22Z","modified":"2026-09-10T03:51:07.425895085Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/axios/axios/security/advisories/GHSA-xx6v-rp6x-q39c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42042"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"versionKeys":["npm:axios@1.11.0","npm:axios@1.13.2"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-183","slug":"pysec-2025-183-08217171","dossier":false,"summary":null,"aliases":["CVE-2025-45768"],"sourceIds":["PYSEC-2025-183"],"published":"2025-07-31T21:15:27.320Z","modified":"2026-05-21T15:00:28.178881228Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/jpadilla"},{"type":"REPORT","url":"https://gist.github.com/ZupeiNie/6f65e564f2067b876321d3dfdbb76569"},{"type":"PACKAGE","url":"https://github.com/jpadilla/pyjwt"}],"versionKeys":["pypi:pyjwt@2.10.1","pypi:pyjwt@2.9.0"],"packageCount":1,"repositoryCount":3}]}}