{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-11-12T08:58:58.139Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-11-12T08:57:16.613Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.29.0","releaseDate":"2026-09-16T00:00:00Z"}},"coverage":{"repositoryCount":49,"completeTreeCount":48,"incompleteTreeCount":1,"lockfileRepositoryCount":29,"sbomRepositoryCount":6,"artifactRepositoryCount":33,"resolvedRepositoryCount":45,"resolvedArtifactRepositoryCount":33,"dependencyFileCount":47,"parsedFileCount":46,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":5071,"metadataResolvedCount":5059,"metadataNotFoundCount":12,"osvEvaluatedVersionCount":5071,"codeRadarRepositoryCount":49},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":8000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":49,"packageCount":2865,"aiPackageCount":51,"resolvedComponentCount":9911,"resolvedVersionCount":5071,"providerExposureRepositoryCount":12,"licenseExpressionCount":63,"knownLicensePackageCount":2827,"unknownLicensePackageCount":38,"advisoryCount":1097,"matchedAdvisoryRepositoryCount":43,"topPackage":{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","label":"typing-extensions","repositoryCount":29,"repositoryShare":0.5918367346938775}},"kind":"repository","entity":{"id":"opencode:13669","slug":"opencode-13669","gitlabProjectId":13669,"name":"sprache2text+meer - Transkription für Jugendamt Verwaltung","pathWithNamespace":"sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain","description":"aTrain transkribiert Sprachaufnahmen KI-gestützt und vollständig lokal, ohne Daten ins Internet zu übertragen. Im Projekt sprache2text+mehr wird die Software für die Anforderungen der Jugendhilfe optimiert und in die IT-Systeme der Stadt Kiel eingebunden, um Arbeitsabläufe zu vereinfachen und Dokumentationszeiten zu verkürzen.\n\n**Dies hier ist nur ein Mirror.**\n\nDie Entwicklung/Community Betreuung findet im [Upstream-Repo](https://github.com/aTrainTranscription/aTrain) statt. Bitte wenden Sie sich bei Fragen zur Software an die Entwickelnden dort.\n\nDie Weiterentwicklung dieser Software wurde im Rahmen des Landesprogramm Offene Innovation 2025 finanziert.","webUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain","commitSha":"b7e00d45e2847bc5089719cb636f5d2215ba9734","commitUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain/-/commit/b7e00d45e2847bc5089719cb636f5d2215ba9734","lastActivityAt":"2026-11-11T01:07:23.599Z","headCommittedAt":"2026-11-10T15:06:04.000Z","tree":{"complete":true,"entryCount":249,"truncated":false},"files":[{"path":"uv.lock","kind":"uv-lock","blobSha":"947a2c691d6f8be1e34d18f292b8c5f0fbc5ac95","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain/-/blob/b7e00d45e2847bc5089719cb636f5d2215ba9734/uv.lock","commitSha":"b7e00d45e2847bc5089719cb636f5d2215ba9734","contentSha256":"1da651709584b4d2b50ab044e77786ba026536343299e6572990ead0829c6375","byteCount":949077,"state":"parsed","componentCount":203}],"resolvedComponentCount":206,"artifactResolvedComponentCount":203,"exactManifestPinCount":3,"packageCount":202,"ecosystems":["pypi"],"aiPackageCount":6,"licenseExpressionCount":26,"unknownLicensePackageCount":9,"advisoryIds":["GHSA-22hg-r758-rrw9","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-29pf-2h5f-8g72","GHSA-29vq-49wr-vm6x","GHSA-2c2j-9gv5-cj73","GHSA-2fqr-mr3j-6wp8","GHSA-2g68-c3qc-8985","GHSA-2g87-pp6c-29x5","GHSA-2h4p-vjrc-8xpq","GHSA-2vrm-gr82-f7m5","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3j72-p6qg-6xp7","GHSA-3wq7-rqq7-wx6j","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-494j-54xm-rwp3","GHSA-4fvr-rgm6-gqmc","GHSA-4j2p-28q2-5m79","GHSA-4m7w-qmgq-4wj5","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-4xh5-x5gv-qwph","GHSA-5239-wwwm-4pmq","GHSA-53q9-r3pm-6pq6","GHSA-54jq-c3m8-4m76","GHSA-54p9-h82j-f925","GHSA-5639-2j2p-m4mx","GHSA-567q-5qvw-pf92","GHSA-58qw-9mgm-455v","GHSA-58r4-6rv3-gfh8","GHSA-59g5-xgcq-4qw3","GHSA-59p9-h35m-wg4g","GHSA-5p39-cfhj-2xmp","GHSA-5rjg-fvgr-3xxf","GHSA-5rvq-cxj2-64vf","GHSA-5w7q-77mv-v69f","GHSA-5wr8-gcqf-gqf3","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-63hf-3vf5-4wqf","GHSA-63hw-fmq6-xxg2","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69f9-5gxw-wvc2","GHSA-69hj-f68j-2879","GHSA-69w3-r845-3855","GHSA-6cjc-53gc-5rqm","GHSA-6jhg-hg63-jvvf","GHSA-6jv3-5f52-599m","GHSA-6mq8-rvhq-8wgg","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-6v7p-g79w-8964","GHSA-6vgw-5pg2-w6jp","GHSA-74r2-7ff9-mjj2","GHSA-768j-98cg-p3fv","GHSA-78g4-xqwv-q3g8","GHSA-7f5h-v6xp-fcq8","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-82r6-8w77-94w6","GHSA-82w8-qh3p-5jfq","GHSA-86qp-5c8j-p5mr","GHSA-87hc-h4r5-73f7","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-9548-qrrj-x5pj","GHSA-966j-vmvw-g2g9","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-9x8q-7h8h-wcw9","GHSA-9xw5-w5jj-pvcg","GHSA-c427-h43c-vf67","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-cfh3-3jmp-rvhc","GHSA-cgwc-pv48-fhj5","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cq5v-8q36-5273","GHSA-cwqr-hh33-gh44","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f96h-pmfr-66vw","GHSA-f9vj-2wh5-fj8j","GHSA-f9xw-jh8m-3mwq","GHSA-fc9g-5qg7-mf45","GHSA-fgcw-684q-jj6r","GHSA-fh55-r93g-j68g","GHSA-fj7v-r99m-22gq","GHSA-fpwr-67px-3qhx","GHSA-fq56-3cx3-fjxp","GHSA-g3cq-j2xw-wf74","GHSA-g4qv-2jxx-769h","GHSA-g6x2-hccm-hh4m","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-g84x-mcqj-x9qq","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gx76-c99x-2c96","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hcc4-c3v8-rx92","GHSA-hg6j-4rv6-33pg","GHSA-hgf8-39gv-g3f2","GHSA-hpj7-wq8m-9hgp","GHSA-hx9q-6w63-j58v","GHSA-hxxf-235m-72v3","GHSA-j4m9-6w36-pw47","GHSA-j586-36cw-2gc2","GHSA-j8f7-rjxc-mr56","GHSA-jg22-mg44-37j8","GHSA-jg86-v3jv-hrpm","GHSA-jj3x-wxrx-4x23","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jp4c-xjxw-mgf9","GHSA-jp82-jpqv-5vv3","GHSA-jw8x-6495-233v","GHSA-m5qp-6w8w-w647","GHSA-m6qw-4cw2-hm4m","GHSA-m9gh-vj53-gvh9","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mfx4-hv73-q22v","GHSA-mj87-hwqh-73pj","GHSA-mq26-g339-26xf","GHSA-mq44-7p77-q5h7","GHSA-mqqc-3gqh-h2x8","GHSA-mrfp-p49p-3hf2","GHSA-mwh4-6h8g-pg8w","GHSA-p4wg-p73j-c528","GHSA-p8hx-v2p6-rp84","GHSA-p998-jp59-783m","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pp6c-gr5w-3c5g","GHSA-pq67-6m6q-mj2v","GHSA-pqxq-w44r-73xw","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-q34m-jh98-gwm2","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qqmf-gpg7-g8gw","GHSA-qwm4-qh6w-59xr","GHSA-qxrp-vhvm-j765","GHSA-r73j-pqj5-w3x7","GHSA-rcv9-qm8p-9p6j","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rrmf-rvhw-rf47","GHSA-v4x8-3wr5-3wq8","GHSA-v92g-xgxw-vvmm","GHSA-v9pg-7xvm-68hf","GHSA-v9pv-5gc8-w2m6","GHSA-vffw-93wf-4j4q","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w2fm-2cpv-w7v5","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-wf93-45jw-7689","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wp53-j4wj-2cfg","GHSA-wqp7-x3pw-xc5r","GHSA-wrfc-pvp9-mr9g","GHSA-x3gm-94wq-g975","GHSA-x746-7m8f-x49c","GHSA-x9r9-c232-4q39","GHSA-xcgm-r5h9-7989","GHSA-xcq7-p3pf-p88h","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xrqw-3rrv-vx5w","GHSA-xvh5-g6gv-559v","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139"],"advisoryCount":241,"providers":[{"id":"hugging-face","label":"Hugging Face"}]},"evidence":{"files":[{"path":"pyproject.toml","kind":"exact-manifest-pin","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain/-/blob/b7e00d45e2847bc5089719cb636f5d2215ba9734/pyproject.toml","commitSha":"b7e00d45e2847bc5089719cb636f5d2215ba9734","blobSha":"afd5f5d9bcc3035294b3138dec63ca6290c89802","state":"parsed","componentCount":3},{"path":"uv.lock","kind":"uv-lock","blobSha":"947a2c691d6f8be1e34d18f292b8c5f0fbc5ac95","sourceUrl":"https://gitlab.opencode.de/sh/digitalhub-sh/landesprogramm-offene-innovationen/aTrain/-/blob/b7e00d45e2847bc5089719cb636f5d2215ba9734/uv.lock","commitSha":"b7e00d45e2847bc5089719cb636f5d2215ba9734","contentSha256":"1da651709584b4d2b50ab044e77786ba026536343299e6572990ead0829c6375","byteCount":949077,"state":"parsed","componentCount":203}],"occurrenceCount":206},"related":{"packages":[{"id":"package:pypi:transformers","slug":"transformers-65289303","identity":"pypi:transformers","label":"Transformers","aiRelevant":true,"provider":{"id":"hugging-face","label":"Hugging Face"},"advisoryCount":27,"licenseExpressions":["Apache-2.0"],"versions":["5.22.0"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["pyproject.toml","uv.lock"]},{"id":"package:pypi:torch","slug":"torch-47a5352a","identity":"pypi:torch","label":"PyTorch","aiRelevant":true,"provider":null,"advisoryCount":23,"licenseExpressions":["BSD-3-Clause"],"versions":["2.9.1","2.9.1+cu128"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["pyproject.toml","uv.lock"]},{"id":"package:pypi:accelerate","slug":"accelerate-7fac5dd9","identity":"pypi:accelerate","label":"Accelerate","aiRelevant":true,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["1.15.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:scikit-learn","slug":"scikit-learn-ab0941d9","identity":"pypi:scikit-learn","label":"scikit-learn","aiRelevant":true,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["1.9.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:faster-whisper","slug":"faster-whisper-edb11692","identity":"pypi:faster-whisper","label":"faster-whisper","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.1"],"dossier":true,"occurrenceCount":2,"directOccurrenceCount":1,"evidenceFiles":["pyproject.toml","uv.lock"]},{"id":"package:pypi:tokenizers","slug":"tokenizers-7ba00902","identity":"pypi:tokenizers","label":"Hugging Face Tokenizers","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.23.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pillow","slug":"pillow-834347dd","identity":"pypi:pillow","label":"pillow","aiRelevant":false,"provider":null,"advisoryCount":61,"licenseExpressions":["HPND","MIT-CMU"],"versions":["13.0.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:aiohttp","slug":"aiohttp-5a806a63","identity":"pypi:aiohttp","label":"aiohttp","aiRelevant":false,"provider":null,"advisoryCount":41,"licenseExpressions":["Apache-2.0","Apache-2.0 AND MIT"],"versions":["3.14.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:filelock","slug":"filelock-b1c63968","identity":"pypi:filelock","label":"filelock","aiRelevant":false,"provider":null,"advisoryCount":11,"licenseExpressions":["MIT","Unlicense"],"versions":["3.29.4"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:urllib3","slug":"urllib3-fa68f32c","identity":"pypi:urllib3","label":"urllib3","aiRelevant":false,"provider":null,"advisoryCount":10,"licenseExpressions":["MIT"],"versions":["2.7.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-multipart","slug":"python-multipart-7d2a810e","identity":"pypi:python-multipart","label":"python-multipart","aiRelevant":false,"provider":null,"advisoryCount":8,"licenseExpressions":["Apache-2.0"],"versions":["0.0.32"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:starlette","slug":"starlette-beb9e527","identity":"pypi:starlette","label":"starlette","aiRelevant":false,"provider":null,"advisoryCount":8,"licenseExpressions":["BSD-3-Clause"],"versions":["1.3.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pip","slug":"pip-2911c768","identity":"pypi:pip","label":"pip","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["MIT"],"versions":["26.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:werkzeug","slug":"werkzeug-b18d5b02","identity":"pypi:werkzeug","label":"werkzeug","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.9"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jinja2","slug":"jinja2-f7d34747","identity":"pypi:jinja2","label":"jinja2","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.6"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:setuptools","slug":"setuptools-fe37c31a","identity":"pypi:setuptools","label":"setuptools","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["MIT"],"versions":["82.0.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mako","slug":"mako-ed406373","identity":"pypi:mako","label":"mako","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["1.3.12"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:requests","slug":"requests-53653f76","identity":"pypi:requests","label":"requests","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["Apache-2.0"],"versions":["2.34.2"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:anyio","slug":"anyio-399e5280","identity":"pypi:anyio","label":"anyio","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["4.14.2"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:certifi","slug":"certifi-d4f0c37e","identity":"pypi:certifi","label":"certifi","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MPL-2.0"],"versions":["2026.10.19"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:msgpack","slug":"msgpack-007a8d3b","identity":"pypi:msgpack","label":"msgpack","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["Apache-2.0"],"versions":["1.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:protobuf","slug":"protobuf-6e30009a","identity":"pypi:protobuf","label":"protobuf","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["BSD-3-Clause"],"versions":["7.35.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-engineio","slug":"python-engineio-a8408602","identity":"pypi:python-engineio","label":"python-engineio","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["MIT"],"versions":["4.13.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:fonttools","slug":"fonttools-d2488ea8","identity":"pypi:fonttools","label":"fonttools","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.63.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:fsspec","slug":"fsspec-b1a7c311","identity":"pypi:fsspec","label":"fsspec","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["2026.6.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:h11","slug":"h11-48165ab1","identity":"pypi:h11","label":"h11","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["0.16.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:idna","slug":"idna-994c9929","identity":"pypi:idna","label":"idna","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.18"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:lightning","slug":"lightning-28a5cccb","identity":"pypi:lightning","label":"lightning","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["2.6.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:multidict","slug":"multidict-b407a4ac","identity":"pypi:multidict","label":"multidict","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["6.9.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-api","slug":"opentelemetry-api-341bc8f7","identity":"pypi:opentelemetry-api","label":"opentelemetry-api","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:orjson","slug":"orjson-0293c856","identity":"pypi:orjson","label":"orjson","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0 OR MIT","MPL-2.0 AND (Apache-2.0 OR MIT)"],"versions":["3.11.9"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pygments","slug":"pygments-ad71bc11","identity":"pypi:pygments","label":"pygments","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-2-Clause"],"versions":["2.20.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-dotenv","slug":"python-dotenv-27b12285","identity":"pypi:python-dotenv","label":"python-dotenv","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["1.2.2"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-socketio","slug":"python-socketio-6960be7a","identity":"pypi:python-socketio","label":"python-socketio","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["5.16.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytorch-lightning","slug":"pytorch-lightning-1550c03a","identity":"pypi:pytorch-lightning","label":"pytorch-lightning","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["Apache-2.0"],"versions":["2.6.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tqdm","slug":"tqdm-04b01f90","identity":"pypi:tqdm","label":"tqdm","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT AND MPL-2.0"],"versions":["4.68.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:aiofiles","slug":"aiofiles-41b094bb","identity":"pypi:aiofiles","label":"aiofiles","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["25.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:aiohappyeyeballs","slug":"aiohappyeyeballs-ea4657b8","identity":"pypi:aiohappyeyeballs","label":"aiohappyeyeballs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0"],"versions":["2.6.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:aiosignal","slug":"aiosignal-b6794e75","identity":"pypi:aiosignal","label":"aiosignal","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:alembic","slug":"alembic-662caf9d","identity":"pypi:alembic","label":"alembic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.18.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:annotated-doc","slug":"annotated-doc-9568e1af","identity":"pypi:annotated-doc","label":"annotated-doc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.0.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:annotated-types","slug":"annotated-types-2304c38b","identity":"pypi:annotated-types","label":"annotated-types","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.7.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:asteroid-filterbanks","slug":"asteroid-filterbanks-012ae487","identity":"pypi:asteroid-filterbanks","label":"asteroid-filterbanks","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:attrs","slug":"attrs-2e7954ac","identity":"pypi:attrs","label":"attrs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["26.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:av","slug":"av-62c498c6","identity":"pypi:av","label":"av","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["18.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:bandit","slug":"bandit-b6566895","identity":"pypi:bandit","label":"bandit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.9.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:bidict","slug":"bidict-d2d69f19","identity":"pypi:bidict","label":"bidict","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MPL-2.0"],"versions":["0.23.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:boolean-py","slug":"boolean-py-d2700117","identity":"pypi:boolean-py","label":"boolean-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:bottle","slug":"bottle-d11915f9","identity":"pypi:bottle","label":"bottle","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.13.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cachecontrol","slug":"cachecontrol-f48df14f","identity":"pypi:cachecontrol","label":"cachecontrol","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["0.14.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cffi","slug":"cffi-38e65d3e","identity":"pypi:cffi","label":"cffi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","MIT-0"],"versions":["2.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:charset-normalizer","slug":"charset-normalizer-74ccb20a","identity":"pypi:charset-normalizer","label":"charset-normalizer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.4.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:click","slug":"click-ef97f731","identity":"pypi:click","label":"click","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["8.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cloudpickle","slug":"cloudpickle-12e9c0d7","identity":"pypi:cloudpickle","label":"cloudpickle","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:clr-loader","slug":"clr-loader-839f2a74","identity":"pypi:clr-loader","label":"clr-loader","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["0.3.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:colorama","slug":"colorama-abaf57c3","identity":"pypi:colorama","label":"colorama","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.4.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:colorlog","slug":"colorlog-a388001c","identity":"pypi:colorlog","label":"colorlog","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.10.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:contourpy","slug":"contourpy-f86f9e10","identity":"pypi:contourpy","label":"contourpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.3.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:crisperwhisper","slug":"crisperwhisper-d3b6821a","identity":"pypi:crisperwhisper","label":"crisperwhisper","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ctranslate2","slug":"ctranslate2-bb8ef47b","identity":"pypi:ctranslate2","label":"ctranslate2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cycler","slug":"cycler-3e14883d","identity":"pypi:cycler","label":"cycler","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.12.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:cyclonedx-python-lib","slug":"cyclonedx-python-lib-af6d232b","identity":"pypi:cyclonedx-python-lib","label":"cyclonedx-python-lib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["11.11.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:dask","slug":"dask-c6d8c0b4","identity":"pypi:dask","label":"dask","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2026.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:defusedxml","slug":"defusedxml-fab5db42","identity":"pypi:defusedxml","label":"defusedxml","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.7.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:docutils","slug":"docutils-cc2f8622","identity":"pypi:docutils","label":"docutils","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.23"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:einops","slug":"einops-248eadc2","identity":"pypi:einops","label":"einops","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:fastapi","slug":"fastapi-e52fd482","identity":"pypi:fastapi","label":"fastapi","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.138.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:flatbuffers","slug":"flatbuffers-90c67795","identity":"pypi:flatbuffers","label":"flatbuffers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["25.12.19"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:frozenlist","slug":"frozenlist-110237da","identity":"pypi:frozenlist","label":"frozenlist","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:googleapis-common-protos","slug":"googleapis-common-protos-d5ca3481","identity":"pypi:googleapis-common-protos","label":"googleapis-common-protos","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.75.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:greenlet","slug":"greenlet-cd6f7934","identity":"pypi:greenlet","label":"greenlet","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT","MIT AND PSF-2.0","MIT AND Python-2.0"],"versions":["3.5.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:grpcio","slug":"grpcio-40fa763c","identity":"pypi:grpcio","label":"grpcio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.81.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:hf-xet","slug":"hf-xet-732ec6c8","identity":"pypi:hf-xet","label":"hf-xet","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:httpcore","slug":"httpcore-ba6ae671","identity":"pypi:httpcore","label":"httpcore","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.0.9"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:httptools","slug":"httptools-b6cca685","identity":"pypi:httptools","label":"httptools","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:httpx","slug":"httpx-a512a166","identity":"pypi:httpx","label":"httpx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.28.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:huggingface-hub","slug":"huggingface-hub-443ec6ef","identity":"pypi:huggingface-hub","label":"huggingface-hub","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.33.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ifaddr","slug":"ifaddr-814125b6","identity":"pypi:ifaddr","label":"ifaddr","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:importlib-metadata","slug":"importlib-metadata-a3dfda3c","identity":"pypi:importlib-metadata","label":"importlib-metadata","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["9.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:itsdangerous","slug":"itsdangerous-4af70837","identity":"pypi:itsdangerous","label":"itsdangerous","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jeepney","slug":"jeepney-898410ff","identity":"pypi:jeepney","label":"jeepney","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:jiwer","slug":"jiwer-722f6674","identity":"pypi:jiwer","label":"jiwer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["4.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:joblib","slug":"joblib-8cbb7872","identity":"pypi:joblib","label":"joblib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.5.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:julius","slug":"julius-2c17d8d2","identity":"pypi:julius","label":"julius","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.2.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:kiwisolver","slug":"kiwisolver-41b47c33","identity":"pypi:kiwisolver","label":"kiwisolver","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:license-expression","slug":"license-expression-66cbb677","identity":"pypi:license-expression","label":"license-expression","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["30.4.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:lightning-utilities","slug":"lightning-utilities-46646cd2","identity":"pypi:lightning-utilities","label":"lightning-utilities","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.15.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:locket","slug":"locket-f0905b94","identity":"pypi:locket","label":"locket","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:markdown-it-py","slug":"markdown-it-py-27073f5e","identity":"pypi:markdown-it-py","label":"markdown-it-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:markdown2","slug":"markdown2-6999cefd","identity":"pypi:markdown2","label":"markdown2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.5.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:markupsafe","slug":"markupsafe-1bdd4c7f","identity":"pypi:markupsafe","label":"markupsafe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:matplotlib","slug":"matplotlib-9dc72309","identity":"pypi:matplotlib","label":"matplotlib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["3.11.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mdurl","slug":"mdurl-e6f5f075","identity":"pypi:mdurl","label":"mdurl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:mpmath","slug":"mpmath-4ccb7a41","identity":"pypi:mpmath","label":"mpmath","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:narwhals","slug":"narwhals-24e2f721","identity":"pypi:narwhals","label":"narwhals","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.22.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:networkx","slug":"networkx-c2336a8d","identity":"pypi:networkx","label":"networkx","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.6.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nicegui","slug":"nicegui-0dcd6652","identity":"pypi:nicegui","label":"nicegui","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.18.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:numpy","slug":"numpy-ba79b98d","identity":"pypi:numpy","label":"numpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib","non-standard"],"versions":["2.4.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cublas-cu12","slug":"nvidia-cublas-cu12-1d052261","identity":"pypi:nvidia-cublas-cu12","label":"nvidia-cublas-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-cupti-cu12","slug":"nvidia-cuda-cupti-cu12-973480f1","identity":"pypi:nvidia-cuda-cupti-cu12","label":"nvidia-cuda-cupti-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.90"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-nvrtc-cu12","slug":"nvidia-cuda-nvrtc-cu12-e32b7f38","identity":"pypi:nvidia-cuda-nvrtc-cu12","label":"nvidia-cuda-nvrtc-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.93"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cuda-runtime-cu12","slug":"nvidia-cuda-runtime-cu12-2b875d2a","identity":"pypi:nvidia-cuda-runtime-cu12","label":"nvidia-cuda-runtime-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.90"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cudnn-cu12","slug":"nvidia-cudnn-cu12-a21dce6d","identity":"pypi:nvidia-cudnn-cu12","label":"nvidia-cudnn-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["9.10.2.21"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cufft-cu12","slug":"nvidia-cufft-cu12-21ff54dd","identity":"pypi:nvidia-cufft-cu12","label":"nvidia-cufft-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.3.3.83"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cufile-cu12","slug":"nvidia-cufile-cu12-14048140","identity":"pypi:nvidia-cufile-cu12","label":"nvidia-cufile-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.13.1.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-curand-cu12","slug":"nvidia-curand-cu12-2fed778b","identity":"pypi:nvidia-curand-cu12","label":"nvidia-curand-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["10.3.9.90"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusolver-cu12","slug":"nvidia-cusolver-cu12-7db0a33a","identity":"pypi:nvidia-cusolver-cu12","label":"nvidia-cusolver-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.7.3.90"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusparse-cu12","slug":"nvidia-cusparse-cu12-d7e6a309","identity":"pypi:nvidia-cusparse-cu12","label":"nvidia-cusparse-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.8.93"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-cusparselt-cu12","slug":"nvidia-cusparselt-cu12-97587f50","identity":"pypi:nvidia-cusparselt-cu12","label":"nvidia-cusparselt-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.7.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nccl-cu12","slug":"nvidia-nccl-cu12-90361558","identity":"pypi:nvidia-nccl-cu12","label":"nvidia-nccl-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["2.27.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nvjitlink-cu12","slug":"nvidia-nvjitlink-cu12-6d08af75","identity":"pypi:nvidia-nvjitlink-cu12","label":"nvidia-nvjitlink-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.8.93"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nvshmem-cu12","slug":"nvidia-nvshmem-cu12-d7141303","identity":"pypi:nvidia-nvshmem-cu12","label":"nvidia-nvshmem-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.3.20"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:nvidia-nvtx-cu12","slug":"nvidia-nvtx-cu12-9a2d0378","identity":"pypi:nvidia-nvtx-cu12","label":"nvidia-nvtx-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","non-standard"],"versions":["12.8.90"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:onnxruntime","slug":"onnxruntime-5acdb617","identity":"pypi:onnxruntime","label":"onnxruntime","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.27.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp","slug":"opentelemetry-exporter-otlp-b1d3676e","identity":"pypi:opentelemetry-exporter-otlp","label":"opentelemetry-exporter-otlp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-proto-common","slug":"opentelemetry-exporter-otlp-proto-common-636ba371","identity":"pypi:opentelemetry-exporter-otlp-proto-common","label":"opentelemetry-exporter-otlp-proto-common","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-proto-grpc","slug":"opentelemetry-exporter-otlp-proto-grpc-c102a976","identity":"pypi:opentelemetry-exporter-otlp-proto-grpc","label":"opentelemetry-exporter-otlp-proto-grpc","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-exporter-otlp-proto-http","slug":"opentelemetry-exporter-otlp-proto-http-6f55af01","identity":"pypi:opentelemetry-exporter-otlp-proto-http","label":"opentelemetry-exporter-otlp-proto-http","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-proto","slug":"opentelemetry-proto-f15a3372","identity":"pypi:opentelemetry-proto","label":"opentelemetry-proto","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-sdk","slug":"opentelemetry-sdk-38b86085","identity":"pypi:opentelemetry-sdk","label":"opentelemetry-sdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.43.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:opentelemetry-semantic-conventions","slug":"opentelemetry-semantic-conventions-15f3be17","identity":"pypi:opentelemetry-semantic-conventions","label":"opentelemetry-semantic-conventions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.64b0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:optuna","slug":"optuna-5cb30128","identity":"pypi:optuna","label":"optuna","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:packageurl-python","slug":"packageurl-python-dc3afccd","identity":"pypi:packageurl-python","label":"packageurl-python","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.17.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:packaging","slug":"packaging-78ee1f47","identity":"pypi:packaging","label":"packaging","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 OR BSD-2-Clause","non-standard"],"versions":["26.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pandas","slug":"pandas-e8d52445","identity":"pypi:pandas","label":"pandas","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:partd","slug":"partd-64327513","identity":"pypi:partd","label":"partd","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pip-api","slug":"pip-api-5919fa1d","identity":"pypi:pip-api","label":"pip-api","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.0.34"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pip-audit","slug":"pip-audit-8a38ba34","identity":"pypi:pip-audit","label":"pip-audit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.10.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pip-requirements-parser","slug":"pip-requirements-parser-3a4c3c44","identity":"pypi:pip-requirements-parser","label":"pip-requirements-parser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["32.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:platformdirs","slug":"platformdirs-e64002f0","identity":"pypi:platformdirs","label":"platformdirs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.14.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:primepy","slug":"primepy-a6cda261","identity":"pypi:primepy","label":"primepy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:propcache","slug":"propcache-1fcd6be4","identity":"pypi:propcache","label":"propcache","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.5.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:proxy-tools","slug":"proxy-tools-e07ef332","identity":"pypi:proxy-tools","label":"proxy-tools","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:psutil","slug":"psutil-840b9a74","identity":"pypi:psutil","label":"psutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["7.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:py-serializable","slug":"py-serializable-cebfca90","identity":"pypi:py-serializable","label":"py-serializable","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannote-audio","slug":"pyannote-audio-3ee3db31","identity":"pypi:pyannote-audio","label":"pyannote-audio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["4.0.7"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannote-core","slug":"pyannote-core-38057ad5","identity":"pypi:pyannote-core","label":"pyannote-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["6.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannote-database","slug":"pyannote-database-ba711eec","identity":"pypi:pyannote-database","label":"pyannote-database","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["6.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannote-metrics","slug":"pyannote-metrics-089b5533","identity":"pypi:pyannote-metrics","label":"pyannote-metrics","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannote-pipeline","slug":"pyannote-pipeline-502241b6","identity":"pypi:pyannote-pipeline","label":"pyannote-pipeline","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["4.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyannoteai-sdk","slug":"pyannoteai-sdk-93f4a941","identity":"pypi:pyannoteai-sdk","label":"pyannoteai-sdk","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["0.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pycairo","slug":"pycairo-dec4e123","identity":"pypi:pycairo","label":"pycairo","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.1-only OR MPL-1.1"],"versions":["1.29.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pycparser","slug":"pycparser-102d9d3e","identity":"pypi:pycparser","label":"pycparser","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pydantic","slug":"pydantic-4ac148ca","identity":"pypi:pydantic","label":"pydantic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.13.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pydantic-core","slug":"pydantic-core-f9814ebc","identity":"pypi:pydantic-core","label":"pydantic-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.46.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pygobject","slug":"pygobject-b7331567","identity":"pypi:pygobject","label":"pygobject","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.0-or-later"],"versions":["3.50.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pygobject-stubs","slug":"pygobject-stubs-770d6f2f","identity":"pypi:pygobject-stubs","label":"pygobject-stubs","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.1"],"versions":["2.16.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-core","slug":"pyobjc-core-adc05bb4","identity":"pypi:pyobjc-core","label":"pyobjc-core","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-framework-cocoa","slug":"pyobjc-framework-cocoa-8e347170","identity":"pypi:pyobjc-framework-cocoa","label":"pyobjc-framework-cocoa","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-framework-quartz","slug":"pyobjc-framework-quartz-6a98fc9b","identity":"pypi:pyobjc-framework-quartz","label":"pyobjc-framework-quartz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-framework-security","slug":"pyobjc-framework-security-fe9a4ff0","identity":"pypi:pyobjc-framework-security","label":"pyobjc-framework-security","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-framework-uniformtypeidentifiers","slug":"pyobjc-framework-uniformtypeidentifiers-cf1b4c2f","identity":"pypi:pyobjc-framework-uniformtypeidentifiers","label":"pyobjc-framework-uniformtypeidentifiers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyobjc-framework-webkit","slug":"pyobjc-framework-webkit-112152ab","identity":"pypi:pyobjc-framework-webkit","label":"pyobjc-framework-webkit","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["12.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyparsing","slug":"pyparsing-a28b9b62","identity":"pypi:pyparsing","label":"pyparsing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:python-dateutil","slug":"python-dateutil-8eac96b7","identity":"pypi:python-dateutil","label":"python-dateutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.9.0.post0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pythonnet","slug":"pythonnet-7ea68ab2","identity":"pypi:pythonnet","label":"pythonnet","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pytorch-metric-learning","slug":"pytorch-metric-learning-389f0864","identity":"pypi:pytorch-metric-learning","label":"pytorch-metric-learning","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pywebview","slug":"pywebview-e9c71fb3","identity":"pypi:pywebview","label":"pywebview","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["6.2.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pywin32","slug":"pywin32-9a7c83ae","identity":"pypi:pywin32","label":"pywin32","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["312"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyxdg","slug":"pyxdg-cb4a8913","identity":"pypi:pyxdg","label":"pyxdg","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.0","LGPL-2.0-or-later"],"versions":["0.28"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:pyyaml","slug":"pyyaml-16000901","identity":"pypi:pyyaml","label":"pyyaml","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["6.0.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:qtpy","slug":"qtpy-44054c99","identity":"pypi:qtpy","label":"qtpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:rapidfuzz","slug":"rapidfuzz-3beab87b","identity":"pypi:rapidfuzz","label":"rapidfuzz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.14.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:regex","slug":"regex-5e8be65e","identity":"pypi:regex","label":"regex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0","Apache-2.0 AND CNRI-Python"],"versions":["2026.9.10"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:rich","slug":"rich-23b343f7","identity":"pypi:rich","label":"rich","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["15.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:ruff","slug":"ruff-d5943bdf","identity":"pypi:ruff","label":"ruff","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.17.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:safetensors","slug":"safetensors-2a32c77a","identity":"pypi:safetensors","label":"safetensors","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:scipy","slug":"scipy-215f884d","identity":"pypi:scipy","label":"scipy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.17.1","1.18.0"],"dossier":false,"occurrenceCount":2,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:shellingham","slug":"shellingham-fceabe5b","identity":"pypi:shellingham","label":"shellingham","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["ISC"],"versions":["1.5.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:show-in-file-manager","slug":"show-in-file-manager-cc1246db","identity":"pypi:show-in-file-manager","label":"show-in-file-manager","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:simple-websocket","slug":"simple-websocket-2bc2e925","identity":"pypi:simple-websocket","label":"simple-websocket","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:six","slug":"six-3c3888bd","identity":"pypi:six","label":"six","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.17.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sortedcontainers","slug":"sortedcontainers-9601b229","identity":"pypi:sortedcontainers","label":"sortedcontainers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:soundfile","slug":"soundfile-10750d91","identity":"pypi:soundfile","label":"soundfile","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.14.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:soxr","slug":"soxr-a0701a3a","identity":"pypi:soxr","label":"soxr","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["LGPL-2.0-or-later","LGPL-2.1-or-later"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sqlalchemy","slug":"sqlalchemy-5de7c53b","identity":"pypi:sqlalchemy","label":"sqlalchemy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.0.51"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:stevedore","slug":"stevedore-32e10f96","identity":"pypi:stevedore","label":"stevedore","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["5.8.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:sympy","slug":"sympy-b30cb89e","identity":"pypi:sympy","label":"sympy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","MIT","non-standard"],"versions":["1.14.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:threadpoolctl","slug":"threadpoolctl-e94f6300","identity":"pypi:threadpoolctl","label":"threadpoolctl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tinycss2","slug":"tinycss2-301fccf6","identity":"pypi:tinycss2","label":"tinycss2","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tomli","slug":"tomli-e09082bd","identity":"pypi:tomli","label":"tomli","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2.4.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tomli-w","slug":"tomli-w-661031c8","identity":"pypi:tomli-w","label":"tomli-w","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:toolz","slug":"toolz-fb894e20","identity":"pypi:toolz","label":"toolz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torch-audiomentations","slug":"torch-audiomentations-2d2db22f","identity":"pypi:torch-audiomentations","label":"torch-audiomentations","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.12.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torch-pitch-shift","slug":"torch-pitch-shift-44bcef4d","identity":"pypi:torch-pitch-shift","label":"torch-pitch-shift","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.5"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torchaudio","slug":"torchaudio-fdd76263","identity":"pypi:torchaudio","label":"torchaudio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-2-Clause","non-standard"],"versions":["2.9.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torchcodec","slug":"torchcodec-8b0b8074","identity":"pypi:torchcodec","label":"torchcodec","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["0.14.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:torchmetrics","slug":"torchmetrics-87072a51","identity":"pypi:torchmetrics","label":"torchmetrics","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:triton","slug":"triton-601ea838","identity":"pypi:triton","label":"triton","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:typer","slug":"typer-b291ff1c","identity":"pypi:typer","label":"typer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.27.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","identity":"pypi:typing-extensions","label":"typing-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0","non-standard"],"versions":["4.15.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:typing-inspection","slug":"typing-inspection-0abeb500","identity":"pypi:typing-inspection","label":"typing-inspection","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:tzdata","slug":"tzdata-f80b3bb7","identity":"pypi:tzdata","label":"tzdata","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2026.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:uvicorn","slug":"uvicorn-07c7a595","identity":"pypi:uvicorn","label":"uvicorn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.49.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:uvloop","slug":"uvloop-7921eb0f","identity":"pypi:uvloop","label":"uvloop","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.22.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:wakepy","slug":"wakepy-586883b0","identity":"pypi:wakepy","label":"wakepy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:watchfiles","slug":"watchfiles-d200b8ce","identity":"pypi:watchfiles","label":"watchfiles","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:webencodings","slug":"webencodings-04815c4d","identity":"pypi:webencodings","label":"webencodings","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:websockets","slug":"websockets-047236a0","identity":"pypi:websockets","label":"websockets","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["16.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:wsproto","slug":"wsproto-d5a3a1f2","identity":"pypi:wsproto","label":"wsproto","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:yarl","slug":"yarl-05cd1b35","identity":"pypi:yarl","label":"yarl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.24.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]},{"id":"package:pypi:zipp","slug":"zipp-75ac1ddb","identity":"pypi:zipp","label":"zipp","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["4.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["uv.lock"]}],"vulnerabilities":[{"id":"GHSA-22hg-r758-rrw9","slug":"ghsa-22hg-r758-rrw9-14adf850","dossier":true,"summary":"Pillow: Infinite loop in MIC n_frames when the embedded TIFF","aliases":["BIT-pillow-2026-112390","CVE-2026-112390"],"sourceIds":["GHSA-22hg-r758-rrw9"],"published":"2026-10-21T20:39:49Z","modified":"2026-10-26T08:56:03.565713059Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-248v-346w-9cwc","slug":"ghsa-248v-346w-9cwc-8a7dbdf1","dossier":false,"summary":"Certifi removes GLOBALTRUST root certificate","aliases":["CVE-2024-39689","PYSEC-2024-230"],"sourceIds":["GHSA-248v-346w-9cwc","PYSEC-2024-230"],"published":"2024-07-05T19:15:10Z","modified":"2026-09-10T03:50:15.994602411Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39689"},{"type":"FIX","url":"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"},{"type":"ARTICLE","url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241206-0001"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241206-0001/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-248v-346w-9cwc"}],"versionKeys":["pypi:certifi@2024.6.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-24rc-8hj2-v98c","slug":"ghsa-24rc-8hj2-v98c-379a2f18","dossier":true,"summary":"Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode","aliases":["BIT-pillow-2026-96638","CVE-2026-96638"],"sourceIds":["GHSA-24rc-8hj2-v98c"],"published":"2026-10-22T15:59:35Z","modified":"2026-10-29T10:55:36.262902070Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-24rc-8hj2-v98c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96638"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10015"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/e7794835e323ff2691d9b3a974cade1a44301b9a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-254f-3936-288h","slug":"ghsa-254f-3936-288h-1cc364b4","dossier":true,"summary":"Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()","aliases":["BIT-pillow-2026-112391","CVE-2026-112391"],"sourceIds":["GHSA-254f-3936-288h"],"published":"2026-10-21T21:11:07Z","modified":"2026-10-26T08:56:17.690706279Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-254f-3936-288h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112391"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/94cb11c44ff7345414da17ebfea1598a529ad9cd"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-27h8-gf7j-v5hc","slug":"ghsa-27h8-gf7j-v5hc-bd4ebeac","dossier":true,"summary":"Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images","aliases":["BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326"],"sourceIds":["GHSA-27h8-gf7j-v5hc","PYSEC-2026-4326"],"published":"2026-10-19T22:17:06.587Z","modified":"2026-10-27T11:10:35.409737764Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-27h8-gf7j-v5hc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112392"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/443e3130a8c11594fd0e296afad497e11e678961"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-27vj-qcqg-25rc","slug":"ghsa-27vj-qcqg-25rc-06b922e9","dossier":false,"summary":"fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution","aliases":["CVE-2026-104851","PYSEC-2026-4217"],"sourceIds":["GHSA-27vj-qcqg-25rc","PYSEC-2026-4217"],"published":"2026-10-05T22:53:22Z","modified":"2026-10-15T14:56:18.658408345Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/security/advisories/GHSA-27vj-qcqg-25rc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104851"},{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/pull/2029"},{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/pull/2039"},{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/commit/86438783f93b1398ef245b92f0e6063b445b611c"},{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/commit/a1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8"},{"type":"PACKAGE","url":"https://github.com/fsspec/filesystem_spec"},{"type":"WEB","url":"https://github.com/fsspec/filesystem_spec/releases/tag/2026.6.0"},{"type":"PACKAGE","url":"https://pypi.org/project/fsspec"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-27vj-qcqg-25rc"}],"versionKeys":["pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-29pf-2h5f-8g72","slug":"ghsa-29pf-2h5f-8g72-1d83ebb4","dossier":false,"summary":"HuggingFace transformers vulnerable to remote code execution","aliases":["CVE-2026-4372","PYSEC-2026-2289"],"sourceIds":["GHSA-29pf-2h5f-8g72","PYSEC-2026-2289"],"published":"2026-05-24T14:16:16.917Z","modified":"2026-09-10T03:50:45.254378086Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4372"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/a7f8e7ff37d87d1a1a0c8cf607971c607741452f"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/1f693a6e-6836-4b8b-a0bd-ca036fba8884"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-29pf-2h5f-8g72"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-29vq-49wr-vm6x","slug":"ghsa-29vq-49wr-vm6x-7d88633b","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2026-27199","PYSEC-2026-2320"],"sourceIds":["GHSA-29vq-49wr-vm6x","PYSEC-2026-2320"],"published":"2026-02-19T20:32:45Z","modified":"2026-09-10T03:50:33.709103081Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27199"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.6"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3","pypi:werkzeug@3.1.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2c2j-9gv5-cj73","slug":"ghsa-2c2j-9gv5-cj73-60bc1f35","dossier":false,"summary":"Starlette has possible denial-of-service vector when parsing large files in multipart forms","aliases":["CVE-2025-54121","PYSEC-2026-1941"],"sourceIds":["GHSA-2c2j-9gv5-cj73","PYSEC-2026-1941"],"published":"2025-07-21T19:34:23Z","modified":"2026-09-10T03:50:25.704876348Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/encode/starlette/security/advisories/GHSA-2c2j-9gv5-cj73"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54121"},{"type":"FIX","url":"https://github.com/encode/starlette/commit/9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1"},{"type":"PACKAGE","url":"https://github.com/encode/starlette"},{"type":"WEB","url":"https://github.com/encode/starlette/blob/fa5355442753f794965ae1af0f87f9fec1b9a3de/starlette/datastructures.py#L436C5-L447C14"},{"type":"WEB","url":"https://github.com/encode/starlette/discussions/2927#discussioncomment-13721403"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2c2j-9gv5-cj73"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-2fqr-mr3j-6wp8","slug":"ghsa-2fqr-mr3j-6wp8-5ee7c60f","dossier":false,"summary":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence","aliases":["CVE-2026-54279","PYSEC-2026-2112"],"sourceIds":["GHSA-2fqr-mr3j-6wp8","PYSEC-2026-2112"],"published":"2026-06-15T20:08:51Z","modified":"2026-11-03T16:45:04.163545105Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:U"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2fqr-mr3j-6wp8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54279"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2112.yaml"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-2g68-c3qc-8985","slug":"ghsa-2g68-c3qc-8985-d6075eca","dossier":false,"summary":"Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain","aliases":["CVE-2024-34069","PYSEC-2026-2043"],"sourceIds":["GHSA-2g68-c3qc-8985","PYSEC-2026-2043"],"published":"2024-05-06T14:21:27Z","modified":"2026-09-10T03:50:13.189126850Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34069"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240614-0004"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g68-c3qc-8985"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2g87-pp6c-29x5","slug":"ghsa-2g87-pp6c-29x5-5aaa26fd","dossier":false,"summary":"aiohttp: Multiple instances of excessive or unbounded memory/CPU use","aliases":["CVE-2026-123817"],"sourceIds":["GHSA-2g87-pp6c-29x5"],"published":"2026-10-19T17:07:23Z","modified":"2026-11-09T21:30:07.738926065Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2g87-pp6c-29x5"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/09bcaa73ff084a0c539bbf16a0a78743acb7141f"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/0ae507423f681161efa77d20052b4054397c7fb6"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/3d850ee9b92573c7e913821cbcb96005beb3f4df"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/615fec3d4f088f30d2ee72cad760152e92aa1c53"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6963ee0befec1502b6bb7b4db6c72d044c08f4fa"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6a4f6682817839313b04b8e5cea2b39c1a88ab4f"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/8cfbe9abe5e11b84006a10f9bdf82bf607671dab"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/a555ab698e08e9baea7386d5b4c0761cb8956fdd"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/c6ac0e44c3c573ff9616f4a6a532992538b31e43"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/d925a80539ffd227da1d93ab4a5bff123cc777db"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-2h4p-vjrc-8xpq","slug":"ghsa-2h4p-vjrc-8xpq-f59f8dec","dossier":false,"summary":"Mako vulnerable to path traversal via backslash URI on Windows in TemplateLookup","aliases":["CVE-2026-44307","PYSEC-2026-2617"],"sourceIds":["GHSA-2h4p-vjrc-8xpq","PYSEC-2026-2617"],"published":"2026-05-06T21:45:16Z","modified":"2026-09-10T03:50:45.452547864Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-2h4p-vjrc-8xpq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44307"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/issues/435"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/72e10c573ca0fbcbddd4455abca8ce92a61780d7"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_12"},{"type":"PACKAGE","url":"https://pypi.org/project/mako"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2h4p-vjrc-8xpq"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-2vrm-gr82-f7m5","slug":"ghsa-2vrm-gr82-f7m5-5092ea0c","dossier":false,"summary":"AIOHTTP has CRLF injection through multipart part content type header construction","aliases":["CVE-2026-34514","PYSEC-2026-2096"],"sourceIds":["GHSA-2vrm-gr82-f7m5","PYSEC-2026-2096"],"published":"2026-04-01T21:16:59.417Z","modified":"2026-09-10T03:50:42.288164171Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-2vrm-gr82-f7m5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34514"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-2xpw-w6gg-jr37","slug":"ghsa-2xpw-w6gg-jr37-91cead57","dossier":false,"summary":"urllib3 streaming API improperly handles highly compressed data","aliases":["CVE-2025-66471","PYSEC-2026-1994"],"sourceIds":["GHSA-2xpw-w6gg-jr37","PYSEC-2026-1994"],"published":"2025-12-05T18:15:54Z","modified":"2026-09-25T17:15:05.968189421Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/d0fde3672e4a4093f7587858dccfc298eb66e46c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-1994.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-332p-7hrc-92wf","slug":"ghsa-332p-7hrc-92wf-af7b2989","dossier":true,"summary":"Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO","aliases":["BIT-pillow-2026-112393","CVE-2026-112393"],"sourceIds":["GHSA-332p-7hrc-92wf"],"published":"2026-10-21T21:28:09Z","modified":"2026-10-26T08:56:07.886625845Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-332p-7hrc-92wf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112393"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/11582e5ffbdceb973d5ee593f3105af5a9852b40"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-3749-ghw9-m3mg","slug":"ghsa-3749-ghw9-m3mg-fadf4a32","dossier":false,"summary":"PyTorch susceptible to local Denial of Service","aliases":["BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191"],"sourceIds":["GHSA-3749-ghw9-m3mg","PYSEC-2025-191"],"published":"2025-03-30T16:15:14.380Z","modified":"2026-09-10T03:50:22.781448235Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2953"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/149274#issue-2923122269"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-191.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/main/SECURITY.md#untrusted-models"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?id.302006"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.521279"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3749-ghw9-m3mg"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-37mw-44qp-f5jm","slug":"ghsa-37mw-44qp-f5jm-fb05555e","dossier":false,"summary":"Transformers is vulnerable to ReDoS attack through its DonutProcessor class","aliases":["CVE-2025-3933","PYSEC-2026-1977"],"sourceIds":["GHSA-37mw-44qp-f5jm","PYSEC-2026-1977"],"published":"2025-07-11T12:30:32Z","modified":"2026-09-10T03:50:57.888142744Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3933"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/37788"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ebbe9b12dd75b69f92100d684c47f923ee262a93"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/25282953-5827-4384-bb6f-5790d275721b"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-37mw-44qp-f5jm"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-38jv-5279-wg99","slug":"ghsa-38jv-5279-wg99-c9df8f7b","dossier":false,"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","aliases":["CVE-2026-21441","PYSEC-2026-1996"],"sourceIds":["GHSA-38jv-5279-wg99","PYSEC-2026-1996"],"published":"2026-01-07T19:18:14Z","modified":"2026-09-10T03:50:32.562010895Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38jv-5279-wg99"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-3j72-p6qg-6xp7","slug":"ghsa-3j72-p6qg-6xp7-6d019684","dossier":true,"summary":"Pillow: TarIO negative size field causes infinite CPU-spin loop","aliases":["BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341"],"sourceIds":["GHSA-3j72-p6qg-6xp7","PYSEC-2026-4341"],"published":"2026-10-21T21:20:32.650Z","modified":"2026-10-29T10:55:45.826300321Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-3j72-p6qg-6xp7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96642"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10012"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/19b695fdcc5eddc37374e2b1645fc4185edaf71d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-3wq7-rqq7-wx6j","slug":"ghsa-3wq7-rqq7-wx6j-29b8d785","dossier":false,"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS","aliases":["CVE-2026-34517","PYSEC-2026-2099"],"sourceIds":["GHSA-3wq7-rqq7-wx6j","PYSEC-2026-2099"],"published":"2026-04-01T21:16:59.870Z","modified":"2026-09-10T03:50:42.683852324Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-3wq7-rqq7-wx6j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34517"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-4558-3h8r-v8xp","slug":"ghsa-4558-3h8r-v8xp-9e09a0b2","dossier":true,"summary":"Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size","aliases":["BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327"],"sourceIds":["GHSA-4558-3h8r-v8xp","PYSEC-2026-4327"],"published":"2026-10-19T21:17:07.747Z","modified":"2026-10-27T11:10:34.006455299Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4558-3h8r-v8xp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112394"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9723"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/392ee6f0d19a4adb766a63e9a99f3c28193b8d31"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-45hq-cxwh-f6vc","slug":"ghsa-45hq-cxwh-f6vc-d18d2872","dossier":false,"summary":"Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading","aliases":["BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255"],"sourceIds":["GHSA-45hq-cxwh-f6vc","PYSEC-2026-2255"],"published":"2026-07-06T19:17:08.577Z","modified":"2026-09-10T03:50:51.372929814Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55379"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2255.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-462x-pgg6-55fp","slug":"ghsa-462x-pgg6-55fp-29049dd8","dossier":true,"summary":"Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)","aliases":["BIT-pillow-2026-112395","CVE-2026-112395"],"sourceIds":["GHSA-462x-pgg6-55fp"],"published":"2026-10-20T20:49:26Z","modified":"2026-10-26T08:56:01.770928143Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-462x-pgg6-55fp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112395"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/76869efdbbf2ad7dccd7536520fb61b7a00ab61e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-48p4-8xcf-vxj5","slug":"ghsa-48p4-8xcf-vxj5-13f12656","dossier":false,"summary":"urllib3 does not control redirects in browsers and Node.js","aliases":["CVE-2025-50182","PYSEC-2026-1997"],"sourceIds":["GHSA-48p4-8xcf-vxj5","PYSEC-2026-1997"],"published":"2025-06-18T17:50:11Z","modified":"2026-09-10T03:50:24.821170285Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-48p4-8xcf-vxj5"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-494j-54xm-rwp3","slug":"ghsa-494j-54xm-rwp3-eab1773e","dossier":false,"summary":"AIOHTTP: Secure attribute not enforced for shared cookie","aliases":["CVE-2026-111063"],"sourceIds":["GHSA-494j-54xm-rwp3"],"published":"2026-10-19T17:07:47Z","modified":"2026-10-26T15:00:05.287728271Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-494j-54xm-rwp3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111063"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/999c356d61e966faffa97b06ab0d0455226d36c5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-4fvr-rgm6-gqmc","slug":"ghsa-4fvr-rgm6-gqmc-c8b35c87","dossier":false,"summary":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit","aliases":["CVE-2026-54273","PYSEC-2026-2107"],"sourceIds":["GHSA-4fvr-rgm6-gqmc","PYSEC-2026-2107"],"published":"2026-06-15T20:10:32Z","modified":"2026-09-10T03:51:07.881817751Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4fvr-rgm6-gqmc"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4j2p-28q2-5m79","slug":"ghsa-4j2p-28q2-5m79-f1478ba7","dossier":false,"summary":"Accelerate path traversal and denial of service via sharded checkpoint weight_map entries","aliases":["CVE-2026-69112","PYSEC-2026-3804"],"sourceIds":["GHSA-4j2p-28q2-5m79","PYSEC-2026-3804"],"published":"2026-08-10T21:32:04Z","modified":"2026-09-10T12:25:52.792193450Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69112"},{"type":"WEB","url":"https://github.com/huggingface/accelerate/issues/4067"},{"type":"WEB","url":"https://github.com/huggingface/accelerate/pull/4070"},{"type":"WEB","url":"https://github.com/huggingface/accelerate/pull/4138"},{"type":"PACKAGE","url":"https://github.com/huggingface/accelerate"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/hugging-face-accelerate-path-traversal-and-dos-via-weight-map"},{"type":"PACKAGE","url":"https://pypi.org/project/accelerate"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4j2p-28q2-5m79"}],"versionKeys":["pypi:accelerate@1.11.0","pypi:accelerate@1.12.0","pypi:accelerate@1.13.0","pypi:accelerate@1.2.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-4m7w-qmgq-4wj5","slug":"ghsa-4m7w-qmgq-4wj5-f98433d3","dossier":false,"summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections","aliases":["CVE-2026-54275","PYSEC-2026-237"],"sourceIds":["GHSA-4m7w-qmgq-4wj5","PYSEC-2026-237"],"published":"2026-06-15T20:11:13Z","modified":"2026-09-10T03:50:48.205198252Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-4m7w-qmgq-4wj5"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4rm8-3hmm-39fg","slug":"ghsa-4rm8-3hmm-39fg-6e9ca404","dossier":true,"summary":"Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise","aliases":["BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340"],"sourceIds":["GHSA-4rm8-3hmm-39fg","PYSEC-2026-4340"],"published":"2026-10-21T21:20:32.500Z","modified":"2026-10-29T10:56:07.449486409Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rm8-3hmm-39fg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96641"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10010"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/80de4be9e38d3a6148dd4d8491eb80cd12b760a4"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-4rr5-89j8-mwwm","slug":"ghsa-4rr5-89j8-mwwm-f8e3c770","dossier":false,"summary":"Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer","aliases":["BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328"],"sourceIds":["GHSA-4rr5-89j8-mwwm","PYSEC-2026-4328"],"published":"2026-10-19T22:17:06.837Z","modified":"2026-10-27T11:10:49.694224501Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4rr5-89j8-mwwm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112396"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/dc95da20207827a062cfbf551ee9f6031465a8bb"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-4w7r-h757-3r74","slug":"ghsa-4w7r-h757-3r74-ca8973bc","dossier":false,"summary":"Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer","aliases":["CVE-2025-6921","PYSEC-2026-1980"],"sourceIds":["GHSA-4w7r-h757-3r74","PYSEC-2026-1980"],"published":"2025-09-23T15:31:09Z","modified":"2026-09-10T03:50:27.867584538Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6921"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/287d15a7-6e7c-45d2-8c05-11e305776f1f"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4w7r-h757-3r74"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-4x4j-2g7c-83w6","slug":"ghsa-4x4j-2g7c-83w6-326c14d2","dossier":false,"summary":"Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path","aliases":["BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257"],"sourceIds":["GHSA-4x4j-2g7c-83w6","PYSEC-2026-2257"],"published":"2026-07-06T19:17:08.830Z","modified":"2026-09-10T03:51:10.324377232Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55798"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2257.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-4xh5-x5gv-qwph","slug":"ghsa-4xh5-x5gv-qwph-bdb101cb","dossier":false,"summary":"pip's fallback tar extraction doesn't check symbolic links point to extraction directory","aliases":["CVE-2025-8869","PYSEC-2026-1795"],"sourceIds":["GHSA-4xh5-x5gv-qwph","PYSEC-2026-1795"],"published":"2025-09-24T15:31:14Z","modified":"2026-09-10T03:50:27.949321787Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8869"},{"type":"WEB","url":"https://github.com/pypa/pip/pull/13550"},{"type":"FIX","url":"https://github.com/pypa/pip/commit/f2b92314da012b9fffa36b3f3e67748a37ef464a"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"},{"type":"WEB","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/IF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN"},{"type":"WEB","url":"https://pip.pypa.io/en/stable/news/#v25-2"},{"type":"PACKAGE","url":"https://pypi.org/project/pip"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4xh5-x5gv-qwph"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-5239-wwwm-4pmq","slug":"ghsa-5239-wwwm-4pmq-228840e4","dossier":false,"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","aliases":["CVE-2026-4539","PYSEC-2026-2987"],"sourceIds":["GHSA-5239-wwwm-4pmq","PYSEC-2026-2987"],"published":"2026-03-22T06:30:15Z","modified":"2026-09-10T03:50:59.780634752Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"},{"type":"PACKAGE","url":"https://pypi.org/project/pygments"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5239-wwwm-4pmq"}],"versionKeys":["pypi:pygments@2.19.1","pypi:pygments@2.19.2"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-53q9-r3pm-6pq6","slug":"ghsa-53q9-r3pm-6pq6-6fbb0149","dossier":false,"summary":"PyTorch: `torch.load` with `weights_only=True` leads to remote code execution","aliases":["BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41"],"sourceIds":["GHSA-53q9-r3pm-6pq6","PYSEC-2025-41"],"published":"2025-04-18T15:19:28Z","modified":"2026-08-07T08:12:20.395044060Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-53q9-r3pm-6pq6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-32434"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/8d4b8a920a2172523deb95bf20e8e52d50649c04"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-41.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"}],"versionKeys":["pypi:torch@2.5.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-54jq-c3m8-4m76","slug":"ghsa-54jq-c3m8-4m76-bba4b2d3","dossier":false,"summary":"AIOHTTP vulnerable to brute-force leak of internal static file path components","aliases":["CVE-2025-69226","PYSEC-2026-1097"],"sourceIds":["GHSA-54jq-c3m8-4m76","PYSEC-2026-1097"],"published":"2026-01-05T23:09:51Z","modified":"2026-09-10T03:50:32.751498447Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-54jq-c3m8-4m76"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69226"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/f2a86fd5ac0383000d1715afddfa704413f0711e"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-54jq-c3m8-4m76"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-54p9-h82j-f925","slug":"ghsa-54p9-h82j-f925-623d2ef6","dossier":false,"summary":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","aliases":["CVE-2026-104874","PYSEC-2026-4244"],"sourceIds":["GHSA-54p9-h82j-f925","PYSEC-2026-4244"],"published":"2026-10-05T23:40:58Z","modified":"2026-10-15T14:56:05.601333622Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/multidict/security/advisories/GHSA-54p9-h82j-f925"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104874"},{"type":"WEB","url":"https://github.com/aio-libs/multidict/commit/350b4a07bf8ff851b6d7544e81b1c748bdc74c40"},{"type":"PACKAGE","url":"https://github.com/aio-libs/multidict"},{"type":"WEB","url":"https://github.com/aio-libs/multidict/releases/tag/v6.9.1"},{"type":"PACKAGE","url":"https://pypi.org/project/multidict"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-54p9-h82j-f925"}],"versionKeys":["pypi:multidict@6.7.0","pypi:multidict@6.7.1"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-5639-2j2p-m4mx","slug":"ghsa-5639-2j2p-m4mx-3aefc2b3","dossier":false,"summary":"Mako: Path traversal via drive-letter URI on Windows in TemplateLookup","aliases":["CVE-2026-102991","PYSEC-2026-4243"],"sourceIds":["GHSA-5639-2j2p-m4mx","PYSEC-2026-4243"],"published":"2026-10-05T23:42:02Z","modified":"2026-10-15T14:55:45.473045835Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-5639-2j2p-m4mx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102991"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/issues/441"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/000ed85e4e48771eff460bf4fc721fb43de80e08"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_4_2"},{"type":"PACKAGE","url":"https://pypi.org/project/mako"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5639-2j2p-m4mx"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.12","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-567q-5qvw-pf92","slug":"ghsa-567q-5qvw-pf92-60527ab6","dossier":false,"summary":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","aliases":["CVE-2026-112907"],"sourceIds":["GHSA-567q-5qvw-pf92"],"published":"2026-10-23T22:27:32Z","modified":"2026-10-23T22:45:03.452878321Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-58qw-9mgm-455v","slug":"ghsa-58qw-9mgm-455v-d690efaf","dossier":false,"summary":"pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files","aliases":["CVE-2026-3219","PYSEC-2026-2875"],"sourceIds":["GHSA-58qw-9mgm-455v","PYSEC-2026-2875"],"published":"2026-04-20T18:31:48Z","modified":"2026-09-10T03:50:42.838011658Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3219"},{"type":"WEB","url":"https://github.com/pypa/pip/issues/13867"},{"type":"WEB","url":"https://github.com/pypa/pip/pull/13870"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/QAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ"},{"type":"PACKAGE","url":"https://pypi.org/project/pip"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-58qw-9mgm-455v"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-58r4-6rv3-gfh8","slug":"ghsa-58r4-6rv3-gfh8-17253bd5","dossier":true,"summary":"Pillow: Out-of-bounds access in _imagingmorph on a zero-width image","aliases":["BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329"],"sourceIds":["GHSA-58r4-6rv3-gfh8","PYSEC-2026-4329"],"published":"2026-10-19T22:17:06.970Z","modified":"2026-10-28T11:10:53.627071818Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-58r4-6rv3-gfh8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112397"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/18f7c0dfee93063c51db6ed0ca8c4da2999dcb64"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-59g5-xgcq-4qw3","slug":"ghsa-59g5-xgcq-4qw3-949fce0e","dossier":false,"summary":"Denial of service (DoS) via deformation `multipart/form-data` boundary","aliases":["CVE-2024-53981","PYSEC-2026-1851"],"sourceIds":["GHSA-59g5-xgcq-4qw3","PYSEC-2026-1851"],"published":"2024-12-02T21:37:04Z","modified":"2026-09-10T03:50:21.270678783Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-59g5-xgcq-4qw3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53981"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/commit/c4fe4d3cebc08c660e57dd709af1ffa7059b3177"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59g5-xgcq-4qw3"}],"versionKeys":["pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-59p9-h35m-wg4g","slug":"ghsa-59p9-h35m-wg4g-68657c65","dossier":false,"summary":"Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer","aliases":["CVE-2025-6638","PYSEC-2026-1981"],"sourceIds":["GHSA-59p9-h35m-wg4g","PYSEC-2026-1981"],"published":"2025-09-12T12:30:23Z","modified":"2026-09-10T03:50:58.113501288Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6638"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/47c34fba5c303576560cb29767efb452ff12b8be"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/d37f7517972f67e3f2194c000ed0f87f064e5099"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/6a6c933f-9ce8-4ded-8b3b-2c1444c61f36"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-59p9-h35m-wg4g"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-5p39-cfhj-2xmp","slug":"ghsa-5p39-cfhj-2xmp-77a62550","dossier":false,"summary":"AnyIO process-pool workers can block indefinitely on undrained stderr","aliases":["CVE-2026-64847","PYSEC-2026-4024"],"sourceIds":["GHSA-5p39-cfhj-2xmp","PYSEC-2026-4024"],"published":"2026-09-18T17:17:10Z","modified":"2026-10-01T17:55:57.336188727Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1207"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/anyio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5p39-cfhj-2xmp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64847"}],"versionKeys":["pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-5rjg-fvgr-3xxf","slug":"ghsa-5rjg-fvgr-3xxf-79d39e6b","dossier":false,"summary":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write","aliases":["BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49"],"sourceIds":["GHSA-5rjg-fvgr-3xxf","PYSEC-2025-49"],"published":"2025-05-17T16:15:19Z","modified":"2026-09-10T03:50:24.253527717Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273"},{"type":"REPORT","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-5rvq-cxj2-64vf","slug":"ghsa-5rvq-cxj2-64vf-5e3e7388","dossier":false,"summary":"python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service","aliases":["CVE-2026-53539","PYSEC-2026-3036"],"sourceIds":["GHSA-5rvq-cxj2-64vf","PYSEC-2026-3036"],"published":"2026-06-15T20:24:09Z","modified":"2026-09-10T03:50:48.426087467Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-5rvq-cxj2-64vf"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5rvq-cxj2-64vf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53539"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-5w7q-77mv-v69f","slug":"ghsa-5w7q-77mv-v69f-f2198303","dossier":false,"summary":"python-socketio: Binary attachment accumulation can cause denial of service","aliases":["CVE-2026-48804","PYSEC-2026-3042"],"sourceIds":["GHSA-5w7q-77mv-v69f","PYSEC-2026-3042"],"published":"2026-06-26T20:51:58Z","modified":"2026-07-13T16:43:50.745760053Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/miguelgrinberg/python-socketio/security/advisories/GHSA-5w7q-77mv-v69f"},{"type":"PACKAGE","url":"https://github.com/miguelgrinberg/python-socketio"},{"type":"PACKAGE","url":"https://pypi.org/project/python-socketio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5w7q-77mv-v69f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48804"}],"versionKeys":["pypi:python-socketio@5.14.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-5wr8-gcqf-gqf3","slug":"ghsa-5wr8-gcqf-gqf3-8b4786ad","dossier":false,"summary":"aiohttp server lacks an initial request/header timeout","aliases":["CVE-2026-111064"],"sourceIds":["GHSA-5wr8-gcqf-gqf3"],"published":"2026-10-19T17:08:04Z","modified":"2026-10-19T17:15:04.139404381Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5wr8-gcqf-gqf3"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/be846822b4b3a5a54b6163e794b42dc06fba54a3"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-5x8w-8jj5-q52h","slug":"ghsa-5x8w-8jj5-q52h-96fe86d3","dossier":true,"summary":"Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution","aliases":["BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330"],"sourceIds":["GHSA-5x8w-8jj5-q52h","PYSEC-2026-4330"],"published":"2026-10-19T22:17:07.107Z","modified":"2026-10-28T11:10:48.833199086Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x8w-8jj5-q52h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112398"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-5x94-69rx-g8h2","slug":"ghsa-5x94-69rx-g8h2-0bc05f88","dossier":false,"summary":"Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254"],"sourceIds":["GHSA-5x94-69rx-g8h2","PYSEC-2026-2254"],"published":"2026-07-06T19:17:08.270Z","modified":"2026-09-10T03:51:10.514604451Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54060"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2254.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-5xm2-6676-qcp9","slug":"ghsa-5xm2-6676-qcp9-1e22ee95","dossier":true,"summary":"Pillow: APNG background disposal allocates full canvas before decompression bomb check","aliases":["BIT-pillow-2026-112399","CVE-2026-112399"],"sourceIds":["GHSA-5xm2-6676-qcp9"],"published":"2026-10-21T21:17:56Z","modified":"2026-10-26T08:56:16.789537980Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xm2-6676-qcp9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112399"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-5xmw-vc9v-4wf2","slug":"ghsa-5xmw-vc9v-4wf2-86a8861a","dossier":false,"summary":"Pillow has a heap buffer overflow with nested list coordinates","aliases":["BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"sourceIds":["GHSA-5xmw-vc9v-4wf2","PYSEC-2026-2251"],"published":"2026-05-04T20:18:27Z","modified":"2026-10-19T20:00:04.709097863Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"WEB","url":"https://github.com/designcomputer/mysql_mcp_server/commit/a96549f4a4d65443fd6e9c7f2324fba9a5c80a82"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/cf6de8ca9b23e714aa5310e1c791eda66fc0b670"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2251.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-62p4-gmf7-7g93","slug":"ghsa-62p4-gmf7-7g93-cb81341c","dossier":false,"summary":"Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)","aliases":["BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493"],"sourceIds":["GHSA-62p4-gmf7-7g93","PYSEC-2026-3493"],"published":"2026-07-20T21:08:13Z","modified":"2026-09-10T03:51:10.632149522Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-62p4-gmf7-7g93"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54058"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9719"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6a8de891fb00968e5ea79bfa84368ed90b3cfc1d"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-62p4-gmf7-7g93"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-63cw-57p8-fm3p","slug":"ghsa-63cw-57p8-fm3p-01ac35c7","dossier":false,"summary":"PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files","aliases":["BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286"],"sourceIds":["GHSA-63cw-57p8-fm3p","PYSEC-2026-2286"],"published":"2026-01-27T20:10:54Z","modified":"2026-11-04T03:15:10.870748916Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/security/advisories/GHSA-63cw-57p8-fm3p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24747"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/163105"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-24747"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2433612"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-63cw-57p8-fm3p"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pytorch/PYSEC-2026-1856.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2026-2286.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/163122/commit/954dc5183ee9205cbe79876ad05dd2d9ae752139"},{"type":"ADVISORY","url":"https://github.com/pytorch/pytorch/releases/tag/v2.10.0"},{"type":"WEB","url":"https://pypi.org/project/pytorch"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-24747.json"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-63hf-3vf5-4wqf","slug":"ghsa-63hf-3vf5-4wqf-aadd9f0f","dossier":false,"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","aliases":["CVE-2026-34520","PYSEC-2026-2102"],"sourceIds":["GHSA-63hf-3vf5-4wqf","PYSEC-2026-2102"],"published":"2026-04-01T21:17:00.333Z","modified":"2026-09-10T03:50:43.255807027Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hf-3vf5-4wqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34520"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2026-2102.yaml"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-63hw-fmq6-xxg2","slug":"ghsa-63hw-fmq6-xxg2-00aac622","dossier":false,"summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines","aliases":["CVE-2026-54277","PYSEC-2026-2110"],"sourceIds":["GHSA-63hw-fmq6-xxg2","PYSEC-2026-2110"],"published":"2026-06-15T20:09:16Z","modified":"2026-09-10T03:50:48.460120366Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-63hw-fmq6-xxg2"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-654x-cwwv-5j9c","slug":"ghsa-654x-cwwv-5j9c-54c66942","dossier":false,"summary":"Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1","aliases":["BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336"],"sourceIds":["GHSA-654x-cwwv-5j9c","PYSEC-2026-4336"],"published":"2026-10-21T22:16:49.410Z","modified":"2026-10-29T10:56:00.934076155Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-654x-cwwv-5j9c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114501"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10172"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/19f64946eb247b973dd4560be7dea3bf979d2e6a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-65pc-fj4g-8rjx","slug":"ghsa-65pc-fj4g-8rjx-9fe9e88a","dossier":true,"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","aliases":["CVE-2026-45409","PYSEC-2026-215"],"sourceIds":["GHSA-65pc-fj4g-8rjx","PYSEC-2026-215"],"published":"2026-05-19T14:34:32Z","modified":"2026-09-10T03:50:45.700124422Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}],"versionKeys":["pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-65qm-jvmh-6pqg","slug":"ghsa-65qm-jvmh-6pqg-7925f039","dossier":true,"summary":"Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS","aliases":["BIT-pillow-2026-112400","CVE-2026-112400"],"sourceIds":["GHSA-65qm-jvmh-6pqg"],"published":"2026-10-20T20:53:36Z","modified":"2026-10-26T08:55:49.781288748Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-65qm-jvmh-6pqg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112400"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6faed707cfb760a4cbd726ddc8406f576cf35bf7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-69f9-5gxw-wvc2","slug":"ghsa-69f9-5gxw-wvc2-eec14573","dossier":false,"summary":"AIOHTTP's unicode processing of header values could cause parsing discrepancies","aliases":["CVE-2025-69224","PYSEC-2026-1099"],"sourceIds":["GHSA-69f9-5gxw-wvc2","PYSEC-2026-1099"],"published":"2026-01-05T22:58:57Z","modified":"2026-09-10T03:49:54.440954011Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-69f9-5gxw-wvc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69224"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/32677f2adfd907420c078dda6b79225c6f4ebce0"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69f9-5gxw-wvc2"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-69hj-f68j-2879","slug":"ghsa-69hj-f68j-2879-d34e420d","dossier":true,"summary":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","aliases":["CVE-2026-112909"],"sourceIds":["GHSA-69hj-f68j-2879"],"published":"2026-10-28T21:08:35Z","modified":"2026-10-28T21:15:04.974667790Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3","pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-69w3-r845-3855","slug":"ghsa-69w3-r845-3855-1b4edc28","dossier":false,"summary":"HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class","aliases":["CVE-2026-1839","PYSEC-2026-2288"],"sourceIds":["GHSA-69w3-r845-3855","PYSEC-2026-2288"],"published":"2026-04-07T06:16:41.490Z","modified":"2026-09-10T03:50:43.300048881Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1839"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/releases/tag/v5.0.0rc3"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/3c77bb97-e493-493d-9a88-c57f5c536485"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-69w3-r845-3855"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-6cjc-53gc-5rqm","slug":"ghsa-6cjc-53gc-5rqm-f1beb40a","dossier":false,"summary":"AIOHTTP: Connector pool exhaustion via Max-Age overflow","aliases":["CVE-2026-111065"],"sourceIds":["GHSA-6cjc-53gc-5rqm"],"published":"2026-10-20T19:57:24Z","modified":"2026-10-20T20:15:05.286053785Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6cjc-53gc-5rqm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111065"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9dd8eaf4e31f1237ef2c1574a8c82a739fca5805"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-6jhg-hg63-jvvf","slug":"ghsa-6jhg-hg63-jvvf-74cd77d8","dossier":false,"summary":"AIOHTTP vulnerable to  denial of service through large payloads","aliases":["CVE-2025-69228","PYSEC-2026-1100"],"sourceIds":["GHSA-6jhg-hg63-jvvf","PYSEC-2026-1100"],"published":"2026-01-05T23:13:14Z","modified":"2026-09-10T03:50:32.839537992Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69228"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6jhg-hg63-jvvf"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6jv3-5f52-599m","slug":"ghsa-6jv3-5f52-599m-dd700d26","dossier":false,"summary":"python-multipart: Semicolon treated as querystring field separator enables parameter smuggling","aliases":["CVE-2026-53538","PYSEC-2026-3037"],"sourceIds":["GHSA-6jv3-5f52-599m","PYSEC-2026-3037"],"published":"2026-06-15T20:22:25Z","modified":"2026-09-10T03:51:07.925895532Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-6jv3-5f52-599m"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6jv3-5f52-599m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53538"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-6mq8-rvhq-8wgg","slug":"ghsa-6mq8-rvhq-8wgg-d94d738f","dossier":false,"summary":"AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb","aliases":["CVE-2025-69223","PYSEC-2026-1101"],"sourceIds":["GHSA-6mq8-rvhq-8wgg","PYSEC-2026-1101"],"published":"2026-01-05T22:58:41Z","modified":"2026-09-10T03:50:32.830751052Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69223"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6mq8-rvhq-8wgg"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-6q48-6c7w-9gw2","slug":"ghsa-6q48-6c7w-9gw2-05036ff0","dossier":true,"summary":"certifi bundles emSign root CAs with compromised intermediate CA keys","aliases":["PYSEC-2026-4320"],"sourceIds":["GHSA-6q48-6c7w-9gw2","PYSEC-2026-4320"],"published":"2026-10-20T19:35:05Z","modified":"2026-10-30T14:00:02.590922333Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-6q48-6c7w-9gw2"},{"type":"WEB","url":"https://discuss.python.org/t/information-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident/109576"},{"type":"WEB","url":"https://emudhra.we-have-a-problem.com/"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"PACKAGE","url":"https://pypi.org/project/certifi"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6q48-6c7w-9gw2"}],"versionKeys":["pypi:certifi@2024.12.14","pypi:certifi@2024.6.2","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17"],"packageCount":1,"repositoryCount":21},{"id":"GHSA-6r8x-57c9-28j4","slug":"ghsa-6r8x-57c9-28j4-3a620dbf","dossier":false,"summary":"Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow","aliases":["BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451"],"sourceIds":["GHSA-6r8x-57c9-28j4","PYSEC-2026-3451"],"published":"2026-07-14T16:17:01.937Z","modified":"2026-09-10T03:51:10.822199342Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59199"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3451.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-6rvg-6v2m-4j46","slug":"ghsa-6rvg-6v2m-4j46-e04ee614","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2024-12720","PYSEC-2026-1982"],"sourceIds":["GHSA-6rvg-6v2m-4j46","PYSEC-2026-1982"],"published":"2025-03-20T12:32:43Z","modified":"2026-08-13T20:11:58.209202163Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12720"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/deac971c469bcbb182c2e52da0b82fb3bf54cccf"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/4bed1214-7835-4252-a853-22bbad891f98"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6rvg-6v2m-4j46"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-6v7p-g79w-8964","slug":"ghsa-6v7p-g79w-8964-7ab8b488","dossier":false,"summary":"MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error","aliases":["CVE-2026-57585","PYSEC-2026-3625"],"sourceIds":["GHSA-6v7p-g79w-8964","PYSEC-2026-3625"],"published":"2026-06-19T21:42:55Z","modified":"2026-09-10T03:51:07.975753919Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964"},{"type":"FIX","url":"https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d"},{"type":"PACKAGE","url":"https://github.com/msgpack/msgpack-python"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1"}],"versionKeys":["pypi:msgpack@1.1.0","pypi:msgpack@1.1.1","pypi:msgpack@1.1.2"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-6vgw-5pg2-w6jp","slug":"ghsa-6vgw-5pg2-w6jp-57c7d3f5","dossier":false,"summary":"pip Path Traversal vulnerability","aliases":["CVE-2026-1703","PYSEC-2026-1796"],"sourceIds":["GHSA-6vgw-5pg2-w6jp","PYSEC-2026-1796"],"published":"2026-02-02T15:30:34Z","modified":"2026-09-10T03:50:34.266257578Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1703"},{"type":"WEB","url":"https://github.com/pypa/pip/pull/13777"},{"type":"WEB","url":"https://github.com/pypa/pip/commit/8e227a9be4faa9594e05d02ca05a413a2a4e7735"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/WIEA34D4TABF2UNQJAOMXKCICSPBE2DJ"},{"type":"PACKAGE","url":"https://pypi.org/project/pip"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-6vgw-5pg2-w6jp"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-74r2-7ff9-mjj2","slug":"ghsa-74r2-7ff9-mjj2-9127f170","dossier":true,"summary":"Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()","aliases":["BIT-pillow-2026-112401","CVE-2026-112401"],"sourceIds":["GHSA-74r2-7ff9-mjj2"],"published":"2026-10-21T20:42:11Z","modified":"2026-10-26T08:56:13.792431880Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-74r2-7ff9-mjj2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112401"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-768j-98cg-p3fv","slug":"ghsa-768j-98cg-p3fv-0815ff07","dossier":false,"summary":"fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib","aliases":["CVE-2025-66034","PYSEC-2026-1389"],"sourceIds":["GHSA-768j-98cg-p3fv","PYSEC-2026-1389"],"published":"2025-12-01T19:07:00Z","modified":"2026-09-10T03:50:31.754255627Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66034"},{"type":"WEB","url":"https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"},{"type":"PACKAGE","url":"https://github.com/fonttools/fonttools"},{"type":"PACKAGE","url":"https://pypi.org/project/fonttools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-768j-98cg-p3fv"}],"versionKeys":["pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-78g4-xqwv-q3g8","slug":"ghsa-78g4-xqwv-q3g8-95d38591","dossier":false,"summary":"Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()","aliases":[],"sourceIds":["GHSA-78g4-xqwv-q3g8"],"published":"2026-10-22T17:01:08Z","modified":"2026-10-22T17:15:04.326552524Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-78g4-xqwv-q3g8"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/5f8114c8096b181fae493543cd3837d9f9a971cc"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/d3470c327840f4c216a1610f30e7091dfd0b97c0"},{"type":"WEB","url":"https://github.com/uclouvain/openjpeg/commit/91d08b11a72764f6d199f32fa0c1b1abd4edc2ad"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"type":"WEB","url":"https://osv.dev/vulnerability/OSV-2025-219"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-7f5h-v6xp-fcq8","slug":"ghsa-7f5h-v6xp-fcq8-9393173e","dossier":false,"summary":"Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``","aliases":["CVE-2025-62727","PYSEC-2026-1942"],"sourceIds":["GHSA-7f5h-v6xp-fcq8","PYSEC-2026-1942"],"published":"2025-10-28T20:38:01Z","modified":"2026-09-10T03:50:29.490992457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-7f5h-v6xp-fcq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62727"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/4ea6e22b489ec388d6004cfbca52dd5b147127c5"},{"type":"INTRODUCED","url":"https://github.com/Kludex/starlette/commit/69ed26a85956ef4bd0161807eb27abf49be7cd3c"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/Kludex/starlette/releases/tag/0.49.1"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7f5h-v6xp-fcq8"}],"versionKeys":["pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-7gcm-g887-7qv7","slug":"ghsa-7gcm-g887-7qv7-55bb9ff1","dossier":false,"summary":"protobuf affected by a JSON recursion depth bypass","aliases":["CVE-2026-0994","PYSEC-2026-1805"],"sourceIds":["GHSA-7gcm-g887-7qv7","PYSEC-2026-1805"],"published":"2026-01-23T15:31:35Z","modified":"2026-09-10T03:50:32.795512159Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0994"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/issues/25070"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/pull/25239"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gcm-g887-7qv7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-7mwm-ghpf-9vrm","slug":"ghsa-7mwm-ghpf-9vrm-446e4269","dossier":true,"summary":"Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform","aliases":["BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331"],"sourceIds":["GHSA-7mwm-ghpf-9vrm","PYSEC-2026-4331"],"published":"2026-10-19T22:17:07.633Z","modified":"2026-10-28T11:10:35.587185673Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-7mwm-ghpf-9vrm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112402"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/aafa6c75f7cdabb9f409a8aac7c780bea31d08d9"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-82r6-8w77-94w6","slug":"ghsa-82r6-8w77-94w6-217253d8","dossier":false,"summary":"AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing","aliases":["CVE-2026-63374","PYSEC-2026-4025"],"sourceIds":["GHSA-82r6-8w77-94w6","PYSEC-2026-4025"],"published":"2026-09-18T17:17:18Z","modified":"2026-10-01T17:56:11.058322399Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"},{"type":"WEB","url":"https://github.com/agronholm/anyio/pull/1208"},{"type":"WEB","url":"https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"},{"type":"PACKAGE","url":"https://github.com/agronholm/anyio"},{"type":"WEB","url":"https://github.com/agronholm/anyio/releases/tag/4.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/anyio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-82r6-8w77-94w6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63374"}],"versionKeys":["pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-82w8-qh3p-5jfq","slug":"ghsa-82w8-qh3p-5jfq-a05ef51e","dossier":false,"summary":"Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS","aliases":["CVE-2026-54283","PYSEC-2026-249"],"sourceIds":["GHSA-82w8-qh3p-5jfq","PYSEC-2026-249"],"published":"2026-06-15T20:39:53Z","modified":"2026-09-10T03:51:08.156199030Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-86qp-5c8j-p5mr","slug":"ghsa-86qp-5c8j-p5mr-13e563cb","dossier":false,"summary":"Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks","aliases":["CVE-2026-48710","PYSEC-2026-161","X41-2026-002"],"sourceIds":["GHSA-86qp-5c8j-p5mr","PYSEC-2026-161"],"published":"2026-05-22T13:10:03Z","modified":"2026-09-10T03:51:08.121685407Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48710"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"},{"type":"WEB","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"},{"type":"ARTICLE","url":"https://www.secwest.net/starlette"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2026-48710"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48710.json"},{"type":"WEB","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481742"},{"type":"DETECTION","url":"https://badhost.org/"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48710"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:60520"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:51357"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:44696"},{"type":"ARTICLE","url":"https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette/"},{"type":"ADVISORY","url":"https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette/"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-87hc-h4r5-73f7","slug":"ghsa-87hc-h4r5-73f7-c5117ca2","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names with compound extensions","aliases":["CVE-2026-21860","PYSEC-2026-2044"],"sourceIds":["GHSA-87hc-h4r5-73f7","PYSEC-2026-2044"],"published":"2026-01-08T19:51:21Z","modified":"2026-09-10T03:50:32.862525778Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21860"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-87hc-h4r5-73f7"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-887c-mr87-cxwp","slug":"ghsa-887c-mr87-cxwp-233a2961","dossier":false,"summary":"PyTorch Improper Resource Shutdown or Release vulnerability","aliases":["BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970"],"sourceIds":["GHSA-887c-mr87-cxwp","PYSEC-2026-1970"],"published":"2025-04-16T21:30:59Z","modified":"2026-09-10T03:50:23.660138570Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3730"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/150835"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/pull/150981"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af"},{"type":"WEB","url":"https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.305076"},{"type":"WEB","url":"https://vuldb.com/?id.305076"},{"type":"WEB","url":"https://vuldb.com/?submit.553645"},{"type":"PACKAGE","url":"https://pypi.org/project/torch"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-887c-mr87-cxwp"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-8988-9cw3-xx77","slug":"ghsa-8988-9cw3-xx77-ee9c660c","dossier":true,"summary":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden","aliases":["CVE-2026-97687","PYSEC-2026-4175"],"sourceIds":["GHSA-8988-9cw3-xx77","PYSEC-2026-4175"],"published":"2026-09-30T14:46:04Z","modified":"2026-10-01T17:55:53.793608550Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/pull/5093"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8988-9cw3-xx77"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-8g5g-8vmr-9782","slug":"ghsa-8g5g-8vmr-9782-3b73f6ca","dossier":false,"summary":"Pillow: Heap buffer overflow in ImagingJpegDecode","aliases":["BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332"],"sourceIds":["GHSA-8g5g-8vmr-9782","PYSEC-2026-4332"],"published":"2026-10-19T22:17:07.770Z","modified":"2026-10-28T11:10:51.788355157Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8g5g-8vmr-9782"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112403"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/242a059aedc1935097d9aa1dc3f099750467ba75"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-8mx5-7m5m-r77g","slug":"ghsa-8mx5-7m5m-r77g-03e425ff","dossier":false,"summary":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","aliases":["CVE-2026-112910"],"sourceIds":["GHSA-8mx5-7m5m-r77g"],"published":"2026-10-28T21:08:55Z","modified":"2026-10-28T21:15:05.688436299Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/835"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3","pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-8qvm-5x2c-j2w7","slug":"ghsa-8qvm-5x2c-j2w7-8a075519","dossier":false,"summary":"protobuf-python has a potential Denial of Service issue","aliases":["CVE-2025-4565","PYSEC-2026-1806"],"sourceIds":["GHSA-8qvm-5x2c-j2w7","PYSEC-2026-1806"],"published":"2025-06-16T16:02:58Z","modified":"2026-09-10T03:50:25.255076549Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8qvm-5x2c-j2w7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-8v84-f9pq-wr9x","slug":"ghsa-8v84-f9pq-wr9x-6c1b185f","dossier":false,"summary":"Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading","aliases":["BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253"],"sourceIds":["GHSA-8v84-f9pq-wr9x","PYSEC-2026-2253"],"published":"2026-07-06T19:17:08.127Z","modified":"2026-09-10T03:51:11.229114807Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54059"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2253.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-9356-575x-2w9m","slug":"ghsa-9356-575x-2w9m-908a1f8c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-5197","PYSEC-2026-1983"],"sourceIds":["GHSA-9356-575x-2w9m","PYSEC-2026-1983"],"published":"2025-08-06T12:31:20Z","modified":"2026-09-10T03:50:26.988216861Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5197"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/701caef704e356dc2f9331cc3fd5df0eccb4720a"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/944b56000be5e9b61af8301aa340838770ad8a0b"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3f8b3fd0-166b-46e7-b60f-60dd9d2678bf"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9356-575x-2w9m"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-9548-qrrj-x5pj","slug":"ghsa-9548-qrrj-x5pj-6121f213","dossier":false,"summary":"AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections","aliases":["CVE-2025-53643","PYSEC-2026-1104"],"sourceIds":["GHSA-9548-qrrj-x5pj","PYSEC-2026-1104"],"published":"2025-07-14T19:33:31Z","modified":"2026-09-10T03:50:26.231846188Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53643"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9548-qrrj-x5pj"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-966j-vmvw-g2g9","slug":"ghsa-966j-vmvw-g2g9-dad9a989","dossier":false,"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","aliases":["CVE-2026-34518","PYSEC-2026-2100"],"sourceIds":["GHSA-966j-vmvw-g2g9","PYSEC-2026-2100"],"published":"2026-04-01T21:17:00.020Z","modified":"2026-09-10T03:51:01.374434696Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-966j-vmvw-g2g9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34518"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/5351c980dcec7ad385730efdf4e1f4338b24fdb6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-9hjg-9r4m-mvj7","slug":"ghsa-9hjg-9r4m-mvj7-32d7b63e","dossier":false,"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","aliases":["CVE-2024-47081","PYSEC-2026-1872"],"sourceIds":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"published":"2025-06-09T19:06:08Z","modified":"2026-10-19T20:00:04.716114530Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"FIX","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://github.com/psf/requests/releases/tag/v2.32.4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/requests/PYSEC-2026-1872.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-9hw9-ch79-4vh6","slug":"ghsa-9hw9-ch79-4vh6-1ebda54f","dossier":false,"summary":"Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch","aliases":["BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453"],"sourceIds":["GHSA-9hw9-ch79-4vh6","PYSEC-2026-3453"],"published":"2026-07-14T16:17:02.370Z","modified":"2026-09-10T03:51:11.334365483Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59205"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3453.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-9v9v-9qvf-h2hj","slug":"ghsa-9v9v-9qvf-h2hj-0344c250","dossier":false,"summary":"Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)","aliases":["BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343"],"sourceIds":["GHSA-9v9v-9qvf-h2hj","PYSEC-2026-4343"],"published":"2026-10-21T21:20:32.943Z","modified":"2026-10-29T10:55:35.129178084Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9v9v-9qvf-h2hj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96644"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10120"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/4cf46bee338304c5c8968fd7f132ba0d40c428b7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-9vhv-jxww-xfm5","slug":"ghsa-9vhv-jxww-xfm5-e19a009a","dossier":false,"summary":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","aliases":["CVE-2026-112913"],"sourceIds":["GHSA-9vhv-jxww-xfm5"],"published":"2026-10-23T22:28:19Z","modified":"2026-10-23T22:45:03.439584635Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-9wx4-h78v-vm56","slug":"ghsa-9wx4-h78v-vm56-6a334c57","dossier":false,"summary":"Requests `Session` object does not verify requests after making first request with verify=False","aliases":["CVE-2024-35195","PYSEC-2026-1873"],"sourceIds":["GHSA-9wx4-h78v-vm56","PYSEC-2026-1873"],"published":"2024-05-20T20:15:00Z","modified":"2026-09-10T03:50:13.740879755Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"FIX","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wx4-h78v-vm56"}],"versionKeys":["pypi:requests@2.31.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-9x8q-7h8h-wcw9","slug":"ghsa-9x8q-7h8h-wcw9-af94166e","dossier":false,"summary":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect","aliases":["CVE-2026-54280","PYSEC-2026-2113"],"sourceIds":["GHSA-9x8q-7h8h-wcw9","PYSEC-2026-2113"],"published":"2026-06-15T20:10:44Z","modified":"2026-09-10T03:50:55.382836820Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9x8q-7h8h-wcw9"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/a762eda5242f6490d6ba667533193f8b473ad587"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-9xw5-w5jj-pvcg","slug":"ghsa-9xw5-w5jj-pvcg-5b93a500","dossier":false,"summary":"AIOHTTP: File descriptor exhaustion in multipart requests","aliases":["CVE-2026-111066"],"sourceIds":["GHSA-9xw5-w5jj-pvcg"],"published":"2026-10-20T19:52:09Z","modified":"2026-10-20T20:00:04.692319554Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9xw5-w5jj-pvcg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111066"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/2d94633b7f1b4c1ba07d647b629a8440652b2d09"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-c427-h43c-vf67","slug":"ghsa-c427-h43c-vf67-fa5b38aa","dossier":false,"summary":"AIOHTTP accepts duplicate Host headers","aliases":["CVE-2026-34525","PYSEC-2026-2103"],"sourceIds":["GHSA-c427-h43c-vf67","PYSEC-2026-2103"],"published":"2026-04-01T21:17:00.490Z","modified":"2026-09-10T03:51:01.505705751Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-c427-h43c-vf67"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34525"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-c678-jfcj-6jmf","slug":"ghsa-c678-jfcj-6jmf-cd9a8774","dossier":false,"summary":"PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument","aliases":["BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189"],"sourceIds":["GHSA-c678-jfcj-6jmf"],"published":"2025-03-10T12:30:55Z","modified":"2026-06-09T21:26:06.844649427Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2148"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147722"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-189.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/blob/b0a67c7495bb11ecb23e556058db059ba48354af/torch/autograd/profiler.py#L990"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299059"},{"type":"WEB","url":"https://vuldb.com/?id.299059"},{"type":"WEB","url":"https://vuldb.com/?submit.505959"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-c6hw-5grf-ff96","slug":"ghsa-c6hw-5grf-ff96-1e7aec72","dossier":false,"summary":"Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels","aliases":["BIT-pillow-2026-112404","CVE-2026-112404"],"sourceIds":["GHSA-c6hw-5grf-ff96"],"published":"2026-10-20T20:42:00Z","modified":"2026-10-26T08:55:55.669563065Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112404"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-cfh3-3jmp-rvhc","slug":"ghsa-cfh3-3jmp-rvhc-4e95572c","dossier":false,"summary":"Pillow affected by out-of-bounds write when loading PSD images","aliases":["BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"sourceIds":["GHSA-cfh3-3jmp-rvhc","PYSEC-2026-2249"],"published":"2026-02-11T14:22:50Z","modified":"2026-09-10T03:50:59.393816085Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-25990"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4942"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0"],"packageCount":1,"repositoryCount":16},{"id":"GHSA-cgwc-pv48-fhj5","slug":"ghsa-cgwc-pv48-fhj5-6739bcab","dossier":false,"summary":"python-engineio has unbound thread allocation that can cause denial of service","aliases":["CVE-2026-48802","PYSEC-2026-3032"],"sourceIds":["GHSA-cgwc-pv48-fhj5","PYSEC-2026-3032"],"published":"2026-06-26T20:51:37Z","modified":"2026-07-13T16:42:35.099677221Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-cgwc-pv48-fhj5"},{"type":"PACKAGE","url":"https://github.com/miguelgrinberg/python-engineio"},{"type":"PACKAGE","url":"https://pypi.org/project/python-engineio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cgwc-pv48-fhj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48802"}],"versionKeys":["pypi:python-engineio@4.12.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-cp9v-662q-vvx9","slug":"ghsa-cp9v-662q-vvx9-b0a60d48","dossier":false,"summary":"Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0","aliases":["BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333"],"sourceIds":["GHSA-cp9v-662q-vvx9","PYSEC-2026-4333"],"published":"2026-10-19T22:17:08.027Z","modified":"2026-10-28T11:10:36.014536437Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cp9v-662q-vvx9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112405"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b6ee66e8b2c2c0932bdf65f963268d9f2927ef86"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-cpwx-vrp4-4pq7","slug":"ghsa-cpwx-vrp4-4pq7-799bdc98","dossier":false,"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","aliases":["CVE-2025-27516","PYSEC-2026-1471"],"sourceIds":["GHSA-cpwx-vrp4-4pq7","PYSEC-2026-1471"],"published":"2025-03-05T20:40:14Z","modified":"2026-09-10T03:49:48.526758681Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cpwx-vrp4-4pq7"}],"versionKeys":["pypi:jinja2@3.1.3","pypi:jinja2@3.1.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-cq5v-8q36-5273","slug":"ghsa-cq5v-8q36-5273-b5e8d025","dossier":false,"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)","aliases":["CVE-2026-69244","PYSEC-2026-3545"],"sourceIds":["GHSA-cq5v-8q36-5273","PYSEC-2026-3545"],"published":"2026-08-03T20:51:13Z","modified":"2026-09-10T03:51:13.983479281Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-cq5v-8q36-5273"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13223"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/49f65d54150397892f7bcc4aae887767d51c322d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.3"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cq5v-8q36-5273"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69244"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-cwqr-hh33-gh44","slug":"ghsa-cwqr-hh33-gh44-4ee53d3a","dossier":false,"summary":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","aliases":["CVE-2026-112915"],"sourceIds":["GHSA-cwqr-hh33-gh44"],"published":"2026-10-28T21:08:49Z","modified":"2026-10-28T21:15:04.923553251Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112915"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-cx63-2mw6-8hw5","slug":"ghsa-cx63-2mw6-8hw5-1754ad59","dossier":false,"summary":"setuptools vulnerable to Command Injection via package URL","aliases":["BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918"],"sourceIds":["GHSA-cx63-2mw6-8hw5","PYSEC-2026-1918"],"published":"2024-07-15T03:30:57Z","modified":"2026-09-10T03:50:16.663495061Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345"},{"type":"WEB","url":"https://github.com/pypa/setuptools/pull/4332"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"},{"type":"PACKAGE","url":"https://pypi.org/project/setuptools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cx63-2mw6-8hw5"}],"versionKeys":["pypi:setuptools@69.2.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f2g6-542v-9j58","slug":"ghsa-f2g6-542v-9j58-1b810101","dossier":false,"summary":"Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle","aliases":["BIT-pillow-2026-112406","CVE-2026-112406"],"sourceIds":["GHSA-f2g6-542v-9j58"],"published":"2026-10-21T21:21:07Z","modified":"2026-10-26T08:56:13.538142549Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-f2g6-542v-9j58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112406"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/b3ebf20c694f2f12537a629c30229a1d5a53f777"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-f4hp-rmr7-r7v8","slug":"ghsa-f4hp-rmr7-r7v8-fe038cb7","dossier":false,"summary":"PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function","aliases":["BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192"],"sourceIds":["GHSA-f4hp-rmr7-r7v8"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-09T22:11:09.050788278Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2998"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-192.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302047"},{"type":"WEB","url":"https://vuldb.com/?id.302047"},{"type":"WEB","url":"https://vuldb.com/?submit.524151"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-f96h-pmfr-66vw","slug":"ghsa-f96h-pmfr-66vw-6763f20e","dossier":false,"summary":"Starlette Denial of service (DoS) via multipart/form-data","aliases":["CVE-2024-47874","PYSEC-2026-1943"],"sourceIds":["GHSA-f96h-pmfr-66vw","PYSEC-2026-1943"],"published":"2024-10-15T18:12:57Z","modified":"2026-09-10T03:50:19.756287586Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/encode/starlette/security/advisories/GHSA-f96h-pmfr-66vw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47874"},{"type":"FIX","url":"https://github.com/encode/starlette/commit/fd038f3070c302bff17ef7d173dbb0b007617733"},{"type":"PACKAGE","url":"https://github.com/encode/starlette"},{"type":"PACKAGE","url":"https://pypi.org/project/starlette"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f96h-pmfr-66vw"}],"versionKeys":["pypi:starlette@0.37.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f9vj-2wh5-fj8j","slug":"ghsa-f9vj-2wh5-fj8j-f0f29e2a","dossier":false,"summary":"Werkzeug safe_join not safe on Windows","aliases":["CVE-2024-49766","PYSEC-2026-2045"],"sourceIds":["GHSA-f9vj-2wh5-fj8j","PYSEC-2026-2045"],"published":"2024-10-25T19:43:41Z","modified":"2026-09-10T03:50:19.894904779Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49766"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250131-0005"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f9vj-2wh5-fj8j"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f9xw-jh8m-3mwq","slug":"ghsa-f9xw-jh8m-3mwq-43205cf6","dossier":false,"summary":"AIOHTTP: Absolute-form request targets can spoof Request.scheme","aliases":["CVE-2026-111748"],"sourceIds":["GHSA-f9xw-jh8m-3mwq"],"published":"2026-10-20T20:01:40Z","modified":"2026-10-20T20:15:05.218624757Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-f9xw-jh8m-3mwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111748"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6d4e7b01f9b951aa084a75d7356e907d4ee80411"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-fc9g-5qg7-mf45","slug":"ghsa-fc9g-5qg7-mf45-6ce92387","dossier":false,"summary":"Pillow: Quadratic GIF comment copying during save","aliases":["BIT-pillow-2026-112891","CVE-2026-112891"],"sourceIds":["GHSA-fc9g-5qg7-mf45"],"published":"2026-10-21T20:38:43Z","modified":"2026-10-26T08:56:06.483214483Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fc9g-5qg7-mf45"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112891"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/68a3fe957d8a4d552e8c69d96066d749f0614c7e"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-fgcw-684q-jj6r","slug":"ghsa-fgcw-684q-jj6r-9fe55ba1","dossier":false,"summary":"huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path","aliases":["CVE-2026-5241","PYSEC-2026-2290"],"sourceIds":["GHSA-fgcw-684q-jj6r","PYSEC-2026-2290"],"published":"2026-06-03T14:16:46.337Z","modified":"2026-09-10T03:50:49.345942449Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5241"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/676559d5022b74aaa0cee1cee0842b7f27c5320e"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:42644"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-5241"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484384"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2026-2290.yaml"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/ceb3ce1a-4c45-497a-b25e-cb9a7685e619"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5241.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fgcw-684q-jj6r"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-fh55-r93g-j68g","slug":"ghsa-fh55-r93g-j68g-a231bc8e","dossier":false,"summary":"AIOHTTP Vulnerable to Cookie Parser Warning Storm","aliases":["CVE-2025-69230","PYSEC-2026-1105"],"sourceIds":["GHSA-fh55-r93g-j68g","PYSEC-2026-1105"],"published":"2026-01-05T23:13:46Z","modified":"2026-09-10T03:50:33.047685052Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-fh55-r93g-j68g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69230"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/64629a0834f94e46d9881f4e99c41a137e1f3326"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fh55-r93g-j68g"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-fj7v-r99m-22gq","slug":"ghsa-fj7v-r99m-22gq-e36cfebd","dossier":false,"summary":"Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images","aliases":["BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494"],"sourceIds":["GHSA-fj7v-r99m-22gq","PYSEC-2026-3494"],"published":"2026-07-20T23:09:36Z","modified":"2026-09-10T03:50:51.891240357Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-fj7v-r99m-22gq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59198"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9709"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/eada3cbd7fb9963ee90673fb7b5270124a0d5f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fj7v-r99m-22gq"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-fpwr-67px-3qhx","slug":"ghsa-fpwr-67px-3qhx-94f30126","dossier":false,"summary":"Transformers Regular Expression Denial of Service (ReDoS) vulnerability","aliases":["CVE-2025-1194","PYSEC-2026-1984"],"sourceIds":["GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"published":"2025-04-29T12:30:21Z","modified":"2026-08-13T20:11:58.399313771Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1194"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/92c5ca9dd70de3ade2af2eb835c96215cc50e815"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/86f58dcd-683f-4adc-a735-849f51e9abb2"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fpwr-67px-3qhx"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-fq56-3cx3-fjxp","slug":"ghsa-fq56-3cx3-fjxp-d2885806","dossier":false,"summary":"filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders","aliases":["CVE-2026-112935"],"sourceIds":["GHSA-fq56-3cx3-fjxp"],"published":"2026-10-28T21:08:08Z","modified":"2026-10-28T21:15:04.933315565Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112935"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/843"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-g3cq-j2xw-wf74","slug":"ghsa-g3cq-j2xw-wf74-4475e17b","dossier":false,"summary":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup","aliases":["CVE-2026-54278","PYSEC-2026-2111"],"sourceIds":["GHSA-g3cq-j2xw-wf74","PYSEC-2026-2111"],"published":"2026-06-15T20:09:51Z","modified":"2026-09-10T03:51:08.751749295Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g3cq-j2xw-wf74"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-g4qv-2jxx-769h","slug":"ghsa-g4qv-2jxx-769h-01f137f2","dossier":false,"summary":"Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time","aliases":["BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342"],"sourceIds":["GHSA-g4qv-2jxx-769h","PYSEC-2026-4342"],"published":"2026-10-21T21:20:32.797Z","modified":"2026-10-29T10:55:44.091799759Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g4qv-2jxx-769h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96643"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10073"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/806e38381c781f32bbd22f4cd026678acd40fd6c"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-g6x2-hccm-hh4m","slug":"ghsa-g6x2-hccm-hh4m-e6759829","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2026-102598","PYSEC-2026-4312"],"sourceIds":["GHSA-g6x2-hccm-hh4m","PYSEC-2026-4312"],"published":"2026-10-05T23:48:39Z","modified":"2026-10-15T14:56:11.020811348Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102598"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/pull/3309"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.9"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g6x2-hccm-hh4m"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3","pypi:werkzeug@3.1.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-g7cr-3p24-7wf7","slug":"ghsa-g7cr-3p24-7wf7-568f0c0a","dossier":false,"summary":"Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer","aliases":["BIT-pillow-2026-96778","CVE-2026-96778"],"sourceIds":["GHSA-g7cr-3p24-7wf7"],"published":"2026-10-22T16:05:39Z","modified":"2026-10-29T10:56:05.933422167Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g7cr-3p24-7wf7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96778"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10124"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/02561b8dc6117d5670d4b469fecdd02c70854f9b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-g7vv-2v7x-gj9p","slug":"ghsa-g7vv-2v7x-gj9p-5ef970c3","dossier":false,"summary":"tqdm CLI arguments injection attack","aliases":["CVE-2024-34062","PYSEC-2026-1976"],"sourceIds":["GHSA-g7vv-2v7x-gj9p","PYSEC-2026-1976"],"published":"2024-05-03T19:33:28Z","modified":"2026-09-10T03:50:13.776534451Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tqdm/tqdm/security/advisories/GHSA-g7vv-2v7x-gj9p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34062"},{"type":"WEB","url":"https://github.com/tqdm/tqdm/commit/4e613f84ed2ae029559f539464df83fa91feb316"},{"type":"PACKAGE","url":"https://github.com/tqdm/tqdm"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRECVQCCESHBS3UJOWNXQUIX725TKNY6"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VA337CYUS4SLRFV2P6MX6MZ2LKFURKJC"},{"type":"PACKAGE","url":"https://pypi.org/project/tqdm"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g7vv-2v7x-gj9p"}],"versionKeys":["pypi:tqdm@4.66.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-g842-9rc4-69pw","slug":"ghsa-g842-9rc4-69pw-38a3cbdb","dossier":false,"summary":"Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS","aliases":["BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338"],"sourceIds":["GHSA-g842-9rc4-69pw","PYSEC-2026-4338"],"published":"2026-10-21T21:20:31.927Z","modified":"2026-10-29T10:55:56.102454725Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-g842-9rc4-69pw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96637"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10076"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/7cb0e02389d8aac2a60896a490f572db0b07b841"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-g84x-mcqj-x9qq","slug":"ghsa-g84x-mcqj-x9qq-fc677e5d","dossier":false,"summary":"AIOHTTP vulnerable to DoS through chunked messages","aliases":["CVE-2025-69229","PYSEC-2026-1106"],"sourceIds":["GHSA-g84x-mcqj-x9qq","PYSEC-2026-1106"],"published":"2026-01-05T23:13:29Z","modified":"2026-09-10T03:50:33.073865205Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-g84x-mcqj-x9qq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/4ed97a4e46eaf61bd0f05063245f613469700229"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/dc3170b56904bdf814228fae70a5501a42a6c712"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-g84x-mcqj-x9qq"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-gc5v-m9x4-r6x2","slug":"ghsa-gc5v-m9x4-r6x2-b9828ad8","dossier":false,"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","aliases":["CVE-2026-25645","PYSEC-2026-2275"],"sourceIds":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"published":"2026-03-25T16:56:28Z","modified":"2026-09-10T03:50:39.207922076Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"FIX","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"ADVISORY","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3","pypi:requests@2.32.4","pypi:requests@2.32.5"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-gg2r-wvfm-q9rx","slug":"ghsa-gg2r-wvfm-q9rx-9e34ef8d","dossier":false,"summary":"Pillow: MSP RLE decoder expands a tiny file into unbounded memory","aliases":["BIT-pillow-2026-112892","CVE-2026-112892"],"sourceIds":["GHSA-gg2r-wvfm-q9rx"],"published":"2026-10-21T21:12:56Z","modified":"2026-10-26T08:55:54.537605973Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-gg2r-wvfm-q9rx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112892"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/5dcb630b9798efd91929cb873d677aeee6ed0bb3"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-gh4c-6fx4-qh6g","slug":"ghsa-gh4c-6fx4-qh6g-a56f6cb1","dossier":false,"summary":"urllib3: Chunked Deflate streaming can enter an infinite loop","aliases":["CVE-2026-97688","PYSEC-2026-4176"],"sourceIds":["GHSA-gh4c-6fx4-qh6g","PYSEC-2026-4176"],"published":"2026-09-30T15:00:38Z","modified":"2026-10-01T17:55:40.608255720Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g"}],"versionKeys":["pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-gm62-xv2j-4w53","slug":"ghsa-gm62-xv2j-4w53-5befa184","dossier":false,"summary":"urllib3 allows an unbounded number of links in the decompression chain","aliases":["CVE-2025-66418","PYSEC-2026-1998"],"sourceIds":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"published":"2025-12-05T18:15:19Z","modified":"2026-09-10T03:50:58.741847479Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gm62-xv2j-4w53"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-gmj6-6f8f-6699","slug":"ghsa-gmj6-6f8f-6699-e3e02f35","dossier":false,"summary":"Jinja has a sandbox breakout through malicious filenames","aliases":["CVE-2024-56201","PYSEC-2026-1472"],"sourceIds":["GHSA-gmj6-6f8f-6699","PYSEC-2026-1472"],"published":"2024-12-23T17:54:12Z","modified":"2026-09-10T03:50:56.152882717Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gmj6-6f8f-6699"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gx76-c99x-2c96","slug":"ghsa-gx76-c99x-2c96-30159937","dossier":false,"summary":"AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies","aliases":["CVE-2026-111749"],"sourceIds":["GHSA-gx76-c99x-2c96"],"published":"2026-10-20T19:58:14Z","modified":"2026-10-20T20:15:05.188135798Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gx76-c99x-2c96"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111749"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6a07c171ef9f3be583e2907dcd1931372efca8d6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-h35f-9h28-mq5c","slug":"ghsa-h35f-9h28-mq5c-f3238ba1","dossier":false,"summary":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","aliases":["BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447"],"sourceIds":["GHSA-h35f-9h28-mq5c","PYSEC-2026-3447"],"published":"2026-07-08T17:17:27.020Z","modified":"2026-09-10T03:50:52.323347787Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}],"references":[{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"ADVISORY","url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0","pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-h75v-3vvj-5mfj","slug":"ghsa-h75v-3vvj-5mfj-d8fc6bb7","dossier":false,"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","aliases":["CVE-2024-34064","PYSEC-2026-1474"],"sourceIds":["GHSA-h75v-3vvj-5mfj","PYSEC-2026-1474"],"published":"2024-05-06T14:20:59Z","modified":"2026-09-10T03:50:13.786450101Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h75v-3vvj-5mfj"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hcc4-c3v8-rx92","slug":"ghsa-hcc4-c3v8-rx92-ddf32b5c","dossier":false,"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector","aliases":["CVE-2026-34513","PYSEC-2026-2095"],"sourceIds":["GHSA-hcc4-c3v8-rx92","PYSEC-2026-2095"],"published":"2026-04-01T21:16:59.267Z","modified":"2026-09-10T03:51:02.067006429Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hcc4-c3v8-rx92"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34513"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/c4d77c3533122be353b8afca8e8675e3b4cbda98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-hg6j-4rv6-33pg","slug":"ghsa-hg6j-4rv6-33pg-d0ac8db0","dossier":false,"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies","aliases":["CVE-2026-47265","PYSEC-2026-2105"],"sourceIds":["GHSA-hg6j-4rv6-33pg","PYSEC-2026-2105"],"published":"2026-06-02T20:16:37.903Z","modified":"2026-09-10T03:50:49.888335735Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hg6j-4rv6-33pg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47265"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-hgf8-39gv-g3f2","slug":"ghsa-hgf8-39gv-g3f2-0469b394","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2025-66221","PYSEC-2026-2046"],"sourceIds":["GHSA-hgf8-39gv-g3f2","PYSEC-2026-2046"],"published":"2025-12-02T00:27:38Z","modified":"2026-09-10T03:50:31.900494607Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66221"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.4"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hgf8-39gv-g3f2"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-hpj7-wq8m-9hgp","slug":"ghsa-hpj7-wq8m-9hgp-fac25647","dossier":false,"summary":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges","aliases":["CVE-2026-54276","PYSEC-2026-2109"],"sourceIds":["GHSA-hpj7-wq8m-9hgp","PYSEC-2026-2109"],"published":"2026-06-15T20:09:06Z","modified":"2026-09-10T03:50:49.899674354Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58fa"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-hx9q-6w63-j58v","slug":"ghsa-hx9q-6w63-j58v-8d6e2248","dossier":false,"summary":"orjson does not limit recursion for deeply nested JSON documents","aliases":["CVE-2025-67221","PYSEC-2026-107"],"sourceIds":["GHSA-hx9q-6w63-j58v","PYSEC-2026-107"],"published":"2026-01-22T17:16:01.433Z","modified":"2026-09-10T03:50:33.258377926Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67221"},{"type":"WEB","url":"https://github.com/ijl/orjson/issues/620"},{"type":"WEB","url":"https://github.com/kpatsakis/CVE-2025-67221/issues/1"},{"type":"WEB","url":"https://github.com/ijl/orjson/commit/62bb185b70785ded49c79c26f8c9781f1e6fe370"},{"type":"PACKAGE","url":"https://github.com/ijl/orjson"},{"type":"EVIDENCE","url":"https://github.com/kpatsakis/orjson_vulnerability"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/orjson/PYSEC-2026-107.yaml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hx9q-6w63-j58v"}],"versionKeys":["pypi:orjson@3.10.14","pypi:orjson@3.10.15","pypi:orjson@3.11.4","pypi:orjson@3.11.5"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-hxxf-235m-72v3","slug":"ghsa-hxxf-235m-72v3-21da19b0","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11394","PYSEC-2024-229"],"sourceIds":["GHSA-hxxf-235m-72v3","PYSEC-2024-229"],"published":"2024-11-22T22:15:07Z","modified":"2026-09-10T03:50:20.811665084Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11394"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-229.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1515/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxxf-235m-72v3"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-j4m9-6w36-pw47","slug":"ghsa-j4m9-6w36-pw47-8a42e0dd","dossier":false,"summary":"Pillow: Invalid free in FreeType glyph rendering when a stroker is active","aliases":["BIT-pillow-2026-112893","CVE-2026-112893"],"sourceIds":["GHSA-j4m9-6w36-pw47"],"published":"2026-10-21T20:06:34Z","modified":"2026-10-26T08:55:43.891551666Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-j4m9-6w36-pw47"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112893"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a7416de7f3a43128179d2cf68df3240ea8dafe13"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-j586-36cw-2gc2","slug":"ghsa-j586-36cw-2gc2-1c16441e","dossier":false,"summary":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","aliases":["CVE-2026-114613"],"sourceIds":["GHSA-j586-36cw-2gc2"],"published":"2026-10-27T15:04:07Z","modified":"2026-10-27T15:15:08.389118415Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114613"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141"},{"type":"PACKAGE","url":"https://github.com/msgpack/msgpack-python"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3"}],"versionKeys":["pypi:msgpack@1.1.0","pypi:msgpack@1.1.1","pypi:msgpack@1.1.2","pypi:msgpack@1.2.1"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-j8f7-rjxc-mr56","slug":"ghsa-j8f7-rjxc-mr56-f1c144ea","dossier":false,"summary":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","aliases":["CVE-2026-112936"],"sourceIds":["GHSA-j8f7-rjxc-mr56"],"published":"2026-10-28T21:08:30Z","modified":"2026-10-28T21:15:04.169983430Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112936"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.0.9"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-jg22-mg44-37j8","slug":"ghsa-jg22-mg44-37j8-b8064c77","dossier":false,"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","aliases":["CVE-2026-34993","PYSEC-2026-2104"],"sourceIds":["GHSA-jg22-mg44-37j8","PYSEC-2026-2104"],"published":"2026-06-02T20:16:34.857Z","modified":"2026-09-10T03:51:08.847676311Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34993"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-34993"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34993.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34456"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484099"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-jg86-v3jv-hrpm","slug":"ghsa-jg86-v3jv-hrpm-1380c45f","dossier":false,"summary":"Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)","aliases":["BIT-pillow-2026-112894","CVE-2026-112894"],"sourceIds":["GHSA-jg86-v3jv-hrpm"],"published":"2026-10-21T21:11:44Z","modified":"2026-10-26T08:56:08.669907131Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jg86-v3jv-hrpm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112894"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-jj3x-wxrx-4x23","slug":"ghsa-jj3x-wxrx-4x23-407bafac","dossier":false,"summary":"AIOHTTP vulnerable to DoS when bypassing asserts","aliases":["CVE-2025-69227","PYSEC-2026-1107"],"sourceIds":["GHSA-jj3x-wxrx-4x23","PYSEC-2026-1107"],"published":"2026-01-05T23:10:15Z","modified":"2026-09-10T03:50:33.308966616Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69227"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jj3x-wxrx-4x23"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-jjj6-mw9f-p565","slug":"ghsa-jjj6-mw9f-p565-ed2d1f46","dossier":false,"summary":"Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()","aliases":["BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495"],"sourceIds":["GHSA-jjj6-mw9f-p565","PYSEC-2026-3495"],"published":"2026-07-20T23:11:29Z","modified":"2026-09-10T03:50:12.341825852Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-jjj6-mw9f-p565"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59200"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9718"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/f7a31ea75e460e108c37126da1f47812f21f6b09"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjj6-mw9f-p565"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-jjph-296x-mrcr","slug":"ghsa-jjph-296x-mrcr-0f661d67","dossier":false,"summary":"Transformers vulnerable to ReDoS attack through its get_imports() function","aliases":["CVE-2025-3264","PYSEC-2026-1985"],"sourceIds":["GHSA-jjph-296x-mrcr","PYSEC-2026-1985"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:51.899728258Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3264"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/3c6f7822-9992-476d-8cf0-b0b1623427df"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jjph-296x-mrcr"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-jp4c-xjxw-mgf9","slug":"ghsa-jp4c-xjxw-mgf9-e780c8d6","dossier":false,"summary":"pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere","aliases":["CVE-2026-6357","PYSEC-2026-2876"],"sourceIds":["GHSA-jp4c-xjxw-mgf9","PYSEC-2026-2876"],"published":"2026-04-27T15:30:52Z","modified":"2026-09-10T03:50:44.656580653Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6357"},{"type":"WEB","url":"https://github.com/pypa/pip/pull/13923"},{"type":"WEB","url":"https://github.com/pypa/pip/commit/b369bfc96cc524e00c267e1693290e6599c36bad"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://ichard26.github.io/blog/2026/04/whats-new-in-pip-26.1/#security-fixes"},{"type":"PACKAGE","url":"https://pypi.org/project/pip"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jp4c-xjxw-mgf9"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-jp82-jpqv-5vv3","slug":"ghsa-jp82-jpqv-5vv3-4d50530e","dossier":false,"summary":"Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname","aliases":["CVE-2026-54282","PYSEC-2026-248"],"sourceIds":["GHSA-jp82-jpqv-5vv3","PYSEC-2026-248"],"published":"2026-06-15T20:38:08Z","modified":"2026-09-10T03:50:50.050800090Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-jp82-jpqv-5vv3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54282"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-248.yaml"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-jw8x-6495-233v","slug":"ghsa-jw8x-6495-233v-cb32b711","dossier":false,"summary":"scikit-learn sensitive data leakage vulnerability","aliases":["CVE-2024-5206","PYSEC-2024-110"],"sourceIds":["GHSA-jw8x-6495-233v","PYSEC-2024-110"],"published":"2024-06-06T19:16:00Z","modified":"2026-09-10T03:50:15.628224747Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-5206"},{"type":"FIX","url":"https://github.com/scikit-learn/scikit-learn/commit/70ca21f106b603b611da73012c9ade7cd8e438b8"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/scikit-learn/PYSEC-2024-110.yaml"},{"type":"PACKAGE","url":"https://github.com/scikit-learn/scikit-learn"},{"type":"WEB","url":"https://huntr.com/bounties/14bc0917-a85b-4106-a170-d09d5191517c"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-jw8x-6495-233v"}],"versionKeys":["pypi:scikit-learn@1.3.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-m5qp-6w8w-w647","slug":"ghsa-m5qp-6w8w-w647-495897bd","dossier":false,"summary":"AIOHTTP has a Multipart Header Size Bypass","aliases":["CVE-2026-34516","PYSEC-2026-2098"],"sourceIds":["GHSA-m5qp-6w8w-w647","PYSEC-2026-2098"],"published":"2026-04-01T21:16:59.723Z","modified":"2026-09-10T03:51:02.372876858Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m5qp-6w8w-w647"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34516"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-m6qw-4cw2-hm4m","slug":"ghsa-m6qw-4cw2-hm4m-3f6d3ee7","dossier":false,"summary":"aiohttp: CRLF injection in multipart headers","aliases":["CVE-2026-50269","PYSEC-2026-2106"],"sourceIds":["GHSA-m6qw-4cw2-hm4m","PYSEC-2026-2106"],"published":"2026-06-15T20:07:26Z","modified":"2026-09-10T03:51:09.078868018Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-m6qw-4cw2-hm4m"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-m9gh-vj53-gvh9","slug":"ghsa-m9gh-vj53-gvh9-764ccc6a","dossier":false,"summary":"python-engineio has possible denial of service due to maximum payload size sometimes not being enforced","aliases":["CVE-2026-48809","PYSEC-2026-3033"],"sourceIds":["GHSA-m9gh-vj53-gvh9","PYSEC-2026-3033"],"published":"2026-06-26T20:48:18Z","modified":"2026-07-13T16:43:30.815486921Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/miguelgrinberg/python-engineio/security/advisories/GHSA-m9gh-vj53-gvh9"},{"type":"PACKAGE","url":"https://github.com/miguelgrinberg/python-engineio"},{"type":"PACKAGE","url":"https://pypi.org/project/python-engineio"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-m9gh-vj53-gvh9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48809"}],"versionKeys":["pypi:python-engineio@4.12.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mf9v-mfxr-j63j","slug":"ghsa-mf9v-mfxr-j63j-1a7db6d4","dossier":false,"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","aliases":["CVE-2026-44432","PYSEC-2026-142"],"sourceIds":["GHSA-mf9v-mfxr-j63j","PYSEC-2026-142"],"published":"2026-05-11T14:51:45Z","modified":"2026-09-10T03:51:06.409994465Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-mf9w-mj56-hr94","slug":"ghsa-mf9w-mj56-hr94-a492e0f4","dossier":false,"summary":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","aliases":["CVE-2026-28684","PYSEC-2026-2270"],"sourceIds":["GHSA-mf9w-mj56-hr94","PYSEC-2026-2270"],"published":"2026-04-20T17:16:33.087Z","modified":"2026-09-10T03:51:02.363430883Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch"},{"type":"PACKAGE","url":"https://github.com/theskumar/python-dotenv"},{"type":"ADVISORY","url":"https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"}],"versionKeys":["pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-mfx4-hv73-q22v","slug":"ghsa-mfx4-hv73-q22v-b33d9650","dossier":false,"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade","aliases":["CVE-2026-69243","PYSEC-2026-3546"],"sourceIds":["GHSA-mfx4-hv73-q22v","PYSEC-2026-3546"],"published":"2026-08-03T20:46:10Z","modified":"2026-09-10T03:51:14.385788837Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/13017"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mfx4-hv73-q22v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-69243"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-mj87-hwqh-73pj","slug":"ghsa-mj87-hwqh-73pj-92a4d569","dossier":false,"summary":"python-multipart affected by Denial of Service via large multipart preamble or epilogue data","aliases":["CVE-2026-40347","PYSEC-2026-3038"],"sourceIds":["GHSA-mj87-hwqh-73pj","PYSEC-2026-3038"],"published":"2026-04-15T19:45:44Z","modified":"2026-09-10T03:51:02.322677211Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-mj87-hwqh-73pj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40347"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.26"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mj87-hwqh-73pj"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-mq26-g339-26xf","slug":"ghsa-mq26-g339-26xf-ed024c7e","dossier":false,"summary":"Command Injection in pip when used with Mercurial","aliases":["CVE-2023-5752","PYSEC-2023-228"],"sourceIds":["GHSA-mq26-g339-26xf","PYSEC-2023-228"],"published":"2023-10-25T18:17:00Z","modified":"2026-09-10T03:50:03.949904915Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5752"},{"type":"FIX","url":"https://github.com/pypa/pip/pull/12306"},{"type":"WEB","url":"https://github.com/pypa/pip/commit/389cb799d0da9a840749fcd14878928467ed49b4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2023-228.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00028.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/622OZXWG72ISQPLM5Y57YCVIMWHD4C3U"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FXUVMJM25PUAZRQZBF54OFVKTY3MINPW"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ"},{"type":"WEB","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/F4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mq26-g339-26xf"}],"versionKeys":["pypi:pip@22.0.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mq44-7p77-q5h7","slug":"ghsa-mq44-7p77-q5h7-6bd0337a","dossier":false,"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate","aliases":["CVE-2026-59881","PYSEC-2026-3547"],"sourceIds":["GHSA-mq44-7p77-q5h7","PYSEC-2026-3547"],"published":"2026-08-03T20:40:55Z","modified":"2026-09-10T03:51:14.489650589Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mq44-7p77-q5h7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59881"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/pull/12978"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mq44-7p77-q5h7"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-mqqc-3gqh-h2x8","slug":"ghsa-mqqc-3gqh-h2x8-6d702daf","dossier":false,"summary":"AIOHTTP has unicode match groups in regexes for ASCII protocol elements","aliases":["CVE-2025-69225","PYSEC-2026-1109"],"sourceIds":["GHSA-mqqc-3gqh-h2x8","PYSEC-2026-1109"],"published":"2026-01-05T23:09:30Z","modified":"2026-09-10T03:50:33.538693726Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mqqc-3gqh-h2x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69225"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/c7b7a044f88c71cefda95ec75cdcfaa4792b3b96"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"PACKAGE","url":"https://pypi.org/project/aiohttp"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mqqc-3gqh-h2x8"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-mrfp-p49p-3hf2","slug":"ghsa-mrfp-p49p-3hf2-6cfe1cba","dossier":false,"summary":"Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion","aliases":["BIT-pillow-2026-96640","CVE-2026-96640"],"sourceIds":["GHSA-mrfp-p49p-3hf2"],"published":"2026-10-22T16:00:47Z","modified":"2026-10-29T10:55:39.916451864Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-mrfp-p49p-3hf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96640"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/10093"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-mwh4-6h8g-pg8w","slug":"ghsa-mwh4-6h8g-pg8w-881420d8","dossier":false,"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase","aliases":["CVE-2026-34519","PYSEC-2026-2101"],"sourceIds":["GHSA-mwh4-6h8g-pg8w","PYSEC-2026-2101"],"published":"2026-04-01T21:17:00.170Z","modified":"2026-09-10T03:50:44.819886754Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mwh4-6h8g-pg8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34519"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-p4wg-p73j-c528","slug":"ghsa-p4wg-p73j-c528-fd1a8a19","dossier":false,"summary":"Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)","aliases":["BIT-pillow-2026-112895","CVE-2026-112895"],"sourceIds":["GHSA-p4wg-p73j-c528"],"published":"2026-10-20T20:50:49Z","modified":"2026-10-26T08:55:38.434240536Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-p4wg-p73j-c528"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112895"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/e2ae7eacad6de68c37eb28b633a97bebacf2c5bf"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-p8hx-v2p6-rp84","slug":"ghsa-p8hx-v2p6-rp84-525428cb","dossier":false,"summary":"Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)","aliases":["BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337"],"sourceIds":["GHSA-p8hx-v2p6-rp84","PYSEC-2026-4337"],"published":"2026-10-21T21:20:31.760Z","modified":"2026-10-29T10:55:49.521326948Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-p8hx-v2p6-rp84"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96636"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10011"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f1acfc54c53502948d0d14121872061df931db48"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-p998-jp59-783m","slug":"ghsa-p998-jp59-783m-17c88f0d","dossier":false,"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows","aliases":["CVE-2026-34515","PYSEC-2026-2097"],"sourceIds":["GHSA-p998-jp59-783m","PYSEC-2026-2097"],"published":"2026-04-01T21:16:59.570Z","modified":"2026-09-10T03:51:02.565661873Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-p998-jp59-783m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34515"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/0ae2aa076c84573df83fc1fdc39eec0f5862fe3d"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-pchr-8j38-3x4p","slug":"ghsa-pchr-8j38-3x4p-42f3b4df","dossier":false,"summary":"Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read","aliases":["BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334"],"sourceIds":["GHSA-pchr-8j38-3x4p","PYSEC-2026-4334"],"published":"2026-10-19T22:17:09.760Z","modified":"2026-10-28T11:10:41.233140457Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pchr-8j38-3x4p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112896"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/d03dc3c587a9b0bdc9e4304d70d59a635a87b742"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-pg7v-jwj7-p798","slug":"ghsa-pg7v-jwj7-p798-7c77aab5","dossier":false,"summary":"Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service","aliases":["BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452"],"sourceIds":["GHSA-pg7v-jwj7-p798","PYSEC-2026-3452"],"published":"2026-07-14T16:17:02.063Z","modified":"2026-09-10T03:50:52.876709782Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59203"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-3452.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-phhr-52qp-3mj4","slug":"ghsa-phhr-52qp-3mj4-6f5d82e3","dossier":false,"summary":"Transformers's Improper Input Validation vulnerability can be exploited through username injection","aliases":["CVE-2025-3777","PYSEC-2026-1986"],"sourceIds":["GHSA-phhr-52qp-3mj4","PYSEC-2026-1986"],"published":"2025-07-07T12:30:22Z","modified":"2026-09-10T03:50:26.198077196Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3777"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/4dda5f71b35fb70cf602187eef84bb17a50b9082"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/huggingface/transformers/blame/a7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4/src/transformers/image_utils.py"},{"type":"WEB","url":"https://huntr.com/bounties/ccba0730-9248-4853-b7ff-5c20e6364f09"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-phhr-52qp-3mj4"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-phj9-mv4w-65pm","slug":"ghsa-phj9-mv4w-65pm-481e7dc3","dossier":false,"summary":"Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`","aliases":["BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256"],"sourceIds":["GHSA-phj9-mv4w-65pm","PYSEC-2026-2256"],"published":"2026-07-06T19:17:08.703Z","modified":"2026-09-10T03:51:11.734605509Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55380"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-2256.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-pp6c-gr5w-3c5g","slug":"ghsa-pp6c-gr5w-3c5g-de40aafe","dossier":false,"summary":"python-multipart has Denial of Service via unbounded multipart part headers","aliases":["CVE-2026-42561","PYSEC-2026-3039"],"sourceIds":["GHSA-pp6c-gr5w-3c5g","PYSEC-2026-3039"],"published":"2026-05-06T21:56:14Z","modified":"2026-09-10T03:50:47.215892833Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42561"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pp6c-gr5w-3c5g"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-pq67-6m6q-mj2v","slug":"ghsa-pq67-6m6q-mj2v-3522d1d4","dossier":false,"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","aliases":["CVE-2025-50181","PYSEC-2026-1999"],"sourceIds":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"published":"2025-06-18T17:50:00Z","modified":"2026-09-10T03:50:25.299291456Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-pqxq-w44r-73xw","slug":"ghsa-pqxq-w44r-73xw-f260bc82","dossier":false,"summary":"AIOHTTP: Pure-Python parser request smuggling","aliases":["CVE-2026-111750"],"sourceIds":["GHSA-pqxq-w44r-73xw"],"published":"2026-10-20T19:52:21Z","modified":"2026-10-20T20:00:04.694820004Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L"}],"references":[{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-pqxq-w44r-73xw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111750"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/commit/9b27347e61454d9f8ca2055f4c67a37dee336e83"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"WEB","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.14.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5","pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-pwv6-vv43-88gr","slug":"ghsa-pwv6-vv43-88gr-c5f811d0","dossier":false,"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","aliases":["BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"sourceIds":["GHSA-pwv6-vv43-88gr","PYSEC-2026-2252"],"published":"2026-05-04T20:20:31Z","modified":"2026-09-10T03:50:47.242104143Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-q2wp-rjmx-x6x9","slug":"ghsa-q2wp-rjmx-x6x9-43135d3d","dossier":false,"summary":"Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking","aliases":["CVE-2025-3263","PYSEC-2026-1987"],"sourceIds":["GHSA-q2wp-rjmx-x6x9","PYSEC-2026-1987"],"published":"2025-07-07T12:30:22Z","modified":"2026-07-07T17:56:57.889099913Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3263"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/0720e206c6ba28887e4d60ef60a6a089f6c1cc76"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/126abe3461762e5fc180e7e614391d1b4ab051ca"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/c7a69150-54f8-4e81-8094-791e7a2a0f29"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q2x7-8rv6-6q7h","slug":"ghsa-q2x7-8rv6-6q7h-1113a288","dossier":false,"summary":"Jinja has a sandbox breakout through indirect reference to format method","aliases":["CVE-2024-56326","PYSEC-2026-1475"],"sourceIds":["GHSA-q2x7-8rv6-6q7h","PYSEC-2026-1475"],"published":"2024-12-23T17:56:08Z","modified":"2026-09-10T03:50:21.662855250Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2x7-8rv6-6q7h"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q34m-jh98-gwm2","slug":"ghsa-q34m-jh98-gwm2-76f8ef0b","dossier":false,"summary":"Werkzeug possible resource exhaustion when parsing file data in forms","aliases":["CVE-2024-49767","PYSEC-2026-1860","PYSEC-2026-3417"],"sourceIds":["GHSA-q34m-jh98-gwm2","PYSEC-2026-3417"],"published":"2024-10-25T19:44:43Z","modified":"2026-09-10T03:50:19.984825326Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49767"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250103-0007"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q34m-jh98-gwm2"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q45j-58j2-45rg","slug":"ghsa-q45j-58j2-45rg-cd238628","dossier":false,"summary":"Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips","aliases":["BIT-pillow-2026-112897","CVE-2026-112897"],"sourceIds":["GHSA-q45j-58j2-45rg"],"published":"2026-10-20T20:52:43Z","modified":"2026-10-26T08:56:08.265781051Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-q45j-58j2-45rg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112897"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-qccp-gfcp-xxvc","slug":"ghsa-qccp-gfcp-xxvc-0d988969","dossier":false,"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","aliases":["CVE-2026-44431","PYSEC-2026-141"],"sourceIds":["GHSA-qccp-gfcp-xxvc","PYSEC-2026-141"],"published":"2026-05-11T14:51:20Z","modified":"2026-09-10T03:50:47.272765640Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-qfhq-4f3w-5fph","slug":"ghsa-qfhq-4f3w-5fph-33bc3f14","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.lstm_cell function","aliases":["BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195"],"sourceIds":["GHSA-qfhq-4f3w-5fph"],"published":"2025-03-31T18:31:08Z","modified":"2026-06-10T18:26:26.736808954Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3001"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149626#issue-2935860995"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/999d94b5ede5f4ec111ba7dd144129e2c2725b03"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-195.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302050"},{"type":"WEB","url":"https://vuldb.com/?id.302050"},{"type":"WEB","url":"https://vuldb.com/?submit.524212"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-qmgc-5h2g-mvrw","slug":"ghsa-qmgc-5h2g-mvrw-199eacc8","dossier":false,"summary":"filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock","aliases":["CVE-2026-22701","PYSEC-2026-1374"],"sourceIds":["GHSA-qmgc-5h2g-mvrw","PYSEC-2026-1374"],"published":"2026-01-13T18:44:55Z","modified":"2026-09-10T03:50:33.702580779Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-qmgc-5h2g-mvrw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22701"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/255ed068bc85d1ef406e50a135e1459170dd1bf0"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qmgc-5h2g-mvrw"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-qq3j-4f4f-9583","slug":"ghsa-qq3j-4f4f-9583-cd76c72c","dossier":false,"summary":"Hugging Face Transformers Regular Expression Denial of Service","aliases":["CVE-2025-2099","PYSEC-2025-40"],"sourceIds":["GHSA-qq3j-4f4f-9583","PYSEC-2025-40"],"published":"2025-05-19T12:15:19Z","modified":"2026-06-10T17:02:48.111891265Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2099"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/36648"},{"type":"FIX","url":"https://github.com/huggingface/transformers/commit/8cb522b4190bd556ce51be04942720650b1a3e57"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2025-40.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/97b780f3-ffca-424f-ad5d-0e1c57a5bde4"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qq3j-4f4f-9583"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qqmf-gpg7-g8gw","slug":"ghsa-qqmf-gpg7-g8gw-3e372614","dossier":false,"summary":"PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters","aliases":["CVE-2026-58659","PYSEC-2026-3624","PYSEC-2026-3967"],"sourceIds":["GHSA-qqmf-gpg7-g8gw","PYSEC-2026-3624","PYSEC-2026-3967"],"published":"2026-07-15T18:16:48.743Z","modified":"2026-09-24T15:45:09.719284514Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58659"},{"type":"REPORT","url":"https://github.com/Lightning-AI/pytorch-lightning/issues/21822"},{"type":"FIX","url":"https://github.com/Lightning-AI/pytorch-lightning/pull/21832"},{"type":"FIX","url":"https://github.com/Lightning-AI/pytorch-lightning/commit/d710d689510d50e800f53b3cd773cbca20b1f86f"},{"type":"PACKAGE","url":"https://github.com/Lightning-AI/pytorch-lightning"},{"type":"WEB","url":"https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qqmf-gpg7-g8gw"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/lightning/PYSEC-2026-3624.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pytorch-lightning/PYSEC-2026-3967.yaml"},{"type":"FIX","url":"https://www.vulncheck.com/advisories/pytorch-lightning-arbitrary-code-execution-via-instantiator-hyperparameter"}],"versionKeys":["pypi:lightning@2.6.1","pypi:lightning@2.6.5","pypi:pytorch-lightning@2.6.1","pypi:pytorch-lightning@2.6.5"],"packageCount":2,"repositoryCount":2},{"id":"GHSA-qwm4-qh6w-59xr","slug":"ghsa-qwm4-qh6w-59xr-db792663","dossier":false,"summary":"pip would incorrectly handle doubly-encoded package URLs from indexes","aliases":["CVE-2026-13346","PYSEC-2026-3721"],"sourceIds":["GHSA-qwm4-qh6w-59xr","PYSEC-2026-3721"],"published":"2026-07-29T19:16:44.267Z","modified":"2026-09-10T11:15:08.939447160Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13346"},{"type":"FIX","url":"https://github.com/pypa/pip/pull/14110"},{"type":"WEB","url":"https://github.com/pypa/pip/commit/10dfb6b9005484578b386f64b9f36982e3dc6679"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-3721.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"WEB","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/L2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qwm4-qh6w-59xr"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1","pypi:pip@26.1.2"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-qxrp-vhvm-j765","slug":"ghsa-qxrp-vhvm-j765-63c6e9a2","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11392","PYSEC-2024-227"],"sourceIds":["GHSA-qxrp-vhvm-j765","PYSEC-2024-227"],"published":"2024-11-22T22:15:06Z","modified":"2026-09-10T03:50:21.016710762Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11392"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-227.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1513/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qxrp-vhvm-j765"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-r73j-pqj5-w3x7","slug":"ghsa-r73j-pqj5-w3x7-8d4d543f","dossier":false,"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","aliases":["BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"sourceIds":["GHSA-r73j-pqj5-w3x7","PYSEC-2026-2874"],"published":"2026-05-04T20:19:30Z","modified":"2026-09-10T03:50:55.309086884Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r73j-pqj5-w3x7"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-rcv9-qm8p-9p6j","slug":"ghsa-rcv9-qm8p-9p6j-edc1db04","dossier":false,"summary":"Hugging Face Transformers library has Regular Expression Denial of Service","aliases":["CVE-2025-6051","PYSEC-2026-1988"],"sourceIds":["GHSA-rcv9-qm8p-9p6j","PYSEC-2026-1988"],"published":"2025-09-14T18:30:26Z","modified":"2026-09-10T03:50:28.694224028Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6051"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/38844"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/54a02160eb030da9be18231c77791f2eb3a52216"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/ba8eaba9865618253f997784aa565b96206426f0"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/af929523-7b59-418a-bf55-301830b2ac9d"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-rcv9-qm8p-9p6j"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-rfgq-q3w2-pmv2","slug":"ghsa-rfgq-q3w2-pmv2-908c42cd","dossier":false,"summary":"Pillow: Image.quantize() with empty palette leaks uninitialized stack memory","aliases":["BIT-pillow-2026-112898","CVE-2026-112898"],"sourceIds":["GHSA-rfgq-q3w2-pmv2"],"published":"2026-10-21T20:44:07Z","modified":"2026-10-26T08:55:50.383984569Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-rfgq-q3w2-pmv2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112898"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13943c8f857b22f073d30f0ef9b725a0d255f1a4"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-rfpc-qcw5-3pc4","slug":"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","dossier":false,"summary":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","aliases":["CVE-2026-112939"],"sourceIds":["GHSA-rfpc-qcw5-3pc4"],"published":"2026-10-28T21:08:45Z","modified":"2026-10-28T21:15:05.584943666Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112939"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/836"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-rrmf-rvhw-rf47","slug":"ghsa-rrmf-rvhw-rf47-389d8330","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its torch.jit.script function","aliases":["BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194"],"sourceIds":["GHSA-rrmf-rvhw-rf47"],"published":"2025-03-31T15:30:48Z","modified":"2026-09-10T03:49:48.419046410Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3000"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149623#issue-2935703015"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/b90c94991cdf8b87c8f7439f79518e0ef2c4ca4f"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-194.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302049"},{"type":"WEB","url":"https://vuldb.com/?id.302049"},{"type":"WEB","url":"https://vuldb.com/?submit.524197"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-v4x8-3wr5-3wq8","slug":"ghsa-v4x8-3wr5-3wq8-fa48bf99","dossier":false,"summary":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","aliases":["CVE-2026-112940"],"sourceIds":["GHSA-v4x8-3wr5-3wq8"],"published":"2026-10-23T21:59:08Z","modified":"2026-10-23T22:15:04.432475030Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112940"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/pull/834"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/4.2.1"}],"versionKeys":["pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-v92g-xgxw-vvmm","slug":"ghsa-v92g-xgxw-vvmm-8ea08169","dossier":false,"summary":"Mako: Path traversal via double-slash URI prefix in TemplateLookup","aliases":["CVE-2026-41205","PYSEC-2026-88"],"sourceIds":["GHSA-v92g-xgxw-vvmm","PYSEC-2026-88"],"published":"2026-04-16T21:16:40Z","modified":"2026-09-10T03:51:03.377000392Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://github.com/sqlalchemy/mako/security/advisories/GHSA-v92g-xgxw-vvmm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41205"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/commit/e05ac61989a7fb9dd7dcde6cfd72dc48328719a3"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/mako/PYSEC-2026-88.yaml"},{"type":"PACKAGE","url":"https://github.com/sqlalchemy/mako"},{"type":"WEB","url":"https://github.com/sqlalchemy/mako/releases/tag/rel_1_3_11"}],"versionKeys":["pypi:mako@1.3.10","pypi:mako@1.3.8"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-v9pg-7xvm-68hf","slug":"ghsa-v9pg-7xvm-68hf-bd9c7524","dossier":false,"summary":"python-multipart: Negative Content-Length in parse_form buffers the entire body in memory","aliases":["CVE-2026-53540","PYSEC-2026-3040"],"sourceIds":["GHSA-v9pg-7xvm-68hf","PYSEC-2026-3040"],"published":"2026-06-15T20:23:45Z","modified":"2026-09-10T03:50:50.590441047Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-v9pg-7xvm-68hf"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-v9pg-7xvm-68hf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53540"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-v9pv-5gc8-w2m6","slug":"ghsa-v9pv-5gc8-w2m6-ece1573e","dossier":false,"summary":"Pillow multi-frame loaders can reuse stale native image storage after mode transitions","aliases":["BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339"],"sourceIds":["GHSA-v9pv-5gc8-w2m6","PYSEC-2026-4339"],"published":"2026-10-21T21:20:32.217Z","modified":"2026-10-29T10:55:37.663049285Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-v9pv-5gc8-w2m6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96639"},{"type":"REPORT","url":"https://github.com/python-pillow/Pillow/pull/10105"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/78d97d994579aef81aafe123773d525f40f2522a"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-vffw-93wf-4j4q","slug":"ghsa-vffw-93wf-4j4q-3828c302","dossier":false,"summary":"python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters","aliases":["CVE-2026-53537","PYSEC-2026-3041"],"sourceIds":["GHSA-vffw-93wf-4j4q","PYSEC-2026-3041"],"published":"2026-06-15T20:20:51Z","modified":"2026-09-10T03:50:50.585695996Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-vffw-93wf-4j4q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53537"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vffw-93wf-4j4q"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/blob/main/vulns/python-multipart/PYSEC-2026-3041.yaml"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-vgrw-7cvw-pwgx","slug":"ghsa-vgrw-7cvw-pwgx-766c6098","dossier":false,"summary":"PyTorch is vulnerable to memory corruption through its unpack_sequence function","aliases":["BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193"],"sourceIds":["GHSA-vgrw-7cvw-pwgx"],"published":"2025-03-31T15:30:48Z","modified":"2026-06-10T17:41:15.774477397Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2999"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/149622#issue-2935495265"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/commit/494518046816d29099b7d056a74ffa5c244fdcdd"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-193.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.302048"},{"type":"WEB","url":"https://vuldb.com/?id.302048"},{"type":"WEB","url":"https://vuldb.com/?submit.524198"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-vjc4-5qp5-m44j","slug":"ghsa-vjc4-5qp5-m44j-08063b19","dossier":false,"summary":"Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service","aliases":["BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496"],"sourceIds":["GHSA-vjc4-5qp5-m44j","PYSEC-2026-3496"],"published":"2026-07-20T23:18:32Z","modified":"2026-09-10T03:50:53.107920034Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vjc4-5qp5-m44j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59204"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9704"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vjc4-5qp5-m44j"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-vqfr-h8mv-ghfj","slug":"ghsa-vqfr-h8mv-ghfj-49515033","dossier":false,"summary":"h11 accepts some malformed Chunked-Encoding bodies","aliases":["CVE-2025-43859","PYSEC-2026-348"],"sourceIds":["GHSA-vqfr-h8mv-ghfj","PYSEC-2026-348"],"published":"2025-04-24T16:07:56Z","modified":"2026-10-27T16:45:03.535584040Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/python-hyper/h11/security/advisories/GHSA-vqfr-h8mv-ghfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-43859"},{"type":"WEB","url":"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/h11/PYSEC-2026-348.yaml"},{"type":"PACKAGE","url":"https://github.com/python-hyper/h11"},{"type":"PACKAGE","url":"https://pypi.org/project/h11"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vqfr-h8mv-ghfj"}],"versionKeys":["pypi:h11@0.14.0"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-vx6w-vv9f-6gvg","slug":"ghsa-vx6w-vv9f-6gvg-f0d0a86e","dossier":false,"summary":"Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit","aliases":["CVE-2026-112899"],"sourceIds":["GHSA-vx6w-vv9f-6gvg"],"published":"2026-10-20T20:53:21Z","modified":"2026-10-20T21:00:04.428653055Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-vx6w-vv9f-6gvg"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3e8cc105588d1dfe062fcada0b6058c1b5f14b65"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-vxq7-64xx-v4gw","slug":"ghsa-vxq7-64xx-v4gw-3e875898","dossier":true,"summary":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory","aliases":["CVE-2026-97689","PYSEC-2026-4177"],"sourceIds":["GHSA-vxq7-64xx-v4gw","PYSEC-2026-4177"],"published":"2026-09-30T14:46:18Z","modified":"2026-10-01T17:55:57.514829071Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.8.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3","pypi:urllib3@2.7.0"],"packageCount":1,"repositoryCount":22},{"id":"GHSA-w2fm-2cpv-w7v5","slug":"ghsa-w2fm-2cpv-w7v5-c2f7701a","dossier":false,"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage","aliases":["CVE-2026-22815","PYSEC-2026-2094"],"sourceIds":["GHSA-w2fm-2cpv-w7v5","PYSEC-2026-2094"],"published":"2026-04-01T19:45:17Z","modified":"2026-09-10T03:51:03.588955358Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-w2fm-2cpv-w7v5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22815"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/0c2e9da51126238a421568eb7c5b53e5b5d17b36"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/releases/tag/v3.13.4"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-w853-jp5j-5j7f","slug":"ghsa-w853-jp5j-5j7f-2786386f","dossier":false,"summary":"filelock has a TOCTOU race condition which allows symlink attacks during lock file creation","aliases":["CVE-2025-68146","PYSEC-2026-1375"],"sourceIds":["GHSA-w853-jp5j-5j7f","PYSEC-2026-1375"],"published":"2025-12-16T20:52:55Z","modified":"2026-09-10T03:50:32.252960082Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/tox-dev/filelock/security/advisories/GHSA-w853-jp5j-5j7f"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/commit/4724d7f8c3393ec1f048c93933e6e3e6ec321f0e"},{"type":"PACKAGE","url":"https://github.com/tox-dev/filelock"},{"type":"WEB","url":"https://github.com/tox-dev/filelock/releases/tag/3.20.1"},{"type":"WEB","url":"https://learn.microsoft.com/en-us/windows/win32/fileio/file-attribute-constants"},{"type":"WEB","url":"https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html"},{"type":"PACKAGE","url":"https://pypi.org/project/filelock"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-w853-jp5j-5j7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68146"}],"versionKeys":["pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0"],"packageCount":1,"repositoryCount":14},{"id":"GHSA-w889-685w-c8fh","slug":"ghsa-w889-685w-c8fh-9dd63a47","dossier":false,"summary":"Pillow: Argument Injection in Ghostscript call, potentially leading into RCE","aliases":["BIT-pillow-2026-112900","CVE-2026-112900"],"sourceIds":["GHSA-w889-685w-c8fh"],"published":"2026-10-21T19:58:44Z","modified":"2026-10-26T08:55:37.091976147Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-w889-685w-c8fh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112900"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/a2c363141da31a265dd536c945677db4b64f3ec9"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-wf93-45jw-7689","slug":"ghsa-wf93-45jw-7689-98dc514d","dossier":false,"summary":"pip: Path traversal in console_scripts/gui_scripts entry point names allows installing scripts outside of target directory","aliases":["CVE-2026-8643","PYSEC-2026-196"],"sourceIds":["GHSA-wf93-45jw-7689","PYSEC-2026-196"],"published":"2026-06-01T17:17:35.770Z","modified":"2026-09-10T03:51:09.636289073Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8643"},{"type":"FIX","url":"https://github.com/pypa/pip/pull/14000"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:33313"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34776"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34777"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34778"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34780"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:34891"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36193"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:36315"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37275"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2026:37283"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-8643"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460927"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/pip"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wf93-45jw-7689"}],"versionKeys":["pypi:pip@22.0.2","pypi:pip@25.1.1"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-whj4-6x5x-4v2j","slug":"ghsa-whj4-6x5x-4v2j-eb5fc6a1","dossier":false,"summary":"FITS GZIP decompression bomb in Pillow","aliases":["BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"sourceIds":["GHSA-whj4-6x5x-4v2j","PYSEC-2026-2250"],"published":"2026-04-13T19:22:35Z","modified":"2026-09-10T03:51:03.847830288Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40192"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-wjx4-4jcj-g98j","slug":"ghsa-wjx4-4jcj-g98j-e937161b","dossier":false,"summary":"Pillow has an integer overflow when processing fonts","aliases":["BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"sourceIds":["GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"published":"2026-05-04T20:18:45Z","modified":"2026-09-10T03:50:47.950262681Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-wp53-j4wj-2cfg","slug":"ghsa-wp53-j4wj-2cfg-22cec3c5","dossier":false,"summary":"Python-Multipart has Arbitrary File Write via Non-Default Configuration","aliases":["CVE-2026-24486","PYSEC-2026-1852"],"sourceIds":["GHSA-wp53-j4wj-2cfg","PYSEC-2026-1852"],"published":"2026-01-26T23:28:05Z","modified":"2026-09-10T03:50:59.359593372Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/Kludex/python-multipart/security/advisories/GHSA-wp53-j4wj-2cfg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24486"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/commit/9433f4bbc9652bdde82bbe380984e32f8cfc89c4"},{"type":"PACKAGE","url":"https://github.com/Kludex/python-multipart"},{"type":"WEB","url":"https://github.com/Kludex/python-multipart/releases/tag/0.0.22"},{"type":"PACKAGE","url":"https://pypi.org/project/python-multipart"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wp53-j4wj-2cfg"}],"versionKeys":["pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.9"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-wqp7-x3pw-xc5r","slug":"ghsa-wqp7-x3pw-xc5r-4caabf81","dossier":false,"summary":"Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows","aliases":["CVE-2026-48818","PYSEC-2026-2281"],"sourceIds":["GHSA-wqp7-x3pw-xc5r","PYSEC-2026-2281"],"published":"2026-06-15T20:16:30Z","modified":"2026-09-10T03:50:51.079936646Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-wqp7-x3pw-xc5r"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-48818"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48818.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30088"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30089"},{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/releases/tag/1.1.0"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490020"},{"type":"FIX","url":"https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5"},{"type":"FIX","url":"https://github.com/Kludex/starlette/pull/3287"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-wrfc-pvp9-mr9g","slug":"ghsa-wrfc-pvp9-mr9g-c6b03ddf","dossier":false,"summary":"Deserialization of Untrusted Data in Hugging Face Transformers","aliases":["CVE-2024-11393","PYSEC-2024-228"],"sourceIds":["GHSA-wrfc-pvp9-mr9g","PYSEC-2024-228"],"published":"2024-11-22T22:15:07Z","modified":"2026-09-10T03:50:55.987633957Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-11393"},{"type":"WEB","url":"https://github.com/huggingface/transformers/issues/34840"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/35296"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/transformers/PYSEC-2024-228.yaml"},{"type":"WEB","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514"},{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-24-1514/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-wrfc-pvp9-mr9g"}],"versionKeys":["pypi:transformers@4.47.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-x3gm-94wq-g975","slug":"ghsa-x3gm-94wq-g975-a197ba31","dossier":false,"summary":"PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module","aliases":["BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190"],"sourceIds":["GHSA-x3gm-94wq-g975"],"published":"2025-03-10T15:30:47Z","modified":"2026-06-09T22:11:08.734544854Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2149"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818"},{"type":"WEB","url":"https://github.com/pytorch/pytorch/issues/147818#issue-2877301660"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/torch/PYSEC-2025-190.yaml"},{"type":"PACKAGE","url":"https://github.com/pytorch/pytorch"},{"type":"WEB","url":"https://vuldb.com/?ctiid.299060"},{"type":"WEB","url":"https://vuldb.com/?id.299060"},{"type":"WEB","url":"https://vuldb.com/?submit.506563"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-x746-7m8f-x49c","slug":"ghsa-x746-7m8f-x49c-c0349d3f","dossier":false,"summary":"Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`","aliases":["CVE-2026-48817","PYSEC-2026-2280"],"sourceIds":["GHSA-x746-7m8f-x49c","PYSEC-2026-2280"],"published":"2026-06-15T20:16:05Z","modified":"2026-09-10T03:50:12.272722043Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/security/advisories/GHSA-x746-7m8f-x49c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48817"},{"type":"PACKAGE","url":"https://github.com/Kludex/starlette"},{"type":"ADVISORY","url":"https://github.com/Kludex/starlette/releases/tag/1.1.0"}],"versionKeys":["pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2","pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0","pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-x9r9-c232-4q39","slug":"ghsa-x9r9-c232-4q39-1586e326","dossier":false,"summary":"Hugging Face Transformers downloads custom generation code before trust consent","aliases":["CVE-2026-80047","PYSEC-2026-4174"],"sourceIds":["GHSA-x9r9-c232-4q39","PYSEC-2026-4174"],"published":"2026-09-01T15:31:13Z","modified":"2026-10-01T17:55:55.397425521Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80047"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/48620"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/cbc1651a032b923da7f4b44b3d0e6f68e6ba6b55"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://kb.cert.org/vuls/id/456290"},{"type":"WEB","url":"https://www.kb.cert.org/vuls/id/456290"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-x9r9-c232-4q39"}],"versionKeys":["pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6","pypi:transformers@5.8.0"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-xcgm-r5h9-7989","slug":"ghsa-xcgm-r5h9-7989-77bcbc26","dossier":false,"summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits","aliases":["CVE-2026-54274","PYSEC-2026-2108"],"sourceIds":["GHSA-xcgm-r5h9-7989","PYSEC-2026-2108"],"published":"2026-06-15T20:11:22Z","modified":"2026-09-10T03:50:12.346397944Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-xcgm-r5h9-7989"},{"type":"PACKAGE","url":"https://github.com/aio-libs/aiohttp"},{"type":"FIX","url":"https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d"}],"versionKeys":["pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-xcq7-p3pf-p88h","slug":"ghsa-xcq7-p3pf-p88h-7e00dc8e","dossier":false,"summary":"OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api","aliases":["CVE-2026-114603"],"sourceIds":["GHSA-xcq7-p3pf-p88h"],"published":"2026-10-22T16:22:07Z","modified":"2026-10-22T16:30:40.999595074Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-xcq7-p3pf-p88h"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/pull/5749"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/commit/d5224bf4ffdf2aee1b592ad238dcc32ca957f26b"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-python"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md#version-1451066b1-2026-10-06"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.1"}],"versionKeys":["pypi:opentelemetry-api@1.25.0","pypi:opentelemetry-api@1.26.0","pypi:opentelemetry-api@1.28.2","pypi:opentelemetry-api@1.34.1","pypi:opentelemetry-api@1.36.0","pypi:opentelemetry-api@1.38.0","pypi:opentelemetry-api@1.39.1","pypi:opentelemetry-api@1.43.0"],"packageCount":1,"repositoryCount":8},{"id":"GHSA-xg8h-j46f-w952","slug":"ghsa-xg8h-j46f-w952-da36a616","dossier":false,"summary":"Pillow vulnerability can cause write buffer overflow on BCn encoding","aliases":["BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61"],"sourceIds":["GHSA-xg8h-j46f-w952","PYSEC-2025-61"],"published":"2025-07-01T17:29:37Z","modified":"2026-09-10T03:50:26.431657121Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9041"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/11.3.0"}],"versionKeys":["pypi:pillow@11.2.1"],"packageCount":1,"repositoryCount":4},{"id":"GHSA-xgh8-jp6q-p5x8","slug":"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","dossier":false,"summary":"Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes","aliases":["BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335"],"sourceIds":["GHSA-xgh8-jp6q-p5x8","PYSEC-2026-4335"],"published":"2026-10-19T22:17:10.293Z","modified":"2026-10-28T11:10:55.647541842Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xgh8-jp6q-p5x8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112901"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/2852a3e3d568997ddec745fc800991f138878f4b"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-xj96-63gp-2gmr","slug":"ghsa-xj96-63gp-2gmr-85e1cf15","dossier":false,"summary":"Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`","aliases":["BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454"],"sourceIds":["GHSA-xj96-63gp-2gmr","PYSEC-2026-3454"],"published":"2026-07-14T17:17:14.487Z","modified":"2026-09-10T03:50:53.192759645Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xj96-63gp-2gmr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59197"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9695"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/cce3bdb867c77a3420261ed1bfdb6b0787ec8fc1"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0"],"packageCount":1,"repositoryCount":18},{"id":"GHSA-xmj3-9gf7-h52w","slug":"ghsa-xmj3-9gf7-h52w-d99c0028","dossier":false,"summary":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","aliases":[],"sourceIds":["GHSA-xmj3-9gf7-h52w"],"published":"2026-10-23T21:44:11Z","modified":"2026-10-23T22:00:03.739009766Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w"},{"type":"WEB","url":"https://github.com/pypa/setuptools/pull/5329"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/setuptools/releases/tag/v84.1.0"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0","pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1"],"packageCount":1,"repositoryCount":19},{"id":"GHSA-xrqw-3rrv-vx5w","slug":"ghsa-xrqw-3rrv-vx5w-3d985837","dossier":false,"summary":"Transformers save_pretrained path traversal allows arbitrary file writes through chat template names","aliases":["CVE-2026-9856","PYSEC-2026-3929"],"sourceIds":["GHSA-xrqw-3rrv-vx5w","PYSEC-2026-3929"],"published":"2026-08-02T18:30:20Z","modified":"2026-09-10T12:25:36.528730268Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9856"},{"type":"WEB","url":"https://github.com/huggingface/transformers/pull/46191"},{"type":"WEB","url":"https://github.com/huggingface/transformers/commit/eaaaf8494dd5386634ae37d1d122212fdc315be5"},{"type":"PACKAGE","url":"https://github.com/huggingface/transformers"},{"type":"WEB","url":"https://huntr.com/bounties/362824d5-fe18-40e8-a6cf-62277f97a170"},{"type":"PACKAGE","url":"https://pypi.org/project/transformers"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xrqw-3rrv-vx5w"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6","pypi:transformers@5.8.0"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-xvh5-g6gv-559v","slug":"ghsa-xvh5-g6gv-559v-e12340aa","dossier":false,"summary":"Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags","aliases":["CVE-2026-112902","PYSEC-2026-4363"],"sourceIds":["GHSA-xvh5-g6gv-559v","PYSEC-2026-4363"],"published":"2026-10-21T21:29:16Z","modified":"2026-11-11T10:20:03.066593346Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"}],"references":[{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xvh5-g6gv-559v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112902"},{"type":"WEB","url":"https://github.com/github/advisory-database/pull/10903"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/10227"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/570df030c0d30c2bf5336b2ab59f3902d8ab0b6d"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/af56ace297b0991d02988fcc2ea933e4824b4fb3"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0"],"packageCount":1,"repositoryCount":19},{"id":"PYSEC-2025-198","slug":"pysec-2025-198-62b25ed4","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46148","CVE-2025-46148"],"sourceIds":["PYSEC-2025-198"],"published":"2025-09-25T15:16:12.007Z","modified":"2026-05-20T09:19:19.437232Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/65a587a579dfdff887b9b35bb79b9093"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151198"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/152993"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":2},{"id":"PYSEC-2025-199","slug":"pysec-2025-199-c528cb5a","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46149","CVE-2025-46149"],"sourceIds":["PYSEC-2025-199"],"published":"2025-09-25T15:16:12.153Z","modified":"2026-05-20T09:19:19.498677Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147848"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/147961"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-200","slug":"pysec-2025-200-d11172cd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46150","CVE-2025-46150"],"sourceIds":["PYSEC-2025-200"],"published":"2025-09-25T15:16:12.303Z","modified":"2026-05-20T09:19:19.559970Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/141538#issuecomment-2537424658"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/144395"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-201","slug":"pysec-2025-201-c002b022","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46152","CVE-2025-46152"],"sourceIds":["PYSEC-2025-201"],"published":"2025-09-25T15:16:12.470Z","modified":"2026-05-20T09:19:19.618679Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/143555"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143635"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-202","slug":"pysec-2025-202-f0ff1751","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-46153","CVE-2025-46153"],"sourceIds":["PYSEC-2025-202"],"published":"2025-09-25T15:16:12.603Z","modified":"2026-05-20T09:19:19.678555Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/compare/v2.6.0...v2.7.0"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/4bcefba4004f8271e64b5185c95a248a"},{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/e636f2e7a306105b7e96809e2b85c28a"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/142853"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/143460"}],"versionKeys":["pypi:torch@2.6.0"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2025-203","slug":"pysec-2025-203-2febb201","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55551","CVE-2025-55551"],"sourceIds":["PYSEC-2025-203"],"published":"2025-09-25T15:16:12.887Z","modified":"2026-05-20T09:19:19.739357Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151401"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-204","slug":"pysec-2025-204-cdae47da","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55552","CVE-2025-55552"],"sourceIds":["PYSEC-2025-204"],"published":"2025-09-25T16:15:34.320Z","modified":"2026-05-20T09:19:19.802802Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/147847"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-205","slug":"pysec-2025-205-fd5e58fd","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55553","CVE-2025-55553"],"sourceIds":["PYSEC-2025-205"],"published":"2025-09-25T16:15:34.460Z","modified":"2026-05-20T09:19:19.866970Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151432"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/154645"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-206","slug":"pysec-2025-206-58322476","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55554","CVE-2025-55554"],"sourceIds":["PYSEC-2025-206"],"published":"2025-09-25T16:15:34.593Z","modified":"2026-05-20T09:19:19.928295Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151510"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0"],"packageCount":1,"repositoryCount":9},{"id":"PYSEC-2025-207","slug":"pysec-2025-207-2abef3fc","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55557","CVE-2025-55557"],"sourceIds":["PYSEC-2025-207"],"published":"2025-09-25T16:15:34.833Z","modified":"2026-05-20T09:19:19.989717Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151738"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151931"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-208","slug":"pysec-2025-208-6e93fe9d","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55558","CVE-2025-55558"],"sourceIds":["PYSEC-2025-208"],"published":"2025-09-25T16:15:34.960Z","modified":"2026-05-20T09:19:20.054109Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151523"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151887"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-209","slug":"pysec-2025-209-e6f352b0","dossier":false,"summary":null,"aliases":["BIT-pytorch-2025-55560","CVE-2025-55560"],"sourceIds":["PYSEC-2025-209"],"published":"2025-09-25T16:15:35.197Z","modified":"2026-05-20T09:19:20.117285Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://gist.github.com/shaoyuyoung/0e7d2a586297ae9c8ed14d8706749efc"},{"type":"REPORT","url":"https://github.com/pytorch/pytorch/issues/151522"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/151897"}],"versionKeys":["pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0"],"packageCount":1,"repositoryCount":3},{"id":"PYSEC-2025-211","slug":"pysec-2025-211-d8bd15de","dossier":false,"summary":null,"aliases":["CVE-2025-14920"],"sourceIds":["PYSEC-2025-211"],"published":"2025-12-23T21:15:47.183Z","modified":"2026-05-21T15:00:32.080516132Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1150/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-212","slug":"pysec-2025-212-a011b97d","dossier":false,"summary":null,"aliases":["CVE-2025-14921"],"sourceIds":["PYSEC-2025-212"],"published":"2025-12-23T21:15:47.340Z","modified":"2026-05-21T15:00:32.052313357Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1149/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-213","slug":"pysec-2025-213-9043dc9b","dossier":false,"summary":null,"aliases":["CVE-2025-14924"],"sourceIds":["PYSEC-2025-213"],"published":"2025-12-23T21:15:47.600Z","modified":"2026-05-21T15:00:32.048516839Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1141/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-214","slug":"pysec-2025-214-eb241255","dossier":false,"summary":null,"aliases":["CVE-2025-14926"],"sourceIds":["PYSEC-2025-214"],"published":"2025-12-23T21:15:47.857Z","modified":"2026-05-21T15:00:32.929011749Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-215","slug":"pysec-2025-215-6064f491","dossier":false,"summary":null,"aliases":["CVE-2025-14927"],"sourceIds":["PYSEC-2025-215"],"published":"2025-12-23T21:15:47.987Z","modified":"2026-05-21T15:00:32.888290877Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-216","slug":"pysec-2025-216-5708ed01","dossier":false,"summary":null,"aliases":["CVE-2025-14928"],"sourceIds":["PYSEC-2025-216"],"published":"2025-12-23T21:15:48.110Z","modified":"2026-05-21T15:00:32.939311939Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1"],"packageCount":1,"repositoryCount":5},{"id":"PYSEC-2025-217","slug":"pysec-2025-217-2c1ad388","dossier":false,"summary":null,"aliases":["CVE-2025-14929"],"sourceIds":["PYSEC-2025-217"],"published":"2025-12-23T21:15:48.240Z","modified":"2026-05-21T15:00:24.271970226Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1144/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6"],"packageCount":1,"repositoryCount":11},{"id":"PYSEC-2025-218","slug":"pysec-2025-218-39811fc3","dossier":false,"summary":null,"aliases":["CVE-2025-14930"],"sourceIds":["PYSEC-2025-218"],"published":"2025-12-23T21:15:48.367Z","modified":"2026-05-21T15:00:33.791364554Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"}],"versionKeys":["pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1"],"packageCount":1,"repositoryCount":8},{"id":"PYSEC-2026-139","slug":"pysec-2026-139-96951ff6","dossier":false,"summary":null,"aliases":["BIT-pytorch-2026-4538","CVE-2026-4538"],"sourceIds":["PYSEC-2026-139"],"published":"2026-03-22T05:16:20.273Z","modified":"2026-05-21T15:00:31.962442644Z","checkedAt":"2026-11-12T08:58:58.139Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pytorch/pytorch/"},{"type":"ADVISORY","url":"https://vuldb.com/?id.352326"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.774681"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.352326"},{"type":"FIX","url":"https://github.com/pytorch/pytorch/pull/176791"}],"versionKeys":["pypi:torch@2.10.0","pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0","pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128"],"packageCount":1,"repositoryCount":15}]}}