{"schemaVersion":"ki-abhaengigkeitsatlas/v1","dataset":"german-public-sector-ai-dependency-atlas","parserVersion":"1","generatedAt":"2026-07-20T11:49:05.682Z","trackingSince":"2026-07-18T21:20:30.334Z","source":{"codeRadar":{"dataset":"german-public-sector-ai-code-radar","generatedAt":"2026-07-20T11:47:56.369Z","parserVersion":"3","url":"https://i6eal.de/tools/ki-code-radar/"},"openCode":{"label":"openCode GitLab","url":"https://gitlab.opencode.de/"},"depsDev":{"label":"deps.dev API v3","url":"https://docs.deps.dev/api/v3/"},"osv":{"label":"OSV API","url":"https://google.github.io/osv.dev/api/"},"spdx":{"label":"SPDX License List","url":"https://spdx.org/licenses/","version":"3.28.0","releaseDate":"2026-02-20T00:00:00Z"}},"coverage":{"repositoryCount":30,"completeTreeCount":29,"incompleteTreeCount":1,"lockfileRepositoryCount":17,"sbomRepositoryCount":4,"artifactRepositoryCount":20,"resolvedRepositoryCount":29,"resolvedArtifactRepositoryCount":20,"dependencyFileCount":33,"parsedFileCount":32,"parseErrorCount":1,"unsupportedFileCount":0,"evaluatedVersionCount":4205,"metadataResolvedCount":4191,"metadataNotFoundCount":14,"osvEvaluatedVersionCount":4205,"codeRadarRepositoryCount":30},"methodology":{"componentParserSchemaVersion":"ki-dependency-atlas-components/v1","candidateBoundary":"repositories_with_exact_ai_code_evidence","resolvedVersionBoundary":"exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin","manifestRangesResolved":false,"latestVersionSubstitution":false,"containerTagsVulnerabilityChecked":false,"osvClaim":"osv_matched_observed_resolved_package_version_at_collection_time","depsDevLicenseSemantics":"spdx_expressions_as_reported_without_inferred_compatibility","providerSemantics":"package_interface_presence_not_api_configuration_procurement_or_use","generativeAiUsed":false,"scoreUsed":false,"treeEntryCeiling":2500,"fileByteCeiling":5242880,"uniqueVersionCeiling":5000,"observedFormats":["package-lock.json / npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins"]},"summary":{"repositoryCount":30,"packageCount":2831,"aiPackageCount":41,"resolvedComponentCount":7181,"resolvedVersionCount":4205,"providerExposureRepositoryCount":7,"licenseExpressionCount":57,"knownLicensePackageCount":2796,"unknownLicensePackageCount":35,"advisoryCount":572,"matchedAdvisoryRepositoryCount":25,"topPackage":{"id":"package:pypi:openai","slug":"openai-0dd26ac5","label":"OpenAI SDK","repositoryCount":18,"repositoryShare":0.6}},"kind":"repository","entity":{"id":"opencode:6174","slug":"opencode-6174","gitlabProjectId":6174,"name":"Energieautarkes Wohnquartier - Backend","pathWithNamespace":"energieautarkes-wohnquartier/backend","description":"This Python-based REST API delivers energy simulation data for the “Energieautarkes Wohnquartier” project. It provides both precomputed results for various building and system configurations, as well as real-time predictions using a machine learning model trained on over 3,300 high-fidelity SimulationX simulations.\r\n\r\nThe API can be used alongside the separately developed React/Three.js frontend to enable real-time evaluation of user-defined scenarios. Deterministic simulations and ML-based regression are combined to ensure fast and accurate responses, even for previously unseen configurations.","webUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend","commitSha":"fc7e24cd546449ac9fdee4ad78aab861e0c89666","commitUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend/-/commit/fc7e24cd546449ac9fdee4ad78aab861e0c89666","lastActivityAt":"2026-04-15T13:18:54.254Z","headCommittedAt":"2026-04-15T13:22:39.000Z","tree":{"complete":true,"entryCount":78,"truncated":false},"files":[{"path":"poetry.lock","kind":"poetry-lock","blobSha":"dc5008ef9fba69d70ea9e7b3fea21265fa5ef93d","sourceUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend/-/blob/fc7e24cd546449ac9fdee4ad78aab861e0c89666/poetry.lock","commitSha":"fc7e24cd546449ac9fdee4ad78aab861e0c89666","contentSha256":"6876a231ced00a8d5ac3f1a8fa53fd89e79d737091ef2925e25665b04e92e693","byteCount":200089,"state":"parsed","componentCount":81}],"resolvedComponentCount":81,"artifactResolvedComponentCount":81,"exactManifestPinCount":0,"packageCount":81,"ecosystems":["pypi"],"aiPackageCount":2,"licenseExpressionCount":11,"unknownLicensePackageCount":1,"advisoryIds":["GHSA-248v-346w-9cwc","GHSA-29vq-49wr-vm6x","GHSA-2g68-c3qc-8985","GHSA-2xpw-w6gg-jr37","GHSA-36fq-jgmw-4r9c","GHSA-36rr-ww3j-vrjv","GHSA-38jv-5279-wg99","GHSA-3m4q-jmj6-r34q","GHSA-43qf-4rqw-9q2g","GHSA-48p4-8xcf-vxj5","GHSA-4f3f-g24h-fr8m","GHSA-5239-wwwm-4pmq","GHSA-5rjg-fvgr-3xxf","GHSA-5wmx-573v-2qwq","GHSA-5xmw-vc9v-4wf2","GHSA-65pc-fj4g-8rjx","GHSA-68rp-wp8r-4726","GHSA-768j-98cg-p3fv","GHSA-7gcm-g887-7qv7","GHSA-7rxf-gvfg-47g4","GHSA-84pr-m4jr-85g5","GHSA-87hc-h4r5-73f7","GHSA-8qvm-5x2c-j2w7","GHSA-8rrh-rw8j-w5fx","GHSA-8vgw-p6qm-5gr7","GHSA-9hjg-9r4m-mvj7","GHSA-9wx4-h78v-vm56","GHSA-c9rc-mg46-23w3","GHSA-cfh3-3jmp-rvhc","GHSA-cpwx-vrp4-4pq7","GHSA-cx63-2mw6-8hw5","GHSA-f9vj-2wh5-fj8j","GHSA-gc5v-m9x4-r6x2","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-h75v-3vvj-5mfj","GHSA-hgf8-39gv-g3f2","GHSA-hjqc-jx6g-rwp9","GHSA-hxwh-jpp2-84pm","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mgx6-5cf9-rr43","GHSA-mq84-hjqx-cwf2","GHSA-pq67-6m6q-mj2v","GHSA-pwv6-vv43-88gr","GHSA-q2x7-8rv6-6q7h","GHSA-q34m-jh98-gwm2","GHSA-qccp-gfcp-xxvc","GHSA-r73j-pqj5-w3x7","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-xg8h-j46f-w952","PYSEC-2026-2132","PYSEC-2026-2253","PYSEC-2026-2254","PYSEC-2026-2255","PYSEC-2026-2256","PYSEC-2026-2257","PYSEC-2026-2324","PYSEC-2026-3447","PYSEC-2026-3451","PYSEC-2026-3452","PYSEC-2026-3453"],"advisoryCount":63,"providers":[]},"evidence":{"files":[{"path":"poetry.lock","kind":"poetry-lock","blobSha":"dc5008ef9fba69d70ea9e7b3fea21265fa5ef93d","sourceUrl":"https://gitlab.opencode.de/energieautarkes-wohnquartier/backend/-/blob/fc7e24cd546449ac9fdee4ad78aab861e0c89666/poetry.lock","commitSha":"fc7e24cd546449ac9fdee4ad78aab861e0c89666","contentSha256":"6876a231ced00a8d5ac3f1a8fa53fd89e79d737091ef2925e25665b04e92e693","byteCount":200089,"state":"parsed","componentCount":81}],"occurrenceCount":81},"related":{"packages":[{"id":"package:pypi:scikit-learn","slug":"scikit-learn-ab0941d9","identity":"pypi:scikit-learn","label":"scikit-learn","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["1.6.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tensorflow","slug":"tensorflow-b039ea09","identity":"pypi:tensorflow","label":"TensorFlow","aiRelevant":true,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.19.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:pillow","slug":"pillow-834347dd","identity":"pypi:pillow","label":"pillow","aiRelevant":false,"provider":null,"advisoryCount":15,"licenseExpressions":["HPND","MIT-CMU"],"versions":["11.2.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:keras","slug":"keras-33e438c4","identity":"pypi:keras","label":"keras","aiRelevant":false,"provider":null,"advisoryCount":9,"licenseExpressions":["Apache-2.0"],"versions":["3.9.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:urllib3","slug":"urllib3-fa68f32c","identity":"pypi:urllib3","label":"urllib3","aiRelevant":false,"provider":null,"advisoryCount":7,"licenseExpressions":["MIT"],"versions":["2.4.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:werkzeug","slug":"werkzeug-b18d5b02","identity":"pypi:werkzeug","label":"werkzeug","aiRelevant":false,"provider":null,"advisoryCount":6,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:flask-cors","slug":"flask-cors-348fb6bb","identity":"pypi:flask-cors","label":"flask-cors","aiRelevant":false,"provider":null,"advisoryCount":5,"licenseExpressions":["MIT"],"versions":["5.0.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:jinja2","slug":"jinja2-f7d34747","identity":"pypi:jinja2","label":"jinja2","aiRelevant":false,"provider":null,"advisoryCount":4,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.6"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:requests","slug":"requests-53653f76","identity":"pypi:requests","label":"requests","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["Apache-2.0"],"versions":["2.32.3"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:setuptools","slug":"setuptools-fe37c31a","identity":"pypi:setuptools","label":"setuptools","aiRelevant":false,"provider":null,"advisoryCount":3,"licenseExpressions":["MIT"],"versions":["80.4.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:protobuf","slug":"protobuf-6e30009a","identity":"pypi:protobuf","label":"protobuf","aiRelevant":false,"provider":null,"advisoryCount":2,"licenseExpressions":["BSD-3-Clause"],"versions":["5.29.4"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:certifi","slug":"certifi-d4f0c37e","identity":"pypi:certifi","label":"certifi","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MPL-2.0"],"versions":["2025.4.26"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:click","slug":"click-ef97f731","identity":"pypi:click","label":"click","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["8.2.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:flask","slug":"flask-734a8b3c","identity":"pypi:flask","label":"flask","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.1.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:fonttools","slug":"fonttools-d2488ea8","identity":"pypi:fonttools","label":"fonttools","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["4.58.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:idna","slug":"idna-994c9929","identity":"pypi:idna","label":"idna","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.10"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:markdown","slug":"markdown-80f66882","identity":"pypi:markdown","label":"markdown","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["3.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:pygments","slug":"pygments-ad71bc11","identity":"pypi:pygments","label":"pygments","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-2-Clause"],"versions":["2.19.1"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:python-dotenv","slug":"python-dotenv-27b12285","identity":"pypi:python-dotenv","label":"python-dotenv","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["BSD-3-Clause"],"versions":["1.1.0"],"dossier":true,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:wheel","slug":"wheel-17857b9a","identity":"pypi:wheel","label":"wheel","aiRelevant":false,"provider":null,"advisoryCount":1,"licenseExpressions":["MIT"],"versions":["0.45.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:absl-py","slug":"absl-py-50126725","identity":"pypi:absl-py","label":"absl-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.2.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:astunparse","slug":"astunparse-16fbaa64","identity":"pypi:astunparse","label":"astunparse","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.6.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:blinker","slug":"blinker-409e1445","identity":"pypi:blinker","label":"blinker","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:charset-normalizer","slug":"charset-normalizer-74ccb20a","identity":"pypi:charset-normalizer","label":"charset-normalizer","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.4.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:colorama","slug":"colorama-abaf57c3","identity":"pypi:colorama","label":"colorama","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.4.6"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:compress-json","slug":"compress-json-58c09309","identity":"pypi:compress-json","label":"compress-json","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:contourpy","slug":"contourpy-f86f9e10","identity":"pypi:contourpy","label":"contourpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:cycler","slug":"cycler-3e14883d","identity":"pypi:cycler","label":"cycler","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.12.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:flatbuffers","slug":"flatbuffers-90c67795","identity":"pypi:flatbuffers","label":"flatbuffers","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["25.2.10"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:gast","slug":"gast-1c13a212","identity":"pypi:gast","label":"gast","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["0.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:google-pasta","slug":"google-pasta-35d2f77c","identity":"pypi:google-pasta","label":"google-pasta","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:grpcio","slug":"grpcio-40fa763c","identity":"pypi:grpcio","label":"grpcio","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["1.71.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:gunicorn","slug":"gunicorn-a765d3c5","identity":"pypi:gunicorn","label":"gunicorn","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["23.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:h5py","slug":"h5py-b8fe3869","identity":"pypi:h5py","label":"h5py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.13.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:itsdangerous","slug":"itsdangerous-4af70837","identity":"pypi:itsdangerous","label":"itsdangerous","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["2.2.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:joblib","slug":"joblib-8cbb7872","identity":"pypi:joblib","label":"joblib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["1.5.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:kiwisolver","slug":"kiwisolver-41b47c33","identity":"pypi:kiwisolver","label":"kiwisolver","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.4.8"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:libclang","slug":"libclang-2322c840","identity":"pypi:libclang","label":"libclang","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["18.1.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:markdown-it-py","slug":"markdown-it-py-27073f5e","identity":"pypi:markdown-it-py","label":"markdown-it-py","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:markupsafe","slug":"markupsafe-1bdd4c7f","identity":"pypi:markupsafe","label":"markupsafe","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["3.0.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:matplotlib","slug":"matplotlib-9dc72309","identity":"pypi:matplotlib","label":"matplotlib","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["3.10.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:mdurl","slug":"mdurl-e6f5f075","identity":"pypi:mdurl","label":"mdurl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.1.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:ml-dtypes","slug":"ml-dtypes-eed9ce80","identity":"pypi:ml-dtypes","label":"ml-dtypes","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["0.5.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:namex","slug":"namex-fd46fa7e","identity":"pypi:namex","label":"namex","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":[],"versions":["0.0.9"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:numpy","slug":"numpy-ba79b98d","identity":"pypi:numpy","label":"numpy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib","non-standard"],"versions":["2.1.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cublas-cu12","slug":"nvidia-cublas-cu12-1d052261","identity":"pypi:nvidia-cublas-cu12","label":"nvidia-cublas-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.3.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cuda-cupti-cu12","slug":"nvidia-cuda-cupti-cu12-973480f1","identity":"pypi:nvidia-cuda-cupti-cu12","label":"nvidia-cuda-cupti-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cuda-nvcc-cu12","slug":"nvidia-cuda-nvcc-cu12-0e108124","identity":"pypi:nvidia-cuda-nvcc-cu12","label":"nvidia-cuda-nvcc-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cuda-nvrtc-cu12","slug":"nvidia-cuda-nvrtc-cu12-e32b7f38","identity":"pypi:nvidia-cuda-nvrtc-cu12","label":"nvidia-cuda-nvrtc-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cuda-runtime-cu12","slug":"nvidia-cuda-runtime-cu12-2b875d2a","identity":"pypi:nvidia-cuda-runtime-cu12","label":"nvidia-cuda-runtime-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cudnn-cu12","slug":"nvidia-cudnn-cu12-a21dce6d","identity":"pypi:nvidia-cudnn-cu12","label":"nvidia-cudnn-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["9.3.0.75"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cufft-cu12","slug":"nvidia-cufft-cu12-21ff54dd","identity":"pypi:nvidia-cufft-cu12","label":"nvidia-cufft-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.2.3.61"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-curand-cu12","slug":"nvidia-curand-cu12-2fed778b","identity":"pypi:nvidia-curand-cu12","label":"nvidia-curand-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["10.3.6.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cusolver-cu12","slug":"nvidia-cusolver-cu12-7db0a33a","identity":"pypi:nvidia-cusolver-cu12","label":"nvidia-cusolver-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["11.6.3.83"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-cusparse-cu12","slug":"nvidia-cusparse-cu12-d7e6a309","identity":"pypi:nvidia-cusparse-cu12","label":"nvidia-cusparse-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.1.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-nccl-cu12","slug":"nvidia-nccl-cu12-90361558","identity":"pypi:nvidia-nccl-cu12","label":"nvidia-nccl-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause","non-standard"],"versions":["2.23.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:nvidia-nvjitlink-cu12","slug":"nvidia-nvjitlink-cu12-6d08af75","identity":"pypi:nvidia-nvjitlink-cu12","label":"nvidia-nvjitlink-cu12","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["12.5.82"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:opt-einsum","slug":"opt-einsum-73c64c2e","identity":"pypi:opt-einsum","label":"opt-einsum","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.4.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:optree","slug":"optree-0d91febb","identity":"pypi:optree","label":"optree","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.15.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:packaging","slug":"packaging-78ee1f47","identity":"pypi:packaging","label":"packaging","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0 OR BSD-2-Clause","non-standard"],"versions":["25.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:pandas","slug":"pandas-e8d52445","identity":"pypi:pandas","label":"pandas","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.2.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:plot-keras-history","slug":"plot-keras-history-fe86c5d6","identity":"pypi:plot-keras-history","label":"plot-keras-history","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.39"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:psutil","slug":"psutil-840b9a74","identity":"pypi:psutil","label":"psutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["7.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:pyparsing","slug":"pyparsing-a28b9b62","identity":"pypi:pyparsing","label":"pyparsing","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.2.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:python-dateutil","slug":"python-dateutil-8eac96b7","identity":"pypi:python-dateutil","label":"python-dateutil","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["2.9.0.post0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:python-magic","slug":"python-magic-28c4094a","identity":"pypi:python-magic","label":"python-magic","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.4.27"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:pytz","slug":"pytz-cbf1d95c","identity":"pypi:pytz","label":"pytz","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["2025.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:rich","slug":"rich-23b343f7","identity":"pypi:rich","label":"rich","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["14.0.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:ruff","slug":"ruff-d5943bdf","identity":"pypi:ruff","label":"ruff","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.11.10"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:sanitize-ml-labels","slug":"sanitize-ml-labels-c9346ff6","identity":"pypi:sanitize-ml-labels","label":"sanitize-ml-labels","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.1.4"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:scipy","slug":"scipy-215f884d","identity":"pypi:scipy","label":"scipy","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.15.3"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:six","slug":"six-3c3888bd","identity":"pypi:six","label":"six","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["1.17.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tabulate","slug":"tabulate-f0392898","identity":"pypi:tabulate","label":"tabulate","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["0.9.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tensorboard","slug":"tensorboard-f5e14cf1","identity":"pypi:tensorboard","label":"tensorboard","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2.19.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tensorboard-data-server","slug":"tensorboard-data-server-d2a4e5d5","identity":"pypi:tensorboard-data-server","label":"tensorboard-data-server","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.7.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tensorflow-io-gcs-filesystem","slug":"tensorflow-io-gcs-filesystem-1c9c0ea8","identity":"pypi:tensorflow-io-gcs-filesystem","label":"tensorflow-io-gcs-filesystem","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["0.37.1"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:termcolor","slug":"termcolor-7ed3cb9a","identity":"pypi:termcolor","label":"termcolor","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["MIT"],"versions":["3.1.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:threadpoolctl","slug":"threadpoolctl-e94f6300","identity":"pypi:threadpoolctl","label":"threadpoolctl","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["BSD-3-Clause"],"versions":["3.6.0"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:typing-extensions","slug":"typing-extensions-87d153eb","identity":"pypi:typing-extensions","label":"typing-extensions","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["PSF-2.0","non-standard"],"versions":["4.13.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:tzdata","slug":"tzdata-f80b3bb7","identity":"pypi:tzdata","label":"tzdata","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["Apache-2.0"],"versions":["2025.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]},{"id":"package:pypi:wrapt","slug":"wrapt-505c01f2","identity":"pypi:wrapt","label":"wrapt","aiRelevant":false,"provider":null,"advisoryCount":0,"licenseExpressions":["non-standard"],"versions":["1.17.2"],"dossier":false,"occurrenceCount":1,"directOccurrenceCount":0,"evidenceFiles":["poetry.lock"]}],"vulnerabilities":[{"id":"GHSA-248v-346w-9cwc","slug":"ghsa-248v-346w-9cwc-8a7dbdf1","dossier":false,"summary":"Certifi removes GLOBALTRUST root certificate","aliases":["CVE-2024-39689","PYSEC-2024-230"],"sourceIds":["GHSA-248v-346w-9cwc","PYSEC-2024-230"],"published":"2024-07-05T19:15:10Z","modified":"2026-06-10T17:14:18.786020835Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/certifi/python-certifi/security/advisories/GHSA-248v-346w-9cwc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39689"},{"type":"FIX","url":"https://github.com/certifi/python-certifi/commit/bd8153872e9c6fc98f4023df9c2deaffea2fa463"},{"type":"PACKAGE","url":"https://github.com/certifi/python-certifi"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/certifi/PYSEC-2024-230.yaml"},{"type":"ARTICLE","url":"https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/XpknYMPO8dI"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20241206-0001"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20241206-0001/"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-248v-346w-9cwc"}],"versionKeys":["pypi:certifi@2024.6.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-29vq-49wr-vm6x","slug":"ghsa-29vq-49wr-vm6x-7d88633b","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2026-27199","PYSEC-2026-2320"],"sourceIds":["GHSA-29vq-49wr-vm6x","PYSEC-2026-2320"],"published":"2026-02-19T20:32:45Z","modified":"2026-07-13T07:26:55.904978535Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-29vq-49wr-vm6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27199"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/f407712fdc60a09c2b3f4fe7db557703e5d9338d"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"ADVISORY","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.6"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3","pypi:werkzeug@3.1.5"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-2g68-c3qc-8985","slug":"ghsa-2g68-c3qc-8985-d6075eca","dossier":false,"summary":"Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain","aliases":["CVE-2024-34069","PYSEC-2026-2043"],"sourceIds":["GHSA-2g68-c3qc-8985","PYSEC-2026-2043"],"published":"2024-05-06T14:21:27Z","modified":"2026-07-07T17:56:15.006571356Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-2g68-c3qc-8985"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34069"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/3386395b24c7371db11a5b8eaac0c91da5362692"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00026.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H4SH32AM3CTPMAAEOIDAN7VU565LO4IR"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240614-0004"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2g68-c3qc-8985"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-2xpw-w6gg-jr37","slug":"ghsa-2xpw-w6gg-jr37-91cead57","dossier":true,"summary":"urllib3 streaming API improperly handles highly compressed data","aliases":["CVE-2025-66471","PYSEC-2026-1994"],"sourceIds":["GHSA-2xpw-w6gg-jr37","PYSEC-2026-1994"],"published":"2025-12-05T18:15:54Z","modified":"2026-07-07T17:56:33.872074196Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66471"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-2xpw-w6gg-jr37"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-36fq-jgmw-4r9c","slug":"ghsa-36fq-jgmw-4r9c-8dbce69b","dossier":false,"summary":"Keras is vulnerable to Deserialization of Untrusted Data","aliases":["CVE-2025-9906","PYSEC-2025-76"],"sourceIds":["GHSA-36fq-jgmw-4r9c"],"published":"2025-09-19T09:31:14Z","modified":"2026-07-16T18:59:35.179790998Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9906"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/21429"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/713172ab56b864e59e2aa79b1a51b0e728bba858"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://github.com/keras-team/keras/releases/tag/v3.11.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-76.yaml"},{"type":"WEB","url":"https://osv.dev/vulnerability/CVE-2025-9906"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-36rr-ww3j-vrjv","slug":"ghsa-36rr-ww3j-vrjv-6da4d3b0","dossier":false,"summary":"The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.","aliases":["CVE-2025-9905","PYSEC-2025-123"],"sourceIds":["GHSA-36rr-ww3j-vrjv","PYSEC-2025-123"],"published":"2025-09-19T09:15:36.033Z","modified":"2026-06-06T00:45:42.787604478Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/keras-team/keras/security/advisories/GHSA-36rr-ww3j-vrjv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9905"},{"type":"FIX","url":"https://github.com/keras-team/keras/pull/21602"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-123.yaml"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-38jv-5279-wg99","slug":"ghsa-38jv-5279-wg99-c9df8f7b","dossier":true,"summary":"Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)","aliases":["CVE-2026-21441","PYSEC-2026-1996"],"sourceIds":["GHSA-38jv-5279-wg99","PYSEC-2026-1996"],"published":"2026-01-07T19:18:14Z","modified":"2026-07-07T17:56:31.346111893Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21441"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-38jv-5279-wg99"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-3m4q-jmj6-r34q","slug":"ghsa-3m4q-jmj6-r34q-1cef6cd5","dossier":false,"summary":"Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading","aliases":["CVE-2026-1669","PYSEC-2026-2546"],"sourceIds":["GHSA-3m4q-jmj6-r34q","PYSEC-2026-2546"],"published":"2026-02-18T22:41:58Z","modified":"2026-07-13T16:42:53.746237646Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/keras-team/keras/security/advisories/GHSA-3m4q-jmj6-r34q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1669"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/22057"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/8a37f9dadd8e23fa4ee3f537eeb6413e75d12553"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://github.com/keras-team/keras/releases/tag/v3.12.1"},{"type":"WEB","url":"https://github.com/keras-team/keras/releases/tag/v3.13.2"},{"type":"PACKAGE","url":"https://pypi.org/project/keras"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-3m4q-jmj6-r34q"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-43qf-4rqw-9q2g","slug":"ghsa-43qf-4rqw-9q2g-2b94f083","dossier":false,"summary":"Flask-CORS vulnerable to Improper Handling of Case Sensitivity","aliases":["CVE-2024-6866","PYSEC-2026-1383"],"sourceIds":["GHSA-43qf-4rqw-9q2g","PYSEC-2026-1383"],"published":"2025-03-20T12:32:45Z","modified":"2026-07-07T17:57:18.348501785Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6866"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/eb39516a3c96b90d0ae5f51293972395ec3ef358"},{"type":"PACKAGE","url":"https://github.com/corydolphin/flask-cors"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/blob/4.0.1/flask_cors/extension.py#L195"},{"type":"WEB","url":"https://huntr.com/bounties/808c11af-faee-43a8-824b-b5ab4f62b9e6"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"},{"type":"PACKAGE","url":"https://pypi.org/project/flask-cors"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-43qf-4rqw-9q2g"}],"versionKeys":["pypi:flask-cors@4.0.0","pypi:flask-cors@5.0.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-48p4-8xcf-vxj5","slug":"ghsa-48p4-8xcf-vxj5-13f12656","dossier":false,"summary":"urllib3 does not control redirects in browsers and Node.js","aliases":["CVE-2025-50182","PYSEC-2026-1997"],"sourceIds":["GHSA-48p4-8xcf-vxj5","PYSEC-2026-1997"],"published":"2025-06-18T17:50:11Z","modified":"2026-07-07T17:57:08.881416805Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-48p4-8xcf-vxj5"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-4f3f-g24h-fr8m","slug":"ghsa-4f3f-g24h-fr8m-024d3bd8","dossier":false,"summary":"Keras has an untrusted deserialization vulnerability","aliases":["CVE-2026-1462","PYSEC-2026-2547"],"sourceIds":["GHSA-4f3f-g24h-fr8m","PYSEC-2026-2547"],"published":"2026-04-13T15:31:42Z","modified":"2026-07-13T16:42:43.080773198Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1462"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/22035"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/b6773d3decaef1b05d8e794458e148cb362f163f"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://huntr.com/bounties/7e78d6f1-6977-4300-b595-e81bdbda331c"},{"type":"PACKAGE","url":"https://pypi.org/project/keras"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-4f3f-g24h-fr8m"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-5239-wwwm-4pmq","slug":"ghsa-5239-wwwm-4pmq-228840e4","dossier":true,"summary":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","aliases":["CVE-2026-4539","PYSEC-2026-2987"],"sourceIds":["GHSA-5239-wwwm-4pmq","PYSEC-2026-2987"],"published":"2026-03-22T06:30:15Z","modified":"2026-07-13T16:42:36.989801915Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539"},{"type":"WEB","url":"https://github.com/pygments/pygments/issues/3058"},{"type":"WEB","url":"https://github.com/pygments/pygments/pull/3064"},{"type":"WEB","url":"https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc"},{"type":"PACKAGE","url":"https://github.com/pygments/pygments"},{"type":"WEB","url":"https://github.com/pygments/pygments/releases/tag/2.20.0"},{"type":"WEB","url":"https://vuldb.com/?ctiid.352327"},{"type":"WEB","url":"https://vuldb.com/?id.352327"},{"type":"WEB","url":"https://vuldb.com/?submit.774685"},{"type":"PACKAGE","url":"https://pypi.org/project/pygments"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5239-wwwm-4pmq"}],"versionKeys":["pypi:pygments@2.19.1","pypi:pygments@2.19.2"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-5rjg-fvgr-3xxf","slug":"ghsa-5rjg-fvgr-3xxf-79d39e6b","dossier":false,"summary":"setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write","aliases":["BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49"],"sourceIds":["GHSA-5rjg-fvgr-3xxf","PYSEC-2025-49"],"published":"2025-05-17T16:15:19Z","modified":"2026-05-11T00:26:34.671259971Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"references":[{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47273"},{"type":"REPORT","url":"https://github.com/pypa/setuptools/issues/4946"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/250a6d17978f9f6ac3ac887091f2d32886fbbb0b"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2025-49.yaml"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://github.com/pypa/setuptools/blob/6ead555c5fb29bc57fe6105b1bffc163f56fd558/setuptools/package_index.py#L810C1-L825C88"},{"type":"ARTICLE","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00035.html"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@75.8.0"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5wmx-573v-2qwq","slug":"ghsa-5wmx-573v-2qwq-3c948197","dossier":false,"summary":"Python-Markdown has an Uncaught Exception","aliases":["CVE-2025-69534","PYSEC-2026-89"],"sourceIds":["GHSA-5wmx-573v-2qwq","PYSEC-2026-89"],"published":"2026-03-05T15:16:11.243Z","modified":"2026-06-10T17:02:03.742572395Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69534"},{"type":"REPORT","url":"https://github.com/Python-Markdown/markdown/issues/1534"},{"type":"WEB","url":"https://github.com/Python-Markdown/markdown/pull/1535"},{"type":"PACKAGE","url":"https://github.com/Python-Markdown/markdown"},{"type":"WEB","url":"https://github.com/Python-Markdown/markdown/actions/runs/15736122892"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/markdown/PYSEC-2026-89.yaml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-5wmx-573v-2qwq"}],"versionKeys":["pypi:markdown@3.8"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-5xmw-vc9v-4wf2","slug":"ghsa-5xmw-vc9v-4wf2-86a8861a","dossier":false,"summary":"Pillow has a heap buffer overflow with nested list coordinates","aliases":["BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251"],"sourceIds":["GHSA-5xmw-vc9v-4wf2","PYSEC-2026-2251"],"published":"2026-05-04T20:18:27Z","modified":"2026-07-13T07:26:28.768890335Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42309"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-65pc-fj4g-8rjx","slug":"ghsa-65pc-fj4g-8rjx-9fe9e88a","dossier":true,"summary":"Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix","aliases":["CVE-2026-45409","PYSEC-2026-215"],"sourceIds":["GHSA-65pc-fj4g-8rjx","PYSEC-2026-215"],"published":"2026-05-19T14:34:32Z","modified":"2026-07-08T17:45:15.021597323Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/kjd/idna/security/advisories/GHSA-65pc-fj4g-8rjx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45409"},{"type":"PACKAGE","url":"https://github.com/kjd/idna"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/idna/PYSEC-2026-215.yaml"}],"versionKeys":["pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.7"],"packageCount":1,"repositoryCount":17},{"id":"GHSA-68rp-wp8r-4726","slug":"ghsa-68rp-wp8r-4726-c59718b4","dossier":false,"summary":"Flask session does not add `Vary: Cookie` header when accessed in some ways","aliases":["CVE-2026-27205","PYSEC-2026-2151"],"sourceIds":["GHSA-68rp-wp8r-4726","PYSEC-2026-2151"],"published":"2026-02-19T20:45:41Z","modified":"2026-07-13T07:26:21.445447696Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27205"},{"type":"FIX","url":"https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4"},{"type":"PACKAGE","url":"https://github.com/pallets/flask"},{"type":"ADVISORY","url":"https://github.com/pallets/flask/releases/tag/3.1.3"}],"versionKeys":["pypi:flask@3.0.2","pypi:flask@3.0.3","pypi:flask@3.1.1","pypi:flask@3.1.2"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-768j-98cg-p3fv","slug":"ghsa-768j-98cg-p3fv-0815ff07","dossier":false,"summary":"fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib","aliases":["CVE-2025-66034","PYSEC-2026-1389"],"sourceIds":["GHSA-768j-98cg-p3fv","PYSEC-2026-1389"],"published":"2025-12-01T19:07:00Z","modified":"2026-07-07T17:57:24.966058048Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:L"}],"references":[{"type":"WEB","url":"https://github.com/fonttools/fonttools/security/advisories/GHSA-768j-98cg-p3fv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66034"},{"type":"WEB","url":"https://github.com/fonttools/fonttools/commit/a696d5ba93270d5954f98e7cab5ddca8a02c1e32"},{"type":"PACKAGE","url":"https://github.com/fonttools/fonttools"},{"type":"PACKAGE","url":"https://pypi.org/project/fonttools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-768j-98cg-p3fv"}],"versionKeys":["pypi:fonttools@4.55.3","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2"],"packageCount":1,"repositoryCount":6},{"id":"GHSA-7gcm-g887-7qv7","slug":"ghsa-7gcm-g887-7qv7-55bb9ff1","dossier":false,"summary":"protobuf affected by a JSON recursion depth bypass","aliases":["CVE-2026-0994","PYSEC-2026-1805"],"sourceIds":["GHSA-7gcm-g887-7qv7","PYSEC-2026-1805"],"published":"2026-01-23T15:31:35Z","modified":"2026-07-07T17:56:36.712428283Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0994"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/issues/25070"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/pull/25239"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/5ebddcb1bcbe51d1fe323baa145e85f4f23128cf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/d2b001626d137c62dfee6c88c87324102531868b"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7gcm-g887-7qv7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4"],"packageCount":1,"repositoryCount":10},{"id":"GHSA-7rxf-gvfg-47g4","slug":"ghsa-7rxf-gvfg-47g4-171801e8","dossier":false,"summary":"Flask-CORS improper regex path matching vulnerability","aliases":["CVE-2024-6839","PYSEC-2026-1384"],"sourceIds":["GHSA-7rxf-gvfg-47g4","PYSEC-2026-1384"],"published":"2025-03-20T12:32:45Z","modified":"2026-07-07T17:57:28.129199523Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6839"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/e970988bea563e05e8b8f53fa7bcc134b5bf5c5f"},{"type":"PACKAGE","url":"https://github.com/corydolphin/flask-cors"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/blob/4.0.1/flask_cors/core.py#L73"},{"type":"WEB","url":"https://huntr.com/bounties/403eb1fc-86f4-4820-8eba-0f3dfae9f2b4"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"},{"type":"PACKAGE","url":"https://pypi.org/project/flask-cors"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-7rxf-gvfg-47g4"}],"versionKeys":["pypi:flask-cors@4.0.0","pypi:flask-cors@5.0.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-84pr-m4jr-85g5","slug":"ghsa-84pr-m4jr-85g5-4a9795ee","dossier":false,"summary":"flask-cors vulnerable to log injection when the log level is set to debug","aliases":["CVE-2024-1681","PYSEC-2024-271"],"sourceIds":["GHSA-84pr-m4jr-85g5","PYSEC-2024-271"],"published":"2024-04-19T20:15:09.273Z","modified":"2026-06-10T17:01:16.365143709Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1681"},{"type":"PACKAGE","url":"https://github.com/corydolphin/flask-cors"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/blob/40acc8092332dfed4bb54d7a4f89a6d479466de7/flask_cors/extension.py#L194"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-271.yaml"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/25a7a0ba-9fa2-4777-acb6-03e5539bb644"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-84pr-m4jr-85g5"}],"versionKeys":["pypi:flask-cors@4.0.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-87hc-h4r5-73f7","slug":"ghsa-87hc-h4r5-73f7-c5117ca2","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names with compound extensions","aliases":["CVE-2026-21860","PYSEC-2026-2044"],"sourceIds":["GHSA-87hc-h4r5-73f7","PYSEC-2026-2044"],"published":"2026-01-08T19:51:21Z","modified":"2026-07-07T17:56:19.044748151Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-87hc-h4r5-73f7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21860"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/7ae1d254e04a0c33e241ac1cca4783ce6c875ca3"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-87hc-h4r5-73f7"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-8qvm-5x2c-j2w7","slug":"ghsa-8qvm-5x2c-j2w7-8a075519","dossier":false,"summary":"protobuf-python has a potential Denial of Service issue","aliases":["CVE-2025-4565","PYSEC-2026-1806"],"sourceIds":["GHSA-8qvm-5x2c-j2w7","PYSEC-2026-1806"],"published":"2025-06-16T16:02:58Z","modified":"2026-07-07T17:57:09.877491994Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8qvm-5x2c-j2w7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4565"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901"},{"type":"PACKAGE","url":"https://github.com/protocolbuffers/protobuf"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/decoder_test.py#L87-L98"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/blob/main/python/google/protobuf/internal/message_test.py#L1436-L1478"},{"type":"WEB","url":"https://github.com/protocolbuffers/protobuf/tree/main/python#implementation-backends"},{"type":"PACKAGE","url":"https://pypi.org/project/protobuf"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8qvm-5x2c-j2w7"}],"versionKeys":["pypi:protobuf@4.25.7","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-8rrh-rw8j-w5fx","slug":"ghsa-8rrh-rw8j-w5fx-eadd80fb","dossier":false,"summary":"Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack","aliases":["CVE-2026-24049","PYSEC-2026-2047"],"sourceIds":["GHSA-8rrh-rw8j-w5fx","PYSEC-2026-2047"],"published":"2026-01-22T18:02:56Z","modified":"2026-07-07T17:56:06.063831091Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24049"},{"type":"FIX","url":"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef"},{"type":"INTRODUCED","url":"https://github.com/pypa/wheel/commit/934fe177ff912c8e03d5ae951d3805e1fd90ba5e"},{"type":"PACKAGE","url":"https://github.com/pypa/wheel"},{"type":"WEB","url":"https://github.com/pypa/wheel/releases/tag/0.46.2"},{"type":"PACKAGE","url":"https://pypi.org/project/wheel"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8rrh-rw8j-w5fx"}],"versionKeys":["pypi:wheel@0.43.0","pypi:wheel@0.45.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-8vgw-p6qm-5gr7","slug":"ghsa-8vgw-p6qm-5gr7-be25d449","dossier":false,"summary":"Flask-CORS allows for inconsistent CORS matching","aliases":["CVE-2024-6844","PYSEC-2026-1385"],"sourceIds":["GHSA-8vgw-p6qm-5gr7","PYSEC-2026-1385"],"published":"2025-03-20T12:32:45Z","modified":"2026-07-07T17:57:07.966932476Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6844"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/35d875319621bd129a38b2b823abf4a2f6cda536"},{"type":"PACKAGE","url":"https://github.com/corydolphin/flask-cors"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/blob/main/flask_cors/extension.py#L193"},{"type":"WEB","url":"https://huntr.com/bounties/731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00049.html"},{"type":"PACKAGE","url":"https://pypi.org/project/flask-cors"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8vgw-p6qm-5gr7"}],"versionKeys":["pypi:flask-cors@4.0.0","pypi:flask-cors@5.0.1"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-9hjg-9r4m-mvj7","slug":"ghsa-9hjg-9r4m-mvj7-32d7b63e","dossier":false,"summary":"Requests vulnerable to .netrc credentials leak via malicious URLs","aliases":["CVE-2024-47081","PYSEC-2026-1872"],"sourceIds":["GHSA-9hjg-9r4m-mvj7","PYSEC-2026-1872"],"published":"2025-06-09T19:06:08Z","modified":"2026-07-07T17:56:56.234172558Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47081"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6965"},{"type":"FIX","url":"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://requests.readthedocs.io/en/latest/api/#requests.Session.trust_env"},{"type":"WEB","url":"https://seclists.org/fulldisclosure/2025/Jun/2"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-9wx4-h78v-vm56","slug":"ghsa-9wx4-h78v-vm56-6a334c57","dossier":false,"summary":"Requests `Session` object does not verify requests after making first request with verify=False","aliases":["CVE-2024-35195","PYSEC-2026-1873"],"sourceIds":["GHSA-9wx4-h78v-vm56","PYSEC-2026-1873"],"published":"2024-05-20T20:15:00Z","modified":"2026-07-07T17:57:17.012984050Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"WEB","url":"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35195"},{"type":"WEB","url":"https://github.com/psf/requests/pull/6655"},{"type":"FIX","url":"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/N7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ"},{"type":"PACKAGE","url":"https://pypi.org/project/requests"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-9wx4-h78v-vm56"}],"versionKeys":["pypi:requests@2.31.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-c9rc-mg46-23w3","slug":"ghsa-c9rc-mg46-23w3-3ac3227d","dossier":false,"summary":"Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality","aliases":["CVE-2025-8747","PYSEC-2025-75"],"sourceIds":["GHSA-c9rc-mg46-23w3"],"published":"2025-08-12T19:33:07Z","modified":"2026-05-29T21:00:16.208455145Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/keras-team/keras/security/advisories/GHSA-c9rc-mg46-23w3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-8747"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/21429"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/713172ab56b864e59e2aa79b1a51b0e728bba858"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2025-75.yaml"},{"type":"WEB","url":"https://jfrog.com/blog/keras-safe_mode-bypass-vulnerability"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-cfh3-3jmp-rvhc","slug":"ghsa-cfh3-3jmp-rvhc-4e95572c","dossier":false,"summary":"Pillow affected by out-of-bounds write when loading PSD images","aliases":["BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249"],"sourceIds":["GHSA-cfh3-3jmp-rvhc","PYSEC-2026-2249"],"published":"2026-02-11T14:22:50Z","modified":"2026-07-13T07:26:49.514806069Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25990"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9427"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/54ba4db542ad3c7b918812a4e2d69c27735a3199"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.1.1.html"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-25990"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25990.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10184"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14873"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3461"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:3462"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4128"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:4942"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:5168"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0"],"packageCount":1,"repositoryCount":12},{"id":"GHSA-cpwx-vrp4-4pq7","slug":"ghsa-cpwx-vrp4-4pq7-799bdc98","dossier":false,"summary":"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method","aliases":["CVE-2025-27516","PYSEC-2026-1471"],"sourceIds":["GHSA-cpwx-vrp4-4pq7","PYSEC-2026-1471"],"published":"2025-03-05T20:40:14Z","modified":"2026-07-07T17:56:16.836141266Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27516"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00045.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cpwx-vrp4-4pq7"}],"versionKeys":["pypi:jinja2@3.1.3","pypi:jinja2@3.1.5"],"packageCount":1,"repositoryCount":2},{"id":"GHSA-cx63-2mw6-8hw5","slug":"ghsa-cx63-2mw6-8hw5-1754ad59","dossier":false,"summary":"setuptools vulnerable to Command Injection via package URL","aliases":["BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918"],"sourceIds":["GHSA-cx63-2mw6-8hw5","PYSEC-2026-1918"],"published":"2024-07-15T03:30:57Z","modified":"2026-07-07T17:57:13.326243614Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6345"},{"type":"WEB","url":"https://github.com/pypa/setuptools/pull/4332"},{"type":"WEB","url":"https://github.com/pypa/setuptools/commit/88807c7062788254f654ea8c03427adc859321f0"},{"type":"PACKAGE","url":"https://github.com/pypa/setuptools"},{"type":"WEB","url":"https://huntr.com/bounties/d6362117-ad57-4e83-951f-b8141c6e7ca5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00018.html"},{"type":"PACKAGE","url":"https://pypi.org/project/setuptools"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-cx63-2mw6-8hw5"}],"versionKeys":["pypi:setuptools@69.2.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-f9vj-2wh5-fj8j","slug":"ghsa-f9vj-2wh5-fj8j-f0f29e2a","dossier":false,"summary":"Werkzeug safe_join not safe on Windows","aliases":["CVE-2024-49766","PYSEC-2026-2045"],"sourceIds":["GHSA-f9vj-2wh5-fj8j","PYSEC-2026-2045"],"published":"2024-10-25T19:43:41Z","modified":"2026-07-07T17:56:25.762524663Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-f9vj-2wh5-fj8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49766"},{"type":"FIX","url":"https://github.com/pallets/werkzeug/commit/2767bcb10a7dd1c297d812cc5e6d11a474c1f092"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250131-0005"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-f9vj-2wh5-fj8j"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-gc5v-m9x4-r6x2","slug":"ghsa-gc5v-m9x4-r6x2-b9828ad8","dossier":true,"summary":"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function","aliases":["CVE-2026-25645","PYSEC-2026-2275"],"sourceIds":["GHSA-gc5v-m9x4-r6x2","PYSEC-2026-2275"],"published":"2026-03-25T16:56:28Z","modified":"2026-07-13T07:26:34.091663004Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25645"},{"type":"FIX","url":"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"},{"type":"PACKAGE","url":"https://github.com/psf/requests"},{"type":"ADVISORY","url":"https://github.com/psf/requests/releases/tag/v2.33.0"}],"versionKeys":["pypi:requests@2.31.0","pypi:requests@2.32.3","pypi:requests@2.32.4","pypi:requests@2.32.5"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-gm62-xv2j-4w53","slug":"ghsa-gm62-xv2j-4w53-5befa184","dossier":true,"summary":"urllib3 allows an unbounded number of links in the decompression chain","aliases":["CVE-2025-66418","PYSEC-2026-1998"],"sourceIds":["GHSA-gm62-xv2j-4w53","PYSEC-2026-1998"],"published":"2025-12-05T18:15:19Z","modified":"2026-07-07T17:57:28.931610368Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66418"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gm62-xv2j-4w53"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-gmj6-6f8f-6699","slug":"ghsa-gmj6-6f8f-6699-e3e02f35","dossier":false,"summary":"Jinja has a sandbox breakout through malicious filenames","aliases":["CVE-2024-56201","PYSEC-2026-1472"],"sourceIds":["GHSA-gmj6-6f8f-6699","PYSEC-2026-1472"],"published":"2024-12-23T17:54:12Z","modified":"2026-07-07T17:56:55.074166933Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56201"},{"type":"WEB","url":"https://github.com/pallets/jinja/issues/1792"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-gmj6-6f8f-6699"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-h75v-3vvj-5mfj","slug":"ghsa-h75v-3vvj-5mfj-d8fc6bb7","dossier":false,"summary":"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter","aliases":["CVE-2024-34064","PYSEC-2026-1474"],"sourceIds":["GHSA-h75v-3vvj-5mfj","PYSEC-2026-1474"],"published":"2024-05-06T14:20:59Z","modified":"2026-07-07T17:57:30.872296178Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34064"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-h75v-3vvj-5mfj"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hgf8-39gv-g3f2","slug":"ghsa-hgf8-39gv-g3f2-0469b394","dossier":false,"summary":"Werkzeug safe_join() allows Windows special device names","aliases":["CVE-2025-66221","PYSEC-2026-2046"],"sourceIds":["GHSA-hgf8-39gv-g3f2","PYSEC-2026-2046"],"published":"2025-12-02T00:27:38Z","modified":"2026-07-07T17:57:36.044527736Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-hgf8-39gv-g3f2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66221"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/4b833376a45c323a189cd11d2362bcffdb1c0c13"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.1.4"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hgf8-39gv-g3f2"}],"versionKeys":["pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3"],"packageCount":1,"repositoryCount":5},{"id":"GHSA-hjqc-jx6g-rwp9","slug":"ghsa-hjqc-jx6g-rwp9-e1daa1c5","dossier":false,"summary":"Keras Directory Traversal Vulnerability","aliases":["CVE-2025-12060","PYSEC-2026-1486"],"sourceIds":["GHSA-hjqc-jx6g-rwp9","PYSEC-2026-1486"],"published":"2025-12-02T00:58:33Z","modified":"2026-07-07T17:57:31.462260108Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}],"references":[{"type":"WEB","url":"https://github.com/keras-team/keras/security/advisories/GHSA-hjqc-jx6g-rwp9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12060"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12638"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/21760"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/47fcb397ee4caffd5a75efd1fa3067559594e951"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4"},{"type":"PACKAGE","url":"https://pypi.org/project/keras"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hjqc-jx6g-rwp9"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-hxwh-jpp2-84pm","slug":"ghsa-hxwh-jpp2-84pm-85ca3470","dossier":false,"summary":"Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default","aliases":["CVE-2024-6221","PYSEC-2024-71"],"sourceIds":["GHSA-hxwh-jpp2-84pm","PYSEC-2024-71"],"published":"2024-08-18T19:15:00Z","modified":"2026-07-09T16:56:25.795378335Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6221"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/issues/362"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/pull/363"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/pull/368"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/03aa3f8e2256437f7bad96422a747b98ab5e31bf"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/7ae310c56ac30e0b94fb42129aa377bf633256ec"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/commit/c8514760cf03fcce16d77f6db7007aad429c4548"},{"type":"PACKAGE","url":"https://github.com/corydolphin/flask-cors"},{"type":"WEB","url":"https://github.com/corydolphin/flask-cors/releases"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-260.yaml"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/flask-cors/PYSEC-2024-71.yaml"},{"type":"WEB","url":"https://huntr.com/bounties/a42935fc-6f57-4818-bca4-3d528235df4d"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-hxwh-jpp2-84pm"}],"versionKeys":["pypi:flask-cors@4.0.0"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mf9v-mfxr-j63j","slug":"ghsa-mf9v-mfxr-j63j-1a7db6d4","dossier":false,"summary":"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API","aliases":["CVE-2026-44432","PYSEC-2026-142"],"sourceIds":["GHSA-mf9v-mfxr-j63j","PYSEC-2026-142"],"published":"2026-05-11T14:51:45Z","modified":"2026-06-08T20:00:12.284378628Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44432"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2026-142.yaml"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":3},{"id":"GHSA-mf9w-mj56-hr94","slug":"ghsa-mf9w-mj56-hr94-a492e0f4","dossier":false,"summary":"python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback","aliases":["CVE-2026-28684","PYSEC-2026-2270"],"sourceIds":["GHSA-mf9w-mj56-hr94","PYSEC-2026-2270"],"published":"2026-04-20T17:16:33.087Z","modified":"2026-07-13T07:26:26.604845458Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H"}],"references":[{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28684"},{"type":"FIX","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"},{"type":"WEB","url":"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311.patch"},{"type":"PACKAGE","url":"https://github.com/theskumar/python-dotenv"},{"type":"ADVISORY","url":"https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"}],"versionKeys":["pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1"],"packageCount":1,"repositoryCount":11},{"id":"GHSA-mgx6-5cf9-rr43","slug":"ghsa-mgx6-5cf9-rr43-cc61e0fb","dossier":false,"summary":"Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)","aliases":["CVE-2026-0897","PYSEC-2026-73"],"sourceIds":["GHSA-mgx6-5cf9-rr43","PYSEC-2026-73"],"published":"2026-01-15T14:16:26.890Z","modified":"2026-06-26T18:00:04.991061489Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"WEB","url":"https://github.com/keras-team/keras/security/advisories/GHSA-mgx6-5cf9-rr43"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0897"},{"type":"FIX","url":"https://github.com/keras-team/keras/pull/21880"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/22081"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/7360d4f0d764fbb1fa9c6408fe53da41974dd4f6"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/f704c887bf459b42769bfc8a9182f838009afddb"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/keras/PYSEC-2026-73.yaml"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mgx6-5cf9-rr43"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-mq84-hjqx-cwf2","slug":"ghsa-mq84-hjqx-cwf2-572417f9","dossier":false,"summary":"Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery","aliases":["CVE-2025-12058","GHSA-qg93-c7p6-gg7f","PYSEC-2026-1487"],"sourceIds":["GHSA-mq84-hjqx-cwf2","PYSEC-2026-1487"],"published":"2025-10-29T09:30:22Z","modified":"2026-07-07T17:57:32.006640385Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}],"references":[{"type":"WEB","url":"https://github.com/keras-team/keras/security/advisories/GHSA-qg93-c7p6-gg7f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12058"},{"type":"WEB","url":"https://github.com/keras-team/keras/pull/21751"},{"type":"WEB","url":"https://github.com/keras-team/keras/commit/61ac8c1e51862c471dee7b49029c356f55531487"},{"type":"PACKAGE","url":"https://github.com/keras-team/keras"},{"type":"WEB","url":"https://www.cve.org/CVERecord?id=CVE-2025-12058"},{"type":"PACKAGE","url":"https://pypi.org/project/keras"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-mq84-hjqx-cwf2"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-pq67-6m6q-mj2v","slug":"ghsa-pq67-6m6q-mj2v-3522d1d4","dossier":false,"summary":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","aliases":["CVE-2025-50181","PYSEC-2026-1999"],"sourceIds":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"published":"2025-06-18T17:50:00Z","modified":"2026-07-07T17:56:41.872294653Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N"}],"references":[{"type":"WEB","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"type":"FIX","url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"},{"type":"WEB","url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"},{"type":"PACKAGE","url":"https://pypi.org/project/urllib3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0"],"packageCount":1,"repositoryCount":7},{"id":"GHSA-pwv6-vv43-88gr","slug":"ghsa-pwv6-vv43-88gr-c5f811d0","dossier":true,"summary":"Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)","aliases":["BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252"],"sourceIds":["GHSA-pwv6-vv43-88gr","PYSEC-2026-2252"],"published":"2026-05-04T20:20:31Z","modified":"2026-07-13T07:26:52.198871129Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-cfh3-3jmp-rvhc"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pwv6-vv43-88gr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42311"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9520"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/58f9a1d166dcb0c274807d4423522d205b0c35ea"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-q2x7-8rv6-6q7h","slug":"ghsa-q2x7-8rv6-6q7h-1113a288","dossier":false,"summary":"Jinja has a sandbox breakout through indirect reference to format method","aliases":["CVE-2024-56326","PYSEC-2026-1475"],"sourceIds":["GHSA-q2x7-8rv6-6q7h","PYSEC-2026-1475"],"published":"2024-12-23T17:56:08Z","modified":"2026-07-07T17:56:44.376174317Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56326"},{"type":"FIX","url":"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"},{"type":"PACKAGE","url":"https://github.com/pallets/jinja"},{"type":"WEB","url":"https://github.com/pallets/jinja/releases/tag/3.1.5"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html"},{"type":"PACKAGE","url":"https://pypi.org/project/jinja2"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q2x7-8rv6-6q7h"}],"versionKeys":["pypi:jinja2@3.1.3"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-q34m-jh98-gwm2","slug":"ghsa-q34m-jh98-gwm2-76f8ef0b","dossier":false,"summary":"Werkzeug possible resource exhaustion when parsing file data in forms","aliases":["CVE-2024-49767","PYSEC-2026-1860","PYSEC-2026-3417"],"sourceIds":["GHSA-q34m-jh98-gwm2","PYSEC-2026-3417"],"published":"2024-10-25T19:44:43Z","modified":"2026-07-13T16:43:34.482065524Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/pallets/werkzeug/security/advisories/GHSA-q34m-jh98-gwm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49767"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee"},{"type":"WEB","url":"https://github.com/pallets/quart/commit/abb04a512496206de279225340ed022852fbf51f"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/50cfeebcb0727e18cc52ffbeb125f4a66551179b"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/commit/cbb446fdcada7685fce936ded01b76c08dbd6eb5"},{"type":"PACKAGE","url":"https://github.com/pallets/werkzeug"},{"type":"WEB","url":"https://github.com/pallets/werkzeug/releases/tag/3.0.6"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20250103-0007"},{"type":"PACKAGE","url":"https://pypi.org/project/werkzeug"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-q34m-jh98-gwm2"}],"versionKeys":["pypi:werkzeug@3.0.1"],"packageCount":1,"repositoryCount":1},{"id":"GHSA-qccp-gfcp-xxvc","slug":"ghsa-qccp-gfcp-xxvc-0d988969","dossier":true,"summary":"urllib3: Sensitive headers forwarded across origins in proxied low-level redirects","aliases":["CVE-2026-44431","PYSEC-2026-141"],"sourceIds":["GHSA-qccp-gfcp-xxvc","PYSEC-2026-141"],"published":"2026-05-11T14:51:20Z","modified":"2026-05-20T09:19:20.983812Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44431"},{"type":"PACKAGE","url":"https://github.com/urllib3/urllib3"}],"versionKeys":["pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0","pypi:urllib3@2.6.3"],"packageCount":1,"repositoryCount":15},{"id":"GHSA-r73j-pqj5-w3x7","slug":"ghsa-r73j-pqj5-w3x7-8d4d543f","dossier":true,"summary":"Pillow has a PDF Parsing Trailer Infinite Loop (DoS)","aliases":["BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874"],"sourceIds":["GHSA-r73j-pqj5-w3x7","PYSEC-2026-2874"],"published":"2026-05-04T20:19:30Z","modified":"2026-07-13T16:42:37.358429541Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42310"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9519"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"},{"type":"PACKAGE","url":"https://pypi.org/project/pillow"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-r73j-pqj5-w3x7"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-whj4-6x5x-4v2j","slug":"ghsa-whj4-6x5x-4v2j-eb5fc6a1","dossier":true,"summary":"FITS GZIP decompression bomb in Pillow","aliases":["BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250"],"sourceIds":["GHSA-whj4-6x5x-4v2j","PYSEC-2026-2250"],"published":"2026-04-13T19:22:35Z","modified":"2026-07-13T07:26:24.246094941Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"references":[{"type":"WEB","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-whj4-6x5x-4v2j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40192"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9521"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html#prevent-fits-decompression-bomb"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-40192"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40192.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17611"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-wjx4-4jcj-g98j","slug":"ghsa-wjx4-4jcj-g98j-e937161b","dossier":true,"summary":"Pillow has an integer overflow when processing fonts","aliases":["BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165"],"sourceIds":["GHSA-wjx4-4jcj-g98j","PYSEC-2026-165"],"published":"2026-05-04T20:18:45Z","modified":"2026-06-08T23:45:16.414580348Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-wjx4-4jcj-g98j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42308"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2026-165.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.2.0"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"GHSA-xg8h-j46f-w952","slug":"ghsa-xg8h-j46f-w952-da36a616","dossier":false,"summary":"Pillow vulnerability can cause write buffer overflow on BCn encoding","aliases":["BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61"],"sourceIds":["GHSA-xg8h-j46f-w952","PYSEC-2025-61"],"published":"2025-07-01T17:29:37Z","modified":"2026-02-04T03:49:31.268130Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-xg8h-j46f-w952"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48379"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/pull/9041"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ef98b3510e3e4f14b547762764813d7e5ca3c5a4"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2025-61.yaml"},{"type":"PACKAGE","url":"https://github.com/python-pillow/Pillow"},{"type":"WEB","url":"https://github.com/python-pillow/Pillow/releases/tag/11.3.0"}],"versionKeys":["pypi:pillow@11.2.1"],"packageCount":1,"repositoryCount":4},{"id":"PYSEC-2026-2132","slug":"pysec-2026-2132-627bf7c7","dossier":true,"summary":null,"aliases":["CVE-2026-7246","GHSA-47fr-3ffg-hgmw"],"sourceIds":["PYSEC-2026-2132"],"published":"2026-04-30T14:16:36.433Z","modified":"2026-07-13T07:15:21.899333658Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"}],"references":[{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2026-7246"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7246.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24761"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464121"},{"type":"FIX","url":"https://github.com/pallets/click/releases/tag/8.3.3"},{"type":"EVIDENCE","url":"https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw"}],"versionKeys":["pypi:click@8.1.7","pypi:click@8.1.8","pypi:click@8.2.0","pypi:click@8.2.1","pypi:click@8.3.0","pypi:click@8.3.1"],"packageCount":1,"repositoryCount":14},{"id":"PYSEC-2026-2253","slug":"pysec-2026-2253-e1ccf3df","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-54059","CVE-2026-54059","GHSA-8v84-f9pq-wr9x"],"sourceIds":["PYSEC-2026-2253"],"published":"2026-07-06T19:17:08.127Z","modified":"2026-07-13T07:26:49.281845979Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-8v84-f9pq-wr9x"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2254","slug":"pysec-2026-2254-a1ed1fd2","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-54060","CVE-2026-54060","GHSA-5x94-69rx-g8h2"],"sourceIds":["PYSEC-2026-2254"],"published":"2026-07-06T19:17:08.270Z","modified":"2026-07-13T07:26:56.196935469Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-5x94-69rx-g8h2"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2255","slug":"pysec-2026-2255-d0951b98","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55379","CVE-2026-55379","GHSA-45hq-cxwh-f6vc"],"sourceIds":["PYSEC-2026-2255"],"published":"2026-07-06T19:17:08.577Z","modified":"2026-07-13T07:26:26.726353373Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/0a263e6264aa5399988d9acd3bbfbca2ca3ec77d"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-45hq-cxwh-f6vc"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2256","slug":"pysec-2026-2256-0f333f0b","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55380","CVE-2026-55380","GHSA-phj9-mv4w-65pm"],"sourceIds":["PYSEC-2026-2256"],"published":"2026-07-06T19:17:08.703Z","modified":"2026-07-13T07:26:17.085341343Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-phj9-mv4w-65pm"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2257","slug":"pysec-2026-2257-bcbe5d79","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-55798","CVE-2026-55798","GHSA-4x4j-2g7c-83w6"],"sourceIds":["PYSEC-2026-2257"],"published":"2026-07-06T19:17:08.830Z","modified":"2026-07-13T07:26:48.229039344Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/blob/main/docs/releasenotes/12.3.0.rst"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/8404ea5fe5df40fc34aa1e51403dd6fce0778b8a"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/88194166691b7b603529b8b036ab3ab9cedd2de4"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/b0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-4x4j-2g7c-83w6"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-2324","slug":"pysec-2026-2324-614c793b","dossier":false,"summary":null,"aliases":["CVE-2026-11816"],"sourceIds":["PYSEC-2026-2324"],"published":"2026-06-11T14:16:26.557Z","modified":"2026-07-13T11:00:08.009375603Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-11816"},{"type":"ADVISORY","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487912"},{"type":"ADVISORY","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11816.json"},{"type":"FIX","url":"https://github.com/keras-team/keras/commit/2465b6657b02c8eed308759b7e800e295ae01888"},{"type":"EVIDENCE","url":"https://huntr.com/bounties/a07e3983-7158-4419-af2b-38f1dea01a4f"}],"versionKeys":["pypi:keras@3.9.2"],"packageCount":1,"repositoryCount":1},{"id":"PYSEC-2026-3447","slug":"pysec-2026-3447-df031425","dossier":true,"summary":null,"aliases":["BIT-setuptools-2026-59890","CVE-2026-59890","GHSA-h35f-9h28-mq5c"],"sourceIds":["PYSEC-2026-3447"],"published":"2026-07-08T17:17:27.020Z","modified":"2026-07-14T10:56:37.948360943Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}],"references":[{"type":"ADVISORY","url":"https://github.com/pypa/setuptools/releases/tag/v83.0.0"},{"type":"FIX","url":"https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f"},{"type":"EVIDENCE","url":"https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"}],"versionKeys":["pypi:setuptools@69.2.0","pypi:setuptools@75.8.0","pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@82.0.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-3451","slug":"pysec-2026-3451-3e5eac34","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-59199","CVE-2026-59199","GHSA-6r8x-57c9-28j4"],"sourceIds":["PYSEC-2026-3451"],"published":"2026-07-14T16:17:01.937Z","modified":"2026-07-15T20:11:36.266805254Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/ceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9703"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-6r8x-57c9-28j4"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13},{"id":"PYSEC-2026-3452","slug":"pysec-2026-3452-0999fd2a","dossier":false,"summary":null,"aliases":["BIT-pillow-2026-59203","CVE-2026-59203","GHSA-pg7v-jwj7-p798"],"sourceIds":["PYSEC-2026-3452"],"published":"2026-07-14T16:17:02.063Z","modified":"2026-07-15T20:11:27.953713427Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/03992618118b4a76b6163cd72ab5ecd684133b83"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9708"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-pg7v-jwj7-p798"}],"versionKeys":["pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":4},{"id":"PYSEC-2026-3453","slug":"pysec-2026-3453-83974725","dossier":true,"summary":null,"aliases":["BIT-pillow-2026-59205","CVE-2026-59205","GHSA-9hw9-ch79-4vh6"],"sourceIds":["PYSEC-2026-3453"],"published":"2026-07-14T16:17:02.370Z","modified":"2026-07-15T20:11:15.582336837Z","checkedAt":"2026-07-20T11:49:05.682Z","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"references":[{"type":"ADVISORY","url":"https://github.com/python-pillow/Pillow/releases/tag/12.3.0"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/commit/a9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721"},{"type":"FIX","url":"https://github.com/python-pillow/Pillow/pull/9715"},{"type":"EVIDENCE","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-9hw9-ch79-4vh6"}],"versionKeys":["pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1"],"packageCount":1,"repositoryCount":13}]}}