[{"data":1,"prerenderedAt":5784},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14325":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":76,"entity":77,"evidence":292,"related":295},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-12T08:58:58.139Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-12T08:57:16.613Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5071,5059,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":42,"licenseExpressionCount":66,"knownLicensePackageCount":67,"unknownLicensePackageCount":68,"advisoryCount":69,"matchedAdvisoryRepositoryCount":70,"topPackage":71},2865,51,9911,63,2827,38,1097,43,{"id":72,"slug":73,"label":74,"repositoryCount":33,"repositoryShare":75},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":78,"slug":79,"gitlabProjectId":80,"name":81,"pathWithNamespace":82,"description":83,"webUrl":84,"commitSha":85,"commitUrl":86,"lastActivityAt":87,"headCommittedAt":88,"tree":89,"files":92,"resolvedComponentCount":100,"artifactResolvedComponentCount":100,"exactManifestPinCount":39,"packageCount":100,"ecosystems":101,"aiPackageCount":103,"licenseExpressionCount":42,"unknownLicensePackageCount":32,"advisoryIds":104,"advisoryCount":290,"providers":291},"opencode:14325","opencode-14325",14325,"URBAN.KI Sovia-app","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app","5a228fab9be01cd711aef443443722445aaa5009","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app\u002F-\u002Fcommit\u002F5a228fab9be01cd711aef443443722445aaa5009","2026-11-11T20:42:13.983Z","2026-11-11T20:42:03.000Z",{"complete":90,"entryCount":91,"truncated":47},true,57,[93],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},"uv-lock","23045eafdfb483ec149e375bcdcde05eebbacd50","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app\u002F-\u002Fblob\u002F5a228fab9be01cd711aef443443722445aaa5009\u002Fuv.lock","b74bb096d47b3a37759845db494e848a6612ed5aae81025097905744d143687b",194138,"parsed",75,[102],"pypi",2,[105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289],"GHSA-22hg-r758-rrw9","GHSA-239g-whfq-7xj9","GHSA-23mf-xhv8-69c2","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-284h-m62q-gf8w","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3hv7-mjh2-fv65","GHSA-3j72-p6qg-6xp7","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4x4j-2g7c-83w6","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59cr-6r3x-644w","GHSA-5p39-cfhj-2xmp","GHSA-5rjg-fvgr-3xxf","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69hj-f68j-2879","GHSA-6p8h-3wgx-97gf","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-74r2-7ff9-mjj2","GHSA-7545-fcxq-7j24","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-78g4-xqwv-q3g8","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-7p48-42j8-8846","GHSA-82r6-8w77-94w6","GHSA-83vg-56qc-22m7","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mcc-hrx5-hvxc","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cwqr-hh33-gh44","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f9j4-qggq-h239","GHSA-fc9g-5qg7-mf45","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fq56-3cx3-fjxp","GHSA-fx3j-rwgx-fr94","GHSA-g4qv-2jxx-769h","GHSA-g5vv-9gxw-82hx","GHSA-g7cr-3p24-7wf7","GHSA-g842-9rc4-69pw","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gq48-pqfc-9p58","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg86-v3jv-hrpm","GHSA-jhmp-mqwm-3gq8","GHSA-jjj6-mw9f-p565","GHSA-jm78-9fvv-mhgr","GHSA-m64x-33q8-m5h7","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mrfp-p49p-3hf2","GHSA-mv93-w799-cj2w","GHSA-p4wg-p73j-c528","GHSA-p538-c434-8v24","GHSA-p8hx-v2p6-rp84","GHSA-pcg2-g6cj-q92c","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pw9p-v7r6-gx4p","GHSA-pwv6-vv43-88gr","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-r4j5-9xpp-3985","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v4x8-3wr5-3wq8","GHSA-v87r-6q3f-2j67","GHSA-v9pv-5gc8-w2m6","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vqwp-45wm-r9r5","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-w8jc-g24h-crhw","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xvh5-g6gv-559v","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2026-139",185,[],{"files":293,"occurrenceCount":100},[294],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},{"packages":296,"vulnerabilities":984},[297,308,318,330,340,350,362,372,383,392,402,411,421,430,439,448,457,466,475,484,493,502,511,520,529,538,547,556,565,574,583,592,601,610,619,628,637,646,655,665,674,683,692,700,709,718,727,736,745,754,763,772,780,789,797,807,816,825,834,843,852,861,870,879,888,898,907,916,925,934,943,952,959,967,976],{"id":298,"slug":299,"identity":300,"label":301,"aiRelevant":90,"provider":83,"advisoryCount":302,"licenseExpressions":303,"versions":305,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":307},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[304],"BSD-3-Clause",[306],"2.9.0",[56],{"id":309,"slug":310,"identity":311,"label":312,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":313,"versions":315,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":317},"package:pypi:opencv-python","opencv-python-bfa06e24","pypi:opencv-python","OpenCV",[314],"Apache-2.0",[316],"4.12.0.88",[56],{"id":319,"slug":320,"identity":321,"label":322,"aiRelevant":47,"provider":83,"advisoryCount":323,"licenseExpressions":324,"versions":327,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":329},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",61,[325,326],"HPND","MIT-CMU",[328],"12.0.0",[56],{"id":331,"slug":332,"identity":333,"label":334,"aiRelevant":47,"provider":83,"advisoryCount":335,"licenseExpressions":336,"versions":337,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":339},"package:pypi:gitpython","gitpython-dcd13009","pypi:gitpython","gitpython",37,[304],[338],"3.1.45",[56],{"id":341,"slug":342,"identity":343,"label":344,"aiRelevant":47,"provider":83,"advisoryCount":345,"licenseExpressions":346,"versions":347,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":349},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",19,[314],[348],"6.5.2",[56],{"id":351,"slug":352,"identity":353,"label":354,"aiRelevant":47,"provider":83,"advisoryCount":355,"licenseExpressions":356,"versions":359,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":361},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",11,[357,358],"MIT","Unlicense",[360],"3.20.0",[56],{"id":363,"slug":364,"identity":365,"label":366,"aiRelevant":47,"provider":83,"advisoryCount":367,"licenseExpressions":368,"versions":369,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":371},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[357],[370],"2.5.0",[56],{"id":373,"slug":374,"identity":375,"label":376,"aiRelevant":47,"provider":83,"advisoryCount":377,"licenseExpressions":378,"versions":380,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":382},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[304,379],"non-standard",[381],"3.1.6",[56],{"id":384,"slug":385,"identity":386,"label":387,"aiRelevant":47,"provider":83,"advisoryCount":377,"licenseExpressions":388,"versions":389,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":391},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[357],[390],"80.9.0",[56],{"id":393,"slug":394,"identity":395,"label":396,"aiRelevant":47,"provider":83,"advisoryCount":397,"licenseExpressions":398,"versions":399,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":401},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[314],[400],"2.32.5",[56],{"id":403,"slug":404,"identity":405,"label":406,"aiRelevant":47,"provider":83,"advisoryCount":103,"licenseExpressions":407,"versions":408,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":410},"package:pypi:anyio","anyio-399e5280","pypi:anyio","anyio",[357],[409],"4.11.0",[56],{"id":412,"slug":413,"identity":414,"label":415,"aiRelevant":47,"provider":83,"advisoryCount":103,"licenseExpressions":416,"versions":418,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":420},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[417],"MPL-2.0",[419],"2025.10.5",[56],{"id":422,"slug":423,"identity":424,"label":425,"aiRelevant":47,"provider":83,"advisoryCount":103,"licenseExpressions":426,"versions":427,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":429},"package:pypi:protobuf","protobuf-6e30009a","pypi:protobuf","protobuf",[304],[428],"6.33.0",[56],{"id":431,"slug":432,"identity":433,"label":434,"aiRelevant":47,"provider":83,"advisoryCount":103,"licenseExpressions":435,"versions":436,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":438},"package:pypi:streamlit","streamlit-b61aa01e","pypi:streamlit","streamlit",[314],[437],"1.51.0",[56],{"id":440,"slug":441,"identity":442,"label":443,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":444,"versions":445,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":447},"package:pypi:duckdb","duckdb-8c0332c9","pypi:duckdb","duckdb",[357],[446],"1.4.1",[56],{"id":449,"slug":450,"identity":451,"label":452,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":453,"versions":454,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":456},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[304],[455],"2025.10.0",[56],{"id":458,"slug":459,"identity":460,"label":461,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":462,"versions":463,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":465},"package:pypi:h11","h11-48165ab1","pypi:h11","h11",[357],[464],"0.16.0",[56],{"id":467,"slug":468,"identity":469,"label":470,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":471,"versions":472,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":474},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[304,379],[473],"3.11",[56],{"id":476,"slug":477,"identity":478,"label":479,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":480,"versions":481,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":483},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[314,379],[482],"21.0.0",[56],{"id":485,"slug":486,"identity":487,"label":488,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":489,"versions":490,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":492},"package:pypi:altair","altair-01b7f976","pypi:altair","altair",[304],[491],"5.5.0",[56],{"id":494,"slug":495,"identity":496,"label":497,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":498,"versions":499,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":501},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[357],[500],"25.4.0",[56],{"id":503,"slug":504,"identity":505,"label":506,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":507,"versions":508,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":510},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[357],[509],"1.9.0",[56],{"id":512,"slug":513,"identity":514,"label":515,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":516,"versions":517,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":519},"package:pypi:branca","branca-e1a3550c","pypi:branca","branca",[357],[518],"0.8.2",[56],{"id":521,"slug":522,"identity":523,"label":524,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":525,"versions":526,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":528},"package:pypi:cachetools","cachetools-84fe6563","pypi:cachetools","cachetools",[357],[527],"6.2.1",[56],{"id":530,"slug":531,"identity":532,"label":533,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":534,"versions":535,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":537},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[357],[536],"3.4.4",[56],{"id":539,"slug":540,"identity":541,"label":542,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":543,"versions":544,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":546},"package:pypi:click","click-ef97f731","pypi:click","click",[304,379],[545],"8.3.0",[56],{"id":548,"slug":549,"identity":550,"label":551,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":552,"versions":553,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":555},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[379],[554],"0.4.6",[56],{"id":557,"slug":558,"identity":559,"label":560,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":561,"versions":562,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":564},"package:pypi:filepath","filepath-6e8545d1","pypi:filepath","filepath",[357],[563],"0.1",[56],{"id":566,"slug":567,"identity":568,"label":569,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":570,"versions":571,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":573},"package:pypi:folium","folium-6e89a148","pypi:folium","folium",[357],[572],"0.20.0",[56],{"id":575,"slug":576,"identity":577,"label":578,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":579,"versions":580,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":582},"package:pypi:gitdb","gitdb-dac4580b","pypi:gitdb","gitdb",[379],[581],"4.0.12",[56],{"id":584,"slug":585,"identity":586,"label":587,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":588,"versions":589,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":591},"package:pypi:httpcore","httpcore-ba6ae671","pypi:httpcore","httpcore",[304],[590],"1.0.9",[56],{"id":593,"slug":594,"identity":595,"label":596,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":597,"versions":598,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":600},"package:pypi:httpx","httpx-a512a166","pypi:httpx","httpx",[304],[599],"0.28.1",[56],{"id":602,"slug":603,"identity":604,"label":605,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":606,"versions":607,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":609},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[357],[608],"4.25.1",[56],{"id":611,"slug":612,"identity":613,"label":614,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":615,"versions":616,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":618},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[357],[617],"2025.9.1",[56],{"id":620,"slug":621,"identity":622,"label":623,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":624,"versions":625,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":627},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[304],[626],"3.0.3",[56],{"id":629,"slug":630,"identity":631,"label":632,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":633,"versions":634,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":636},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[304],[635],"1.3.0",[56],{"id":638,"slug":639,"identity":640,"label":641,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":642,"versions":643,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":645},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[357],[644],"2.11.0",[56],{"id":647,"slug":648,"identity":649,"label":650,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":651,"versions":652,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":654},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[304,379],[653],"3.5",[56],{"id":656,"slug":657,"identity":658,"label":659,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":660,"versions":662,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":664},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[661,379],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[663],"2.2.6",[56],{"id":666,"slug":667,"identity":668,"label":669,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":670,"versions":671,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":673},"package:pypi:nvidia-cublas-cu12","nvidia-cublas-cu12-1d052261","pypi:nvidia-cublas-cu12","nvidia-cublas-cu12",[379],[672],"12.8.4.1",[56],{"id":675,"slug":676,"identity":677,"label":678,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":679,"versions":680,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":682},"package:pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12-973480f1","pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12",[379],[681],"12.8.90",[56],{"id":684,"slug":685,"identity":686,"label":687,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":688,"versions":689,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":691},"package:pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12-e32b7f38","pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12",[379],[690],"12.8.93",[56],{"id":693,"slug":694,"identity":695,"label":696,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":697,"versions":698,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":699},"package:pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12-2b875d2a","pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12",[379],[681],[56],{"id":701,"slug":702,"identity":703,"label":704,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":705,"versions":706,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":708},"package:pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12-a21dce6d","pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12",[379],[707],"9.10.2.21",[56],{"id":710,"slug":711,"identity":712,"label":713,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":714,"versions":715,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":717},"package:pypi:nvidia-cufft-cu12","nvidia-cufft-cu12-21ff54dd","pypi:nvidia-cufft-cu12","nvidia-cufft-cu12",[379],[716],"11.3.3.83",[56],{"id":719,"slug":720,"identity":721,"label":722,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":723,"versions":724,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":726},"package:pypi:nvidia-cufile-cu12","nvidia-cufile-cu12-14048140","pypi:nvidia-cufile-cu12","nvidia-cufile-cu12",[379],[725],"1.13.1.3",[56],{"id":728,"slug":729,"identity":730,"label":731,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":732,"versions":733,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":735},"package:pypi:nvidia-curand-cu12","nvidia-curand-cu12-2fed778b","pypi:nvidia-curand-cu12","nvidia-curand-cu12",[379],[734],"10.3.9.90",[56],{"id":737,"slug":738,"identity":739,"label":740,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":741,"versions":742,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":744},"package:pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12-7db0a33a","pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12",[379],[743],"11.7.3.90",[56],{"id":746,"slug":747,"identity":748,"label":749,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":750,"versions":751,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":753},"package:pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12-d7e6a309","pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12",[379],[752],"12.5.8.93",[56],{"id":755,"slug":756,"identity":757,"label":758,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":759,"versions":760,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":762},"package:pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12-97587f50","pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12",[379],[761],"0.7.1",[56],{"id":764,"slug":765,"identity":766,"label":767,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":768,"versions":769,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":771},"package:pypi:nvidia-nccl-cu12","nvidia-nccl-cu12-90361558","pypi:nvidia-nccl-cu12","nvidia-nccl-cu12",[304],[770],"2.27.5",[56],{"id":773,"slug":774,"identity":775,"label":776,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":777,"versions":778,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":779},"package:pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12-6d08af75","pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12",[379],[690],[56],{"id":781,"slug":782,"identity":783,"label":784,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":785,"versions":786,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":788},"package:pypi:nvidia-nvshmem-cu12","nvidia-nvshmem-cu12-d7141303","pypi:nvidia-nvshmem-cu12","nvidia-nvshmem-cu12",[304,379],[787],"3.3.20",[56],{"id":790,"slug":791,"identity":792,"label":793,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":794,"versions":795,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":796},"package:pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12-9a2d0378","pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12",[314,379],[681],[56],{"id":798,"slug":799,"identity":800,"label":801,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":802,"versions":804,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":806},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[803,379],"Apache-2.0 OR BSD-2-Clause",[805],"25.0",[56],{"id":808,"slug":809,"identity":810,"label":811,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":812,"versions":813,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":815},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[304,379],[814],"2.3.3",[56],{"id":817,"slug":818,"identity":819,"label":820,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":821,"versions":822,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":824},"package:pypi:pydeck","pydeck-75380c92","pypi:pydeck","pydeck",[314],[823],"0.9.1",[56],{"id":826,"slug":827,"identity":828,"label":829,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":830,"versions":831,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":833},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[379],[832],"2.9.0.post0",[56],{"id":835,"slug":836,"identity":837,"label":838,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":839,"versions":840,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":842},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[357],[841],"2025.2",[56],{"id":844,"slug":845,"identity":846,"label":847,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":848,"versions":849,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":851},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[357],[850],"0.37.0",[56],{"id":853,"slug":854,"identity":855,"label":856,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":857,"versions":858,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":860},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[357],[859],"0.28.0",[56],{"id":862,"slug":863,"identity":864,"label":865,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":866,"versions":867,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":869},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[304],[868],"2.1.2",[56],{"id":871,"slug":872,"identity":873,"label":874,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":875,"versions":876,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":878},"package:pypi:six","six-3c3888bd","pypi:six","six",[357],[877],"1.17.0",[56],{"id":880,"slug":881,"identity":882,"label":883,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":884,"versions":885,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":887},"package:pypi:smmap","smmap-943fc5aa","pypi:smmap","smmap",[304],[886],"5.0.2",[56],{"id":889,"slug":890,"identity":891,"label":892,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":893,"versions":895,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":897},"package:pypi:sniffio","sniffio-83f32c9d","pypi:sniffio","sniffio",[894],"Apache-2.0 OR MIT",[896],"1.3.1",[56],{"id":899,"slug":900,"identity":901,"label":902,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":903,"versions":904,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":906},"package:pypi:streamlit-folium","streamlit-folium-e76fb4ea","pypi:streamlit-folium","streamlit-folium",[],[905],"0.25.3",[56],{"id":908,"slug":909,"identity":910,"label":911,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":912,"versions":913,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":915},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[304,357,379],[914],"1.14.0",[56],{"id":917,"slug":918,"identity":919,"label":920,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":921,"versions":922,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":924},"package:pypi:tenacity","tenacity-415454f8","pypi:tenacity","tenacity",[314],[923],"9.1.2",[56],{"id":926,"slug":927,"identity":928,"label":929,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":930,"versions":931,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":933},"package:pypi:toml","toml-490ac3c8","pypi:toml","toml",[357],[932],"0.10.2",[56],{"id":935,"slug":936,"identity":937,"label":938,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":939,"versions":940,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":942},"package:pypi:torchvision","torchvision-7f85cafa","pypi:torchvision","torchvision",[304],[941],"0.24.0",[56],{"id":944,"slug":945,"identity":946,"label":947,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":948,"versions":949,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":951},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[357],[950],"3.5.0",[56],{"id":72,"slug":73,"identity":953,"label":74,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":954,"versions":956,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":958},"pypi:typing-extensions",[955,379],"PSF-2.0",[957],"4.15.0",[56],{"id":960,"slug":961,"identity":962,"label":963,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":964,"versions":965,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":966},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[314],[841],[56],{"id":968,"slug":969,"identity":970,"label":971,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":972,"versions":973,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":975},"package:pypi:watchdog","watchdog-55ddb444","pypi:watchdog","watchdog",[314],[974],"6.0.0",[56],{"id":977,"slug":978,"identity":979,"label":980,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":981,"versions":982,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":983},"package:pypi:xyzservices","xyzservices-a1955a18","pypi:xyzservices","xyzservices",[304],[455],[56],[985,1023,1060,1082,1117,1141,1163,1187,1230,1257,1288,1324,1346,1389,1415,1442,1473,1499,1528,1558,1581,1608,1634,1656,1683,1712,1736,1760,1789,1813,1837,1865,1889,1911,1950,1986,2010,2033,2054,2084,2107,2137,2187,2214,2242,2263,2289,2315,2351,2377,2398,2421,2453,2483,2507,2532,2572,2595,2624,2651,2675,2698,2735,2767,2789,2821,2840,2871,2894,2921,2949,2987,3013,3040,3067,3087,3117,3139,3171,3193,3218,3272,3297,3321,3353,3373,3397,3428,3449,3482,3502,3522,3550,3573,3596,3617,3642,3667,3691,3716,3743,3764,3788,3811,3839,3858,3892,3925,3952,3984,4005,4027,4048,4070,4097,4121,4141,4162,4183,4208,4231,4252,4273,4300,4323,4346,4370,4397,4421,4445,4470,4486,4513,4540,4566,4586,4605,4638,4664,4691,4713,4741,4764,4786,4808,4838,4858,4892,4922,4942,4962,4986,5014,5041,5070,5112,5130,5154,5184,5206,5226,5278,5301,5328,5352,5374,5406,5433,5456,5481,5502,5532,5554,5574,5591,5610,5627,5648,5664,5679,5696,5711,5728,5745,5762],{"id":105,"slug":986,"dossier":90,"summary":987,"aliases":988,"sourceIds":991,"published":992,"modified":993,"checkedAt":7,"severity":994,"references":998,"versionKeys":1012,"packageCount":32,"repositoryCount":345},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[989,990],"BIT-pillow-2026-112390","CVE-2026-112390",[105],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[995],{"type":996,"score":997},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[999,1002,1005,1007,1010],{"type":1000,"url":1001},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1003,"url":1004},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1000,"url":1006},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1008,"url":1009},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1000,"url":1011},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",{"id":106,"slug":1024,"dossier":47,"summary":1025,"aliases":1026,"sourceIds":1029,"published":1030,"modified":1031,"checkedAt":7,"severity":1032,"references":1038,"versionKeys":1056,"packageCount":32,"repositoryCount":34},"ghsa-239g-whfq-7xj9-ede3fcd6","GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution",[1027,1028],"CVE-2026-87817","PYSEC-2026-3982",[106,1028],"2026-09-09T12:17:16.830Z","2026-09-30T23:45:04.022111787Z",[1033,1036],{"type":1034,"score":1035},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":996,"score":1037},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1039,1042,1044,1046,1048,1050,1052,1054],{"type":1040,"url":1041},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-239g-whfq-7xj9",{"type":1003,"url":1043},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87817",{"type":1000,"url":1045},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2218",{"type":1000,"url":1047},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fc7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b",{"type":1008,"url":1049},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython",{"type":1000,"url":1051},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.60",{"type":1000,"url":1053},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3982.yaml",{"type":1003,"url":1055},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",[1057,1058,1059],"pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46",{"id":107,"slug":1061,"dossier":47,"summary":1062,"aliases":1063,"sourceIds":1065,"published":1066,"modified":1067,"checkedAt":7,"severity":1068,"references":1071,"versionKeys":1081,"packageCount":32,"repositoryCount":34},"ghsa-23mf-xhv8-69c2-0feffb42","GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)",[1064],"CVE-2026-110859",[107],"2026-10-27T15:28:03Z","2026-10-27T15:47:08.812491596Z",[1069],{"type":996,"score":1070},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1072,1074,1076,1078,1079],{"type":1000,"url":1073},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-23mf-xhv8-69c2",{"type":1000,"url":1075},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2233",{"type":1000,"url":1077},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8da65080849a56a2fc9f3e7817bbf0524e8397d5",{"type":1008,"url":1049},{"type":1000,"url":1080},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.0",[1057,1058,1059],{"id":108,"slug":1083,"dossier":47,"summary":1084,"aliases":1085,"sourceIds":1088,"published":1089,"modified":1090,"checkedAt":7,"severity":1091,"references":1094,"versionKeys":1115,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1086,1087],"CVE-2024-39689","PYSEC-2024-230",[108,1087],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1092],{"type":1034,"score":1093},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1095,1097,1099,1102,1104,1106,1109,1111,1113],{"type":1003,"url":1096},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1003,"url":1098},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1100,"url":1101},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1008,"url":1103},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1000,"url":1105},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1107,"url":1108},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1000,"url":1110},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1003,"url":1112},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1003,"url":1114},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1116],"pypi:certifi@2024.6.2",{"id":109,"slug":1118,"dossier":90,"summary":1119,"aliases":1120,"sourceIds":1123,"published":1124,"modified":1125,"checkedAt":7,"severity":1126,"references":1129,"versionKeys":1140,"packageCount":32,"repositoryCount":345},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1121,1122],"BIT-pillow-2026-96638","CVE-2026-96638",[109],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1127],{"type":1034,"score":1128},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1130,1132,1134,1136,1138,1139],{"type":1000,"url":1131},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1003,"url":1133},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1000,"url":1135},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1000,"url":1137},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":110,"slug":1142,"dossier":90,"summary":1143,"aliases":1144,"sourceIds":1147,"published":1148,"modified":1149,"checkedAt":7,"severity":1150,"references":1153,"versionKeys":1162,"packageCount":32,"repositoryCount":345},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1145,1146],"BIT-pillow-2026-112391","CVE-2026-112391",[110],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1151],{"type":996,"score":1152},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1154,1156,1158,1160,1161],{"type":1000,"url":1155},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1003,"url":1157},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1000,"url":1159},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":111,"slug":1164,"dossier":90,"summary":1165,"aliases":1166,"sourceIds":1170,"published":1171,"modified":1172,"checkedAt":7,"severity":1173,"references":1177,"versionKeys":1186,"packageCount":32,"repositoryCount":345},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1167,1168,1169],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[111,1169],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1174,1175],{"type":996,"score":997},{"type":1034,"score":1176},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1178,1180,1182,1184,1185],{"type":1100,"url":1179},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1003,"url":1181},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1100,"url":1183},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":112,"slug":1188,"dossier":47,"summary":1189,"aliases":1190,"sourceIds":1193,"published":1194,"modified":1195,"checkedAt":7,"severity":1196,"references":1198,"versionKeys":1219,"packageCount":32,"repositoryCount":1229},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1191,1192],"CVE-2026-104851","PYSEC-2026-4217",[112,1192],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1197],{"type":1034,"score":1035},[1199,1201,1203,1205,1207,1209,1211,1213,1215,1217],{"type":1000,"url":1200},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1003,"url":1202},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1000,"url":1204},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1000,"url":1206},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1000,"url":1208},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1000,"url":1210},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1008,"url":1212},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1000,"url":1214},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1008,"url":1216},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1003,"url":1218},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1220,1221,1222,1223,1224,1225,1226,1227,1228],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",15,{"id":113,"slug":1231,"dossier":47,"summary":1232,"aliases":1233,"sourceIds":1236,"published":1237,"modified":1238,"checkedAt":7,"severity":1239,"references":1246,"versionKeys":1256,"packageCount":32,"repositoryCount":34},"ghsa-284h-m62q-gf8w-da9acb0c","GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE",[1234,1235],"CVE-2026-78676","PYSEC-2026-3786",[113,1235],"2026-08-25T02:16:52.030Z","2026-09-08T19:00:06.885837775Z",[1240,1242,1244],{"type":1034,"score":1241},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":996,"score":1243},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":996,"score":1245},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1247,1249,1251,1252,1254],{"type":1040,"url":1248},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-284h-m62q-gf8w",{"type":1003,"url":1250},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78676",{"type":1008,"url":1049},{"type":1000,"url":1253},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3786.yaml",{"type":1003,"url":1255},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-config-injection",[1057,1058,1059],{"id":114,"slug":1258,"dossier":47,"summary":1259,"aliases":1260,"sourceIds":1263,"published":1264,"modified":1265,"checkedAt":7,"severity":1266,"references":1269,"versionKeys":1287,"packageCount":32,"repositoryCount":34},"ghsa-2f96-g7mh-g2hx-dd7ec02d","GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist",[1261,1262],"CVE-2026-67325","PYSEC-2026-3836",[114,1262],"2026-07-21T19:43:43Z","2026-09-23T05:15:05.950374846Z",[1267],{"type":1034,"score":1268},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1270,1272,1274,1276,1278,1279,1281,1283,1285],{"type":1000,"url":1271},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",{"type":1003,"url":1273},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67325",{"type":1000,"url":1275},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2161",{"type":1000,"url":1277},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F56806080c1348749b07daa4a2024ce47b3cad285",{"type":1008,"url":1049},{"type":1000,"url":1280},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.51",{"type":1000,"url":1282},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-option-prefix-abbreviation",{"type":1008,"url":1284},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fgitpython",{"type":1003,"url":1286},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",[1057,1058,1059],{"id":115,"slug":1289,"dossier":47,"summary":1290,"aliases":1291,"sourceIds":1294,"published":1295,"modified":1296,"checkedAt":7,"severity":1297,"references":1300,"versionKeys":1317,"packageCount":32,"repositoryCount":1323},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1292,1293],"CVE-2025-66471","PYSEC-2026-1994",[115,1293],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1298],{"type":996,"score":1299},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1301,1303,1305,1307,1309,1311,1313,1315],{"type":1000,"url":1302},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1003,"url":1304},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1100,"url":1306},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1000,"url":1308},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1003,"url":1310},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1000,"url":1312},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1008,"url":1314},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1008,"url":1316},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1318,1319,1320,1321,1322],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":116,"slug":1325,"dossier":90,"summary":1326,"aliases":1327,"sourceIds":1330,"published":1331,"modified":1332,"checkedAt":7,"severity":1333,"references":1336,"versionKeys":1345,"packageCount":32,"repositoryCount":345},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1328,1329],"BIT-pillow-2026-112393","CVE-2026-112393",[116],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1334],{"type":996,"score":1335},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1337,1339,1341,1343,1344],{"type":1000,"url":1338},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1003,"url":1340},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1000,"url":1342},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":117,"slug":1347,"dossier":47,"summary":1348,"aliases":1349,"sourceIds":1353,"published":1354,"modified":1355,"checkedAt":7,"severity":1356,"references":1363,"versionKeys":1385,"packageCount":32,"repositoryCount":397},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1350,1351,1352],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[117,1352],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1357,1359,1361],{"type":1034,"score":1358},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":996,"score":1360},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1034,"score":1362},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1364,1366,1369,1371,1373,1375,1377,1379,1381,1383],{"type":1003,"url":1365},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1367,"url":1368},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1367,"url":1370},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1000,"url":1372},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1008,"url":1374},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1000,"url":1376},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1367,"url":1378},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1003,"url":1380},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1003,"url":1382},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1003,"url":1384},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1386,1387,1388],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":118,"slug":1390,"dossier":47,"summary":1391,"aliases":1392,"sourceIds":1395,"published":1396,"modified":1397,"checkedAt":7,"severity":1398,"references":1401,"versionKeys":1414,"packageCount":32,"repositoryCount":1323},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1393,1394],"CVE-2026-21441","PYSEC-2026-1996",[118,1394],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1399,1400],{"type":1034,"score":1176},{"type":996,"score":1299},[1402,1404,1406,1408,1409,1411,1412],{"type":1000,"url":1403},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1003,"url":1405},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1100,"url":1407},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1008,"url":1314},{"type":1000,"url":1410},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1008,"url":1316},{"type":1003,"url":1413},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1318,1319,1320,1321,1322],{"id":119,"slug":1416,"dossier":47,"summary":1417,"aliases":1418,"sourceIds":1421,"published":1422,"modified":1423,"checkedAt":7,"severity":1424,"references":1429,"versionKeys":1441,"packageCount":32,"repositoryCount":34},"ghsa-3f7w-8rr8-f37f-9cab61a6","GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read",[1419,1420],"CVE-2026-73620","PYSEC-2026-3949",[119,1420],"2026-08-03T20:09:56Z","2026-09-10T13:10:44.075529324Z",[1425,1427],{"type":1034,"score":1426},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":996,"score":1428},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1430,1432,1434,1436,1437,1439],{"type":1040,"url":1431},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3f7w-8rr8-f37f",{"type":1000,"url":1433},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2193",{"type":1000,"url":1435},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F3af0c2516c5e18c829da30338614688f6b69b49c",{"type":1008,"url":1049},{"type":1000,"url":1438},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.57",{"type":1003,"url":1440},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-and-read",[1057,1058,1059],{"id":120,"slug":1443,"dossier":47,"summary":1444,"aliases":1445,"sourceIds":1447,"published":1448,"modified":1449,"checkedAt":7,"severity":1450,"references":1453,"versionKeys":1466,"packageCount":32,"repositoryCount":355},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[1446],"CVE-2026-103261",[120],"2026-09-30T23:49:25Z","2026-10-02T03:56:09.601689224Z",[1451],{"type":1034,"score":1452},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1454,1456,1458,1460,1462,1464],{"type":1000,"url":1455},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1000,"url":1457},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1000,"url":1459},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1000,"url":1461},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1008,"url":1463},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1000,"url":1465},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1467,1468,1469,1470,1471,1472],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7",{"id":121,"slug":1474,"dossier":90,"summary":1475,"aliases":1476,"sourceIds":1480,"published":1481,"modified":1482,"checkedAt":7,"severity":1483,"references":1487,"versionKeys":1498,"packageCount":32,"repositoryCount":345},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1477,1478,1479],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[121,1479],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1484,1486],{"type":996,"score":1485},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":1128},[1488,1490,1492,1494,1496,1497],{"type":1003,"url":1489},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1003,"url":1491},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1367,"url":1493},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1100,"url":1495},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":122,"slug":1500,"dossier":47,"summary":1501,"aliases":1502,"sourceIds":1505,"published":1506,"modified":1507,"checkedAt":7,"severity":1508,"references":1513,"versionKeys":1527,"packageCount":32,"repositoryCount":34},"ghsa-3rp5-jjmw-4wv2-6d7352e6","GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)",[1503,1504],"CVE-2026-69097","PYSEC-2026-3981",[122,1504],"2026-07-24T16:22:02Z","2026-10-23T21:47:05Z",[1509,1511],{"type":1034,"score":1510},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1034,"score":1512},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1514,1516,1518,1520,1521,1523,1525],{"type":1040,"url":1515},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3rp5-jjmw-4wv2",{"type":1000,"url":1517},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2176",{"type":1000,"url":1519},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed1b924f4e2d2ee7bab296df77b978af21853f1",{"type":1008,"url":1049},{"type":1000,"url":1522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.53",{"type":1000,"url":1524},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3981.yaml",{"type":1003,"url":1526},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-submodule-names",[1057,1058,1059],{"id":123,"slug":1529,"dossier":47,"summary":1530,"aliases":1531,"sourceIds":1534,"published":1535,"modified":1536,"checkedAt":7,"severity":1537,"references":1540,"versionKeys":1557,"packageCount":32,"repositoryCount":34},"ghsa-3wxw-xv34-2frg-c013ae2d","GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)",[1532,1533],"CVE-2026-78679","PYSEC-2026-3837",[123,1533],"2026-09-08T19:42:22Z","2026-09-23T05:15:05.925079070Z",[1538],{"type":1034,"score":1539},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1541,1543,1545,1547,1549,1550,1552,1554,1555],{"type":1000,"url":1542},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",{"type":1003,"url":1544},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78679",{"type":1000,"url":1546},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2208",{"type":1000,"url":1548},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6",{"type":1008,"url":1049},{"type":1000,"url":1551},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.59",{"type":1000,"url":1553},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-tagreference-create",{"type":1008,"url":1284},{"type":1003,"url":1556},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",[1057,1058,1059],{"id":124,"slug":1559,"dossier":47,"summary":1560,"aliases":1561,"sourceIds":1564,"published":1565,"modified":1566,"checkedAt":7,"severity":1567,"references":1570,"versionKeys":1580,"packageCount":32,"repositoryCount":367},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1562,1563],"CVE-2026-49853","PYSEC-2026-3387",[124,1563],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1568],{"type":1034,"score":1569},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1571,1573,1574,1576,1578],{"type":1000,"url":1572},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1008,"url":1463},{"type":1008,"url":1575},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1003,"url":1577},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1003,"url":1579},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1467,1468,1469,1470,1471],{"id":125,"slug":1582,"dossier":90,"summary":1583,"aliases":1584,"sourceIds":1588,"published":1589,"modified":1590,"checkedAt":7,"severity":1591,"references":1596,"versionKeys":1607,"packageCount":32,"repositoryCount":345},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[1585,1586,1587],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[125,1587],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[1592,1594],{"type":996,"score":1593},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":1595},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[1597,1599,1601,1603,1605,1606],{"type":1040,"url":1598},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1003,"url":1600},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1000,"url":1602},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1100,"url":1604},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":126,"slug":1609,"dossier":47,"summary":1610,"aliases":1611,"sourceIds":1615,"published":1616,"modified":1617,"checkedAt":7,"severity":1618,"references":1620,"versionKeys":1632,"packageCount":32,"repositoryCount":1633},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[1612,1613,1614],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[126,1614],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[1619],{"type":1034,"score":1176},[1621,1623,1625,1627,1629,1630],{"type":1040,"url":1622},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1003,"url":1624},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1100,"url":1626},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1000,"url":1628},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1008,"url":1009},{"type":1003,"url":1631},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1013,1014,1015,1016,1017,1018,1019,1020,1021],18,{"id":127,"slug":1635,"dossier":90,"summary":1636,"aliases":1637,"sourceIds":1640,"published":1641,"modified":1642,"checkedAt":7,"severity":1643,"references":1646,"versionKeys":1655,"packageCount":32,"repositoryCount":345},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[1638,1639],"BIT-pillow-2026-112395","CVE-2026-112395",[127],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[1644],{"type":1034,"score":1645},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[1647,1649,1651,1653,1654],{"type":1000,"url":1648},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1003,"url":1650},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1000,"url":1652},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":128,"slug":1657,"dossier":47,"summary":1658,"aliases":1659,"sourceIds":1662,"published":1663,"modified":1664,"checkedAt":7,"severity":1665,"references":1668,"versionKeys":1681,"packageCount":32,"repositoryCount":1682},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[1660,1661],"CVE-2025-50182","PYSEC-2026-1997",[128,1661],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[1666],{"type":1034,"score":1667},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1669,1671,1673,1675,1676,1678,1679],{"type":1000,"url":1670},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1003,"url":1672},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1100,"url":1674},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1008,"url":1314},{"type":1000,"url":1677},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1008,"url":1316},{"type":1003,"url":1680},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1318,1319,1320,1321],8,{"id":129,"slug":1684,"dossier":47,"summary":1685,"aliases":1686,"sourceIds":1689,"published":1690,"modified":1691,"checkedAt":7,"severity":1692,"references":1694,"versionKeys":1711,"packageCount":32,"repositoryCount":34},"ghsa-4gmw-gg2m-w46p-58f27cb8","GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\u002Freset\u002Fmerge_tree enables arbitrary file overwrite",[1687,1688],"CVE-2026-76219","PYSEC-2026-3838",[129,1688],"2026-08-07T15:33:57Z","2026-09-10T12:25:42.767166279Z",[1693],{"type":1034,"score":1426},[1695,1697,1699,1701,1703,1704,1706,1708,1709],{"type":1000,"url":1696},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",{"type":1003,"url":1698},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76219",{"type":1000,"url":1700},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2204",{"type":1000,"url":1702},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9b5dcaf85da5946dbf69dcd53f9edba08f760b32",{"type":1008,"url":1049},{"type":1000,"url":1705},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.58",{"type":1000,"url":1707},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-read-tree",{"type":1008,"url":1284},{"type":1003,"url":1710},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",[1057,1058,1059],{"id":130,"slug":1713,"dossier":90,"summary":1714,"aliases":1715,"sourceIds":1719,"published":1720,"modified":1721,"checkedAt":7,"severity":1722,"references":1724,"versionKeys":1735,"packageCount":32,"repositoryCount":345},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[1716,1717,1718],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[130,1718],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[1723],{"type":1034,"score":1128},[1725,1727,1729,1731,1733,1734],{"type":1003,"url":1726},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1003,"url":1728},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1367,"url":1730},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1100,"url":1732},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":131,"slug":1737,"dossier":47,"summary":1738,"aliases":1739,"sourceIds":1743,"published":1744,"modified":1745,"checkedAt":7,"severity":1746,"references":1750,"versionKeys":1759,"packageCount":32,"repositoryCount":355},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[1740,1741,1742],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[131,1742],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[1747,1749],{"type":1034,"score":1748},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1034,"score":1176},[1751,1753,1755,1757,1758],{"type":1040,"url":1752},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1003,"url":1754},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1100,"url":1756},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1008,"url":1009},{"type":1003,"url":1011},[1017,1018,1019,1020,1021,1022],{"id":132,"slug":1761,"dossier":47,"summary":1762,"aliases":1763,"sourceIds":1767,"published":1768,"modified":1769,"checkedAt":7,"severity":1770,"references":1773,"versionKeys":1788,"packageCount":32,"repositoryCount":1633},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[1764,1765,1766],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[132,1766],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[1771],{"type":1034,"score":1772},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[1774,1776,1778,1780,1782,1784,1786,1787],{"type":1040,"url":1775},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1003,"url":1777},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1100,"url":1779},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1100,"url":1781},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1100,"url":1783},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1000,"url":1785},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1008,"url":1009},{"type":1003,"url":1631},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":133,"slug":1790,"dossier":47,"summary":1791,"aliases":1792,"sourceIds":1795,"published":1796,"modified":1797,"checkedAt":7,"severity":1798,"references":1802,"versionKeys":1812,"packageCount":32,"repositoryCount":34},"ghsa-539m-9xh6-q6rr-c4575e3c","GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file \u002F --add-virtual-file, enabling arbitrary file read via Repo.archive()",[1793,1794],"CVE-2026-73619","PYSEC-2026-3948",[133,1794],"2026-08-03T20:14:28Z","2026-09-10T13:11:01.695990206Z",[1799,1800],{"type":1034,"score":1539},{"type":996,"score":1801},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1803,1805,1806,1808,1809,1810],{"type":1040,"url":1804},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-539m-9xh6-q6rr",{"type":1000,"url":1433},{"type":1000,"url":1807},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca",{"type":1008,"url":1049},{"type":1000,"url":1438},{"type":1003,"url":1811},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-archive",[1057,1058,1059],{"id":134,"slug":1814,"dossier":47,"summary":1815,"aliases":1816,"sourceIds":1820,"published":1821,"modified":1822,"checkedAt":7,"severity":1823,"references":1826,"versionKeys":1836,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[1817,1818,1819],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[134,1819],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[1824,1825],{"type":996,"score":1243},{"type":1034,"score":1241},[1827,1829,1831,1833,1835],{"type":1003,"url":1828},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1003,"url":1830},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1000,"url":1832},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1000,"url":1834},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1008,"url":1374},[1386],{"id":135,"slug":1838,"dossier":47,"summary":1839,"aliases":1840,"sourceIds":1842,"published":1843,"modified":1844,"checkedAt":7,"severity":1845,"references":1848,"versionKeys":1859,"packageCount":32,"repositoryCount":1864},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[1841],"CVE-2026-112907",[135],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[1846],{"type":1034,"score":1847},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1849,1851,1853,1855,1857],{"type":1000,"url":1850},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1000,"url":1852},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1000,"url":1854},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1008,"url":1856},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1000,"url":1858},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[1860,1861,1862,1863],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":136,"slug":1866,"dossier":90,"summary":1867,"aliases":1868,"sourceIds":1872,"published":1873,"modified":1874,"checkedAt":7,"severity":1875,"references":1879,"versionKeys":1888,"packageCount":32,"repositoryCount":345},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[1869,1870,1871],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[136,1871],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[1876,1878],{"type":996,"score":1877},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":1176},[1880,1882,1884,1886,1887],{"type":1040,"url":1881},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1003,"url":1883},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1100,"url":1885},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":137,"slug":1890,"dossier":47,"summary":1891,"aliases":1892,"sourceIds":1894,"published":1895,"modified":1896,"checkedAt":7,"severity":1897,"references":1900,"versionKeys":1910,"packageCount":32,"repositoryCount":34},"ghsa-59cr-6r3x-644w-a8ec12fb","GitPython submodule update path traversal can write outside the repository",[1893],"CVE-2026-100689",[137],"2026-09-30T23:47:12Z","2026-10-01T00:00:05.754996881Z",[1898],{"type":996,"score":1899},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1901,1903,1905,1907,1908],{"type":1000,"url":1902},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-59cr-6r3x-644w",{"type":1000,"url":1904},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2225",{"type":1000,"url":1906},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed0ebc2f2e74d979cdc367a4864a7731fdcc093",{"type":1008,"url":1049},{"type":1000,"url":1909},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.62",[1057,1058,1059],{"id":138,"slug":1912,"dossier":47,"summary":1913,"aliases":1914,"sourceIds":1917,"published":1918,"modified":1919,"checkedAt":7,"severity":1920,"references":1923,"versionKeys":1940,"packageCount":32,"repositoryCount":1949},"ghsa-5p39-cfhj-2xmp-77a62550","AnyIO process-pool workers can block indefinitely on undrained stderr",[1915,1916],"CVE-2026-64847","PYSEC-2026-4024",[138,1916],"2026-09-18T17:17:10Z","2026-10-01T17:55:57.336188727Z",[1921],{"type":996,"score":1922},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1924,1926,1928,1930,1932,1934,1936,1938],{"type":1000,"url":1925},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1000,"url":1927},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1207",{"type":1000,"url":1929},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002Ff1b7301c8264b0d2e8d24a5788fd29e93dea4040",{"type":1008,"url":1931},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio",{"type":1000,"url":1933},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Freleases\u002Ftag\u002F4.14.2",{"type":1008,"url":1935},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fanyio",{"type":1003,"url":1937},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1003,"url":1939},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-64847",[1941,1942,1943,1944,1945,1946,1947,1948],"pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0",16,{"id":139,"slug":1951,"dossier":47,"summary":1952,"aliases":1953,"sourceIds":1957,"published":1958,"modified":1959,"checkedAt":7,"severity":1960,"references":1964,"versionKeys":1981,"packageCount":32,"repositoryCount":377},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[1954,1955,1956],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[139,1956],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[1961,1963],{"type":996,"score":1962},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1034,"score":1268},[1965,1967,1969,1971,1973,1975,1977,1979],{"type":1040,"url":1966},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1003,"url":1968},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1367,"url":1970},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1100,"url":1972},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1000,"url":1974},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1008,"url":1976},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1000,"url":1978},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1107,"url":1980},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[1982,1983,1984,1985],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":140,"slug":1987,"dossier":90,"summary":1988,"aliases":1989,"sourceIds":1993,"published":1994,"modified":1995,"checkedAt":7,"severity":1996,"references":2000,"versionKeys":2009,"packageCount":32,"repositoryCount":345},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[1990,1991,1992],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[140,1992],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[1997,1999],{"type":996,"score":1998},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":1241},[2001,2003,2005,2007,2008],{"type":1040,"url":2002},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1003,"url":2004},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1100,"url":2006},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":141,"slug":2011,"dossier":47,"summary":2012,"aliases":2013,"sourceIds":2017,"published":2018,"modified":2019,"checkedAt":7,"severity":2020,"references":2022,"versionKeys":2032,"packageCount":32,"repositoryCount":1633},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2014,2015,2016],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[141,2016],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2021],{"type":1034,"score":1176},[2023,2025,2027,2028,2030,2031],{"type":1040,"url":2024},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1003,"url":2026},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1100,"url":1626},{"type":1000,"url":2029},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1008,"url":1009},{"type":1003,"url":1631},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":142,"slug":2034,"dossier":90,"summary":2035,"aliases":2036,"sourceIds":2039,"published":2040,"modified":2041,"checkedAt":7,"severity":2042,"references":2044,"versionKeys":2053,"packageCount":32,"repositoryCount":345},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2037,2038],"BIT-pillow-2026-112399","CVE-2026-112399",[142],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2043],{"type":996,"score":1877},[2045,2047,2049,2051,2052],{"type":1000,"url":2046},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1003,"url":2048},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1000,"url":2050},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":143,"slug":2055,"dossier":47,"summary":2056,"aliases":2057,"sourceIds":2061,"published":2062,"modified":2063,"checkedAt":7,"severity":2064,"references":2068,"versionKeys":2082,"packageCount":32,"repositoryCount":2083},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2058,2059,2060],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[143,2060],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2065,2066],{"type":1034,"score":1362},{"type":996,"score":2067},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2069,2071,2073,2075,2077,2079,2080],{"type":1003,"url":2070},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1003,"url":2072},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1000,"url":2074},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1000,"url":2076},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1000,"url":2078},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1008,"url":1009},{"type":1003,"url":2081},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1016,1017,1018,1019,1020],13,{"id":144,"slug":2085,"dossier":47,"summary":2086,"aliases":2087,"sourceIds":2090,"published":2091,"modified":2092,"checkedAt":7,"severity":2093,"references":2096,"versionKeys":2106,"packageCount":32,"repositoryCount":34},"ghsa-5xxx-qhh7-9287-87d91b3e","GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\u002F-S, enabling arbitrary file read via Repo.blame()",[2088,2089],"CVE-2026-78678","PYSEC-2026-3788",[144,2089],"2026-08-25T02:16:52.313Z","2026-09-08T19:00:06.904435463Z",[2094,2095],{"type":1034,"score":1539},{"type":996,"score":1801},[2097,2099,2101,2102,2104],{"type":1040,"url":2098},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-5xxx-qhh7-9287",{"type":1003,"url":2100},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78678",{"type":1008,"url":1049},{"type":1000,"url":2103},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3788.yaml",{"type":1003,"url":2105},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-blame",[1057,1058,1059],{"id":145,"slug":2108,"dossier":47,"summary":2109,"aliases":2110,"sourceIds":2114,"published":2115,"modified":2116,"checkedAt":7,"severity":2117,"references":2120,"versionKeys":2136,"packageCount":32,"repositoryCount":1633},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2111,2112,2113],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[145,2113],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2118],{"type":996,"score":2119},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2121,2123,2125,2127,2129,2130,2132,2134],{"type":1000,"url":2122},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1003,"url":2124},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1000,"url":2126},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1000,"url":2128},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1008,"url":1009},{"type":1000,"url":2131},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1008,"url":2133},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1003,"url":2135},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":146,"slug":2138,"dossier":47,"summary":2139,"aliases":2140,"sourceIds":2145,"published":2146,"modified":2147,"checkedAt":7,"severity":2148,"references":2150,"versionKeys":2178,"packageCount":32,"repositoryCount":2186},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2141,2142,2143,2144],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[146,2144],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2149],{"type":1034,"score":1035},[2151,2153,2155,2157,2159,2161,2163,2165,2167,2169,2170,2172,2174,2176],{"type":1003,"url":2152},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1003,"url":2154},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1367,"url":2156},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1003,"url":2158},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1000,"url":2160},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1367,"url":2162},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1003,"url":2164},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1000,"url":2166},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1000,"url":2168},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1008,"url":1374},{"type":1100,"url":2171},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1003,"url":2173},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1000,"url":2175},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1000,"url":2177},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1386,1387,1388,2179,2180,2181,2182,2183,2184,2185],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":147,"slug":2188,"dossier":47,"summary":2189,"aliases":2190,"sourceIds":2194,"published":2195,"modified":2196,"checkedAt":7,"severity":2197,"references":2202,"versionKeys":2213,"packageCount":32,"repositoryCount":1229},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2191,2192,2193],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[147,2193],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2198,2200],{"type":996,"score":2199},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":2201},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2203,2205,2207,2209,2211,2212],{"type":1003,"url":2204},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1003,"url":2206},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1367,"url":2208},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1100,"url":2210},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1008,"url":1009},{"type":1003,"url":1011},[1016,1017,1018,1019,1020,1021,1022],{"id":148,"slug":2215,"dossier":90,"summary":2216,"aliases":2217,"sourceIds":2220,"published":2221,"modified":2222,"checkedAt":7,"severity":2223,"references":2227,"versionKeys":2236,"packageCount":32,"repositoryCount":2241},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2218,2219],"CVE-2026-45409","PYSEC-2026-215",[148,2219],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2224,2225],{"type":1034,"score":1452},{"type":996,"score":2226},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2228,2230,2232,2234],{"type":1003,"url":2229},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1003,"url":2231},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1008,"url":2233},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1000,"url":2235},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2237,2238,2239,2240],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":149,"slug":2243,"dossier":90,"summary":2244,"aliases":2245,"sourceIds":2248,"published":2249,"modified":2250,"checkedAt":7,"severity":2251,"references":2253,"versionKeys":2262,"packageCount":32,"repositoryCount":345},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2246,2247],"BIT-pillow-2026-112400","CVE-2026-112400",[149],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2252],{"type":996,"score":1877},[2254,2256,2258,2260,2261],{"type":1000,"url":2255},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1003,"url":2257},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1000,"url":2259},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":150,"slug":2264,"dossier":90,"summary":2265,"aliases":2266,"sourceIds":2268,"published":2269,"modified":2270,"checkedAt":7,"severity":2271,"references":2274,"versionKeys":2283,"packageCount":32,"repositoryCount":345},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2267],"CVE-2026-112909",[150],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2272],{"type":1034,"score":2273},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2275,2277,2279,2280,2281,2282],{"type":1000,"url":2276},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1003,"url":2278},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1000,"url":1852},{"type":1000,"url":1854},{"type":1008,"url":1856},{"type":1000,"url":1858},[2284,2285,2286,2287,2288,1860,1861,1862,1863],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":151,"slug":2290,"dossier":47,"summary":2291,"aliases":2292,"sourceIds":2295,"published":2296,"modified":2297,"checkedAt":7,"severity":2298,"references":2302,"versionKeys":2314,"packageCount":32,"repositoryCount":34},"ghsa-6p8h-3wgx-97gf-635a010c","GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks",[2293,2294],"CVE-2026-73623","PYSEC-2026-3952",[151,2294],"2026-07-24T16:42:09Z","2026-09-10T13:11:03.995690741Z",[2299,2301],{"type":1034,"score":2300},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1034,"score":1268},[2303,2305,2307,2309,2310,2312],{"type":1040,"url":2304},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-6p8h-3wgx-97gf",{"type":1000,"url":2306},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2180",{"type":1000,"url":2308},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fffcb5359e87619f4fe4a70a4aff5f08c5580ba97",{"type":1008,"url":1049},{"type":1000,"url":2311},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.54",{"type":1003,"url":2313},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-template",[1057,1058,1059],{"id":152,"slug":2316,"dossier":90,"summary":2317,"aliases":2318,"sourceIds":2320,"published":2321,"modified":2322,"checkedAt":7,"severity":2323,"references":2326,"versionKeys":2338,"packageCount":32,"repositoryCount":2350},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2319],"PYSEC-2026-4320",[152,2319],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2324],{"type":996,"score":2325},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2327,2329,2331,2333,2334,2336],{"type":1000,"url":2328},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1000,"url":2330},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1000,"url":2332},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1008,"url":1103},{"type":1008,"url":2335},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1003,"url":2337},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2339,1116,2340,2341,2342,2343,2344,2345,2346,2347,2348,2349],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":153,"slug":2352,"dossier":47,"summary":2353,"aliases":2354,"sourceIds":2358,"published":2359,"modified":2360,"checkedAt":7,"severity":2361,"references":2363,"versionKeys":2376,"packageCount":32,"repositoryCount":1633},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2355,2356,2357],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[153,2357],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2362],{"type":1034,"score":1176},[2364,2366,2368,2370,2372,2374,2375],{"type":1040,"url":2365},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1003,"url":2367},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1100,"url":2369},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1100,"url":2371},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1000,"url":2373},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1008,"url":1009},{"type":1003,"url":2131},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":154,"slug":2378,"dossier":90,"summary":2379,"aliases":2380,"sourceIds":2383,"published":2384,"modified":2385,"checkedAt":7,"severity":2386,"references":2388,"versionKeys":2397,"packageCount":32,"repositoryCount":345},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[2381,2382],"BIT-pillow-2026-112401","CVE-2026-112401",[154],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[2387],{"type":996,"score":2226},[2389,2391,2393,2395,2396],{"type":1000,"url":2390},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1003,"url":2392},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1000,"url":2394},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":155,"slug":2399,"dossier":47,"summary":2400,"aliases":2401,"sourceIds":2404,"published":2405,"modified":2406,"checkedAt":7,"severity":2407,"references":2412,"versionKeys":2420,"packageCount":32,"repositoryCount":34},"ghsa-7545-fcxq-7j24-84dd19fd","GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository",[2402,2403],"CVE-2026-44243","PYSEC-2026-2162",[155,2403],"2026-05-06T19:38:48Z","2026-09-10T03:50:45.903378498Z",[2408,2410],{"type":1034,"score":2409},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":996,"score":2411},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2413,2415,2417,2418],{"type":1040,"url":2414},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7545-fcxq-7j24",{"type":1003,"url":2416},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44243",{"type":1008,"url":1049},{"type":1100,"url":2419},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.48",[1057,1058,1059],{"id":156,"slug":2422,"dossier":47,"summary":2423,"aliases":2424,"sourceIds":2427,"published":2428,"modified":2429,"checkedAt":7,"severity":2430,"references":2437,"versionKeys":2452,"packageCount":32,"repositoryCount":34},"ghsa-7833-fr7j-v32q-fd003872","GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)",[2425,2426],"CVE-2026-78675","PYSEC-2026-3785",[156,2426],"2026-08-25T02:16:51.887Z","2026-09-23T05:15:05.931147061Z",[2431,2433,2435],{"type":1034,"score":2432},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":996,"score":2434},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":2436},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2438,2440,2442,2444,2446,2447,2448,2450],{"type":1040,"url":2439},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7833-fr7j-v32q",{"type":1003,"url":2441},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78675",{"type":1000,"url":2443},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2211",{"type":1000,"url":2445},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fef7568e3b317ce617eacda39b8b54dcdff8c3b5c",{"type":1008,"url":1049},{"type":1000,"url":1551},{"type":1000,"url":2449},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3785.yaml",{"type":1003,"url":2451},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-local-file-content-disclosure-via-gitmodules",[1057,1058,1059],{"id":157,"slug":2454,"dossier":47,"summary":2455,"aliases":2456,"sourceIds":2460,"published":2461,"modified":2462,"checkedAt":7,"severity":2463,"references":2470,"versionKeys":2482,"packageCount":32,"repositoryCount":367},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[2457,2458,2459],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[157,2458,2459],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[2464,2466,2468],{"type":1034,"score":2465},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1034,"score":2467},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1034,"score":2469},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2471,2473,2475,2476,2478,2480],{"type":1003,"url":2472},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1000,"url":2474},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1008,"url":1463},{"type":1000,"url":2477},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1003,"url":2479},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1003,"url":2481},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1467,1468,1469,1470],{"id":158,"slug":2484,"dossier":47,"summary":2485,"aliases":2486,"sourceIds":2487,"published":2488,"modified":2489,"checkedAt":7,"severity":2490,"references":2493,"versionKeys":2506,"packageCount":32,"repositoryCount":1323},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[158],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[2491],{"type":1034,"score":2492},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2494,2496,2498,2500,2502,2503,2504],{"type":1000,"url":2495},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1000,"url":2497},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1000,"url":2499},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1000,"url":2501},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1008,"url":1009},{"type":1000,"url":1011},{"type":1000,"url":2505},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1015,1016,1017,1018,1019,1020,1021,1022],{"id":159,"slug":2508,"dossier":47,"summary":2509,"aliases":2510,"sourceIds":2513,"published":2514,"modified":2515,"checkedAt":7,"severity":2516,"references":2518,"versionKeys":2531,"packageCount":32,"repositoryCount":103},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[2511,2512],"CVE-2025-47287","PYSEC-2026-1974",[159,2512],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[2517],{"type":1034,"score":1176},[2519,2521,2523,2525,2526,2528,2529],{"type":1000,"url":2520},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1003,"url":2522},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1000,"url":2524},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1008,"url":1463},{"type":1000,"url":2527},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1008,"url":1575},{"type":1003,"url":2530},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1467],{"id":160,"slug":2533,"dossier":47,"summary":2534,"aliases":2535,"sourceIds":2538,"published":2539,"modified":2540,"checkedAt":7,"severity":2541,"references":2544,"versionKeys":2561,"packageCount":32,"repositoryCount":2083},"ghsa-7gcm-g887-7qv7-55bb9ff1","protobuf affected by a JSON recursion depth bypass",[2536,2537],"CVE-2026-0994","PYSEC-2026-1805",[160,2537],"2026-01-23T15:31:35Z","2026-09-10T03:50:32.795512159Z",[2542],{"type":996,"score":2543},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:L",[2545,2547,2549,2551,2553,2555,2557,2559],{"type":1003,"url":2546},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0994",{"type":1000,"url":2548},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fissues\u002F25070",{"type":1000,"url":2550},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fpull\u002F25239",{"type":1000,"url":2552},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",{"type":1000,"url":2554},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002Fd2b001626d137c62dfee6c88c87324102531868b",{"type":1008,"url":2556},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf",{"type":1008,"url":2558},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fprotobuf",{"type":1003,"url":2560},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7gcm-g887-7qv7",[2562,2563,2564,2565,2566,2567,2568,2569,2570,2571],"pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4",{"id":161,"slug":2573,"dossier":90,"summary":2574,"aliases":2575,"sourceIds":2579,"published":2580,"modified":2581,"checkedAt":7,"severity":2582,"references":2585,"versionKeys":2594,"packageCount":32,"repositoryCount":345},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[2576,2577,2578],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[161,2578],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[2583,2584],{"type":996,"score":1877},{"type":1034,"score":1176},[2586,2588,2590,2592,2593],{"type":1100,"url":2587},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1003,"url":2589},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1100,"url":2591},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":162,"slug":2596,"dossier":47,"summary":2597,"aliases":2598,"sourceIds":2601,"published":2602,"modified":2603,"checkedAt":7,"severity":2604,"references":2609,"versionKeys":2620,"packageCount":32,"repositoryCount":397},"ghsa-7p48-42j8-8846-584b0522","Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)",[2599,2600],"CVE-2026-33682","PYSEC-2026-2285",[162,2600],"2026-03-25T21:20:52Z","2026-07-13T07:26:25.253864212Z",[2605,2607],{"type":1034,"score":2606},"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1034,"score":2608},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[2610,2612,2614,2616,2618],{"type":1003,"url":2611},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fsecurity\u002Fadvisories\u002FGHSA-7p48-42j8-8846",{"type":1003,"url":2613},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33682",{"type":1100,"url":2615},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002F23692ca70b2f2ac720c72d1feb4f190c9d6eed76",{"type":1008,"url":2617},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit",{"type":1003,"url":2619},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Freleases\u002Ftag\u002F1.54.0",[2621,2622,2623],"pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0",{"id":163,"slug":2625,"dossier":47,"summary":2626,"aliases":2627,"sourceIds":2630,"published":2631,"modified":2632,"checkedAt":7,"severity":2633,"references":2636,"versionKeys":2650,"packageCount":32,"repositoryCount":1949},"ghsa-82r6-8w77-94w6-217253d8","AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing",[2628,2629],"CVE-2026-63374","PYSEC-2026-4025",[163,2629],"2026-09-18T17:17:18Z","2026-10-01T17:56:11.058322399Z",[2634],{"type":996,"score":2635},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2637,2639,2641,2643,2644,2645,2646,2648],{"type":1000,"url":2638},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1000,"url":2640},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1208",{"type":1000,"url":2642},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002F68f58915f82d9be8109ebbbd8f5d70577d43f2ce",{"type":1008,"url":1931},{"type":1000,"url":1933},{"type":1008,"url":1935},{"type":1003,"url":2647},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1003,"url":2649},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-63374",[1941,1942,1943,1944,1945,1946,1947,1948],{"id":164,"slug":2652,"dossier":47,"summary":2653,"aliases":2654,"sourceIds":2656,"published":2657,"modified":2658,"checkedAt":7,"severity":2659,"references":2662,"versionKeys":2674,"packageCount":32,"repositoryCount":34},"ghsa-83vg-56qc-22m7-6ad99a7a","GitPython validates a submodule's \".git\" path only after cloning into it (RCE)",[2655],"CVE-2026-114145",[164],"2026-10-22T16:41:14Z","2026-10-22T16:45:04.297463159Z",[2660],{"type":1034,"score":2661},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2663,2665,2667,2669,2671,2672],{"type":1000,"url":2664},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-83vg-56qc-22m7",{"type":1003,"url":2666},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114145",{"type":1000,"url":2668},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2264",{"type":1000,"url":2670},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F97eadb888d2f99567e3113f4e455be4ca128f697",{"type":1008,"url":1049},{"type":1000,"url":2673},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.1",[1057,1058,1059],{"id":165,"slug":2676,"dossier":47,"summary":2677,"aliases":2678,"sourceIds":2680,"published":2681,"modified":2682,"checkedAt":7,"severity":2683,"references":2685,"versionKeys":2697,"packageCount":32,"repositoryCount":355},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[2679],"CVE-2026-91990",[165],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[2684],{"type":996,"score":2226},[2686,2688,2690,2692,2694,2695],{"type":1000,"url":2687},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1000,"url":2689},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1000,"url":2691},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1000,"url":2693},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1008,"url":1463},{"type":1000,"url":2696},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1467,1468,1469,1470,1471,1472],{"id":166,"slug":2699,"dossier":47,"summary":2700,"aliases":2701,"sourceIds":2705,"published":2706,"modified":2707,"checkedAt":7,"severity":2708,"references":2712,"versionKeys":2734,"packageCount":32,"repositoryCount":1682},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[2702,2703,2704],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[166,2704],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[2709,2710],{"type":1034,"score":1358},{"type":996,"score":2711},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2713,2715,2717,2719,2721,2723,2724,2726,2728,2730,2732],{"type":1003,"url":2714},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1000,"url":2716},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1000,"url":2718},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1000,"url":2720},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1000,"url":2722},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1008,"url":1374},{"type":1000,"url":2725},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1000,"url":2727},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1000,"url":2729},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1008,"url":2731},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1003,"url":2733},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1386,1387,1388,2179,2180],{"id":167,"slug":2736,"dossier":90,"summary":2737,"aliases":2738,"sourceIds":2741,"published":2742,"modified":2743,"checkedAt":7,"severity":2744,"references":2747,"versionKeys":2764,"packageCount":32,"repositoryCount":2241},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[2739,2740],"CVE-2026-97687","PYSEC-2026-4175",[167,2740],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[2745],{"type":996,"score":2746},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2748,2750,2752,2754,2756,2758,2759,2761,2762],{"type":1000,"url":2749},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1003,"url":2751},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1000,"url":2753},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1000,"url":2755},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1000,"url":2757},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1008,"url":1314},{"type":1000,"url":2760},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1008,"url":1316},{"type":1003,"url":2763},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1318,1319,1320,1321,1322,2765,2766],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":168,"slug":2768,"dossier":47,"summary":2769,"aliases":2770,"sourceIds":2774,"published":2775,"modified":2776,"checkedAt":7,"severity":2777,"references":2780,"versionKeys":2788,"packageCount":32,"repositoryCount":345},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[2771,2772,2773],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[168,2773],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[2778,2779],{"type":996,"score":1998},{"type":1034,"score":1241},[2781,2783,2785,2786,2787],{"type":1040,"url":2782},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1003,"url":2784},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1100,"url":2006},{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":169,"slug":2790,"dossier":47,"summary":2791,"aliases":2792,"sourceIds":2795,"published":2796,"modified":2797,"checkedAt":7,"severity":2798,"references":2805,"versionKeys":2820,"packageCount":32,"repositoryCount":34},"ghsa-8mcc-hrx5-hvxc-9da62a9f","GitPython: clone_from()\u002Fclone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination",[2793,2794],"CVE-2026-78677","PYSEC-2026-3787",[169,2794],"2026-08-25T02:16:52.173Z","2026-09-08T19:00:06.914140693Z",[2799,2801,2803],{"type":1034,"score":2800},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":996,"score":2802},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":996,"score":2804},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2806,2808,2810,2812,2814,2815,2816,2818],{"type":1040,"url":2807},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-8mcc-hrx5-hvxc",{"type":1003,"url":2809},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78677",{"type":1000,"url":2811},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2210",{"type":1000,"url":2813},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fb68afff45af0f49e79a3e2d2162018986b37ad5d",{"type":1008,"url":1049},{"type":1000,"url":1551},{"type":1000,"url":2817},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3787.yaml",{"type":1003,"url":2819},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-separate-git-dir",[1057,1058,1059],{"id":170,"slug":2822,"dossier":47,"summary":2823,"aliases":2824,"sourceIds":2826,"published":2827,"modified":2828,"checkedAt":7,"severity":2829,"references":2832,"versionKeys":2839,"packageCount":32,"repositoryCount":345},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[2825],"CVE-2026-112910",[170],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[2830],{"type":1034,"score":2831},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2833,2835,2836,2837,2838],{"type":1000,"url":2834},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1000,"url":1852},{"type":1000,"url":1854},{"type":1008,"url":1856},{"type":1000,"url":1858},[2284,2285,2286,2287,2288,1860,1861,1862,1863],{"id":171,"slug":2841,"dossier":47,"summary":2842,"aliases":2843,"sourceIds":2846,"published":2847,"modified":2848,"checkedAt":7,"severity":2849,"references":2851,"versionKeys":2870,"packageCount":32,"repositoryCount":397},"ghsa-8qvm-5x2c-j2w7-8a075519","protobuf-python has a potential Denial of Service issue",[2844,2845],"CVE-2025-4565","PYSEC-2026-1806",[171,2845],"2025-06-16T16:02:58Z","2026-09-10T03:50:25.255076549Z",[2850],{"type":996,"score":997},[2852,2854,2856,2858,2860,2861,2863,2865,2867,2868],{"type":1000,"url":2853},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-735f-pc8j-v9w8",{"type":1000,"url":2855},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",{"type":1003,"url":2857},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-4565",{"type":1000,"url":2859},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F17838beda2943d08b8a9d4df5b68f5f04f26d901",{"type":1008,"url":2556},{"type":1000,"url":2862},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fdecoder_test.py#L87-L98",{"type":1000,"url":2864},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fmessage_test.py#L1436-L1478",{"type":1000,"url":2866},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Ftree\u002Fmain\u002Fpython#implementation-backends",{"type":1008,"url":2558},{"type":1003,"url":2869},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",[2562,2564,2565],{"id":172,"slug":2872,"dossier":47,"summary":2873,"aliases":2874,"sourceIds":2878,"published":2879,"modified":2880,"checkedAt":7,"severity":2881,"references":2883,"versionKeys":2893,"packageCount":32,"repositoryCount":1633},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[2875,2876,2877],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[172,2877],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[2882],{"type":1034,"score":1176},[2884,2886,2888,2889,2891,2892],{"type":1040,"url":2885},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1003,"url":2887},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1100,"url":1626},{"type":1000,"url":2890},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1008,"url":1009},{"type":1003,"url":1631},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":173,"slug":2895,"dossier":47,"summary":2896,"aliases":2897,"sourceIds":2900,"published":2901,"modified":2902,"checkedAt":7,"severity":2903,"references":2906,"versionKeys":2920,"packageCount":32,"repositoryCount":34},"ghsa-94p4-4cq8-9g67-9a288a09","GitPython: Environment-variable exfiltration via Repo.create_remote() \u002F Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)",[2898,2899],"CVE-2026-73622","PYSEC-2026-3951",[173,2899],"2026-07-24T21:45:16Z","2026-09-24T14:45:07.411775302Z",[2904,2905],{"type":1034,"score":2800},{"type":996,"score":2804},[2907,2909,2911,2913,2914,2916,2918],{"type":1040,"url":2908},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-94p4-4cq8-9g67",{"type":1000,"url":2910},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F863417457a0633db7ea5aed4fd01e0b291a41162",{"type":1100,"url":2912},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8ac5a30519b6f4af85398b9b9d7064ff4d452da2",{"type":1008,"url":1049},{"type":1000,"url":2915},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.55",{"type":1000,"url":2917},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3951.yaml",{"type":1003,"url":2919},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-remote-add",[1057,1058,1059],{"id":174,"slug":2922,"dossier":47,"summary":2923,"aliases":2924,"sourceIds":2927,"published":2928,"modified":2929,"checkedAt":7,"severity":2930,"references":2932,"versionKeys":2948,"packageCount":32,"repositoryCount":34},"ghsa-956x-8gvw-wg5v-f5d32b2d","GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \u002F `Repo.blame()`",[2925,2926],"CVE-2026-67323","PYSEC-2026-3839",[174,2926],"2026-07-21T20:10:06Z","2026-09-10T12:25:39.217544351Z",[2931],{"type":1034,"score":2432},[2933,2935,2937,2939,2941,2942,2943,2945,2946],{"type":1000,"url":2934},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",{"type":1003,"url":2936},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67323",{"type":1000,"url":2938},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2163",{"type":1000,"url":2940},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F701ce32fe5ba8cb622c0e0342a376a6beb47d738",{"type":1008,"url":1049},{"type":1000,"url":1280},{"type":1000,"url":2944},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-unguarded-git-options",{"type":1008,"url":1284},{"type":1003,"url":2947},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",[1057,1058,1059],{"id":175,"slug":2950,"dossier":47,"summary":2951,"aliases":2952,"sourceIds":2955,"published":2956,"modified":2957,"checkedAt":7,"severity":2958,"references":2961,"versionKeys":2984,"packageCount":32,"repositoryCount":1682},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[2953,2954],"CVE-2024-47081","PYSEC-2026-1872",[175,2954],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[2959],{"type":1034,"score":2960},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2962,2964,2966,2968,2970,2972,2974,2976,2978,2980,2982],{"type":1000,"url":2963},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1003,"url":2965},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1000,"url":2967},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1100,"url":2969},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1003,"url":2971},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1008,"url":2973},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1000,"url":2975},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1000,"url":2977},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1008,"url":2979},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1000,"url":2981},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1000,"url":2983},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[2985,2986],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":176,"slug":2988,"dossier":47,"summary":2989,"aliases":2990,"sourceIds":2994,"published":2995,"modified":2996,"checkedAt":7,"severity":2997,"references":2999,"versionKeys":3012,"packageCount":32,"repositoryCount":1633},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[2991,2992,2993],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[176,2993],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[2998],{"type":1034,"score":1176},[3000,3002,3004,3006,3008,3010,3011],{"type":1040,"url":3001},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1003,"url":3003},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1100,"url":3005},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1100,"url":3007},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1000,"url":3009},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1008,"url":1009},{"type":1003,"url":2131},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":177,"slug":3014,"dossier":47,"summary":3015,"aliases":3016,"sourceIds":3019,"published":3020,"modified":3021,"checkedAt":7,"severity":3022,"references":3024,"versionKeys":3039,"packageCount":32,"repositoryCount":34},"ghsa-9rj7-rf2p-w77r-996a0359","GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks",[3017,3018],"CVE-2026-76218","PYSEC-2026-3840",[177,3018],"2026-08-07T15:36:43Z","2026-09-10T12:25:55.324487522Z",[3023],{"type":1034,"score":2300},[3025,3027,3029,3030,3032,3033,3034,3036,3037],{"type":1000,"url":3026},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",{"type":1003,"url":3028},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76218",{"type":1000,"url":1700},{"type":1000,"url":3031},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fd9ddb55bdc66",{"type":1008,"url":1049},{"type":1000,"url":1705},{"type":1000,"url":3035},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-repo-init",{"type":1008,"url":1284},{"type":1003,"url":3038},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",[1057,1058,1059],{"id":178,"slug":3041,"dossier":47,"summary":3042,"aliases":3043,"sourceIds":3047,"published":3048,"modified":3049,"checkedAt":7,"severity":3050,"references":3055,"versionKeys":3066,"packageCount":32,"repositoryCount":345},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3044,3045,3046],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[178,3046],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3051,3053],{"type":996,"score":3052},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":3054},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3056,3058,3060,3062,3064,3065],{"type":1003,"url":3057},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1003,"url":3059},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1367,"url":3061},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1100,"url":3063},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":179,"slug":3068,"dossier":47,"summary":3069,"aliases":3070,"sourceIds":3072,"published":3073,"modified":3074,"checkedAt":7,"severity":3075,"references":3077,"versionKeys":3086,"packageCount":32,"repositoryCount":1864},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3071],"CVE-2026-112913",[179],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3076],{"type":1034,"score":1358},[3078,3080,3082,3084,3085],{"type":1000,"url":3079},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1000,"url":3081},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1000,"url":3083},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1008,"url":1856},{"type":1000,"url":1858},[1860,1861,1862,1863],{"id":180,"slug":3088,"dossier":47,"summary":3089,"aliases":3090,"sourceIds":3093,"published":3094,"modified":3095,"checkedAt":7,"severity":3096,"references":3099,"versionKeys":3116,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3091,3092],"CVE-2024-35195","PYSEC-2026-1873",[180,3092],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3097],{"type":1034,"score":3098},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3100,3102,3104,3106,3108,3109,3111,3113,3114],{"type":1000,"url":3101},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1003,"url":3103},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1000,"url":3105},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1100,"url":3107},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1008,"url":2973},{"type":1000,"url":3110},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1000,"url":3112},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1008,"url":2979},{"type":1003,"url":3115},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[2985],{"id":181,"slug":3118,"dossier":47,"summary":3119,"aliases":3120,"sourceIds":3122,"published":3123,"modified":3124,"checkedAt":7,"severity":3125,"references":3128,"versionKeys":3138,"packageCount":32,"repositoryCount":355},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[3121],"CVE-2026-103263",[181],"2026-09-30T23:48:55Z","2026-10-02T03:56:10.964622908Z",[3126],{"type":996,"score":3127},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3129,3131,3132,3134,3136,3137],{"type":1000,"url":3130},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1000,"url":1457},{"type":1000,"url":3133},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1000,"url":3135},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1008,"url":1463},{"type":1000,"url":1465},[1467,1468,1469,1470,1471,1472],{"id":182,"slug":3140,"dossier":47,"summary":3141,"aliases":3142,"sourceIds":3146,"published":3147,"modified":3148,"checkedAt":7,"severity":3149,"references":3154,"versionKeys":3170,"packageCount":32,"repositoryCount":103},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3143,3144,3145],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[182],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3150,3152],{"type":1034,"score":3151},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":996,"score":3153},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3155,3157,3159,3161,3162,3164,3166,3168],{"type":1003,"url":3156},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1000,"url":3158},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1000,"url":3160},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1008,"url":1374},{"type":1000,"url":3163},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1000,"url":3165},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1000,"url":3167},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1000,"url":3169},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1386,1387],{"id":183,"slug":3172,"dossier":47,"summary":3173,"aliases":3174,"sourceIds":3177,"published":3178,"modified":3179,"checkedAt":7,"severity":3180,"references":3183,"versionKeys":3192,"packageCount":32,"repositoryCount":345},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3175,3176],"BIT-pillow-2026-112404","CVE-2026-112404",[183],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3181],{"type":996,"score":3182},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3184,3186,3188,3190,3191],{"type":1000,"url":3185},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1003,"url":3187},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1000,"url":3189},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":184,"slug":3194,"dossier":47,"summary":3195,"aliases":3196,"sourceIds":3199,"published":3200,"modified":3201,"checkedAt":7,"severity":3202,"references":3204,"versionKeys":3216,"packageCount":32,"repositoryCount":3217},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[3197,3198],"CVE-2025-67725","PYSEC-2025-266",[184,3198],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[3203],{"type":1034,"score":1176},[3205,3207,3209,3211,3213,3214],{"type":1003,"url":3206},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1003,"url":3208},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1100,"url":3210},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1000,"url":3212},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1008,"url":1463},{"type":1003,"url":3215},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1467,1468,1469],9,{"id":185,"slug":3219,"dossier":47,"summary":3220,"aliases":3221,"sourceIds":3225,"published":3226,"modified":3227,"checkedAt":7,"severity":3228,"references":3231,"versionKeys":3271,"packageCount":32,"repositoryCount":1949},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3222,3223,3224],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[185,3224],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3229,3230],{"type":996,"score":2434},{"type":1034,"score":1176},[3232,3234,3236,3238,3240,3242,3243,3245,3247,3249,3251,3253,3255,3257,3259,3261,3263,3265,3267,3269],{"type":1000,"url":3233},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1003,"url":3235},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1000,"url":3237},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1000,"url":3239},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1000,"url":3241},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1008,"url":1009},{"type":1000,"url":3244},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1000,"url":3246},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1000,"url":3248},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1003,"url":3250},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1003,"url":3252},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1003,"url":3254},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1003,"url":3256},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1003,"url":3258},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1003,"url":3260},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1003,"url":3262},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1003,"url":3264},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1003,"url":3266},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1003,"url":3268},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1003,"url":3270},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1013,1014,1015,1016,1017,1018,1019],{"id":186,"slug":3273,"dossier":47,"summary":3274,"aliases":3275,"sourceIds":3277,"published":3278,"modified":3279,"checkedAt":7,"severity":3280,"references":3282,"versionKeys":3296,"packageCount":32,"repositoryCount":355},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[3276],"CVE-2026-103262",[186],"2026-09-30T23:49:13Z","2026-10-02T03:56:11.819291984Z",[3281],{"type":1034,"score":1176},[3283,3285,3286,3288,3290,3292,3294,3295],{"type":1000,"url":3284},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1000,"url":1457},{"type":1000,"url":3287},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1000,"url":3289},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1000,"url":3291},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1000,"url":3293},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1008,"url":1463},{"type":1000,"url":1465},[1467,1468,1469,1470,1471,1472],{"id":187,"slug":3298,"dossier":47,"summary":3299,"aliases":3300,"sourceIds":3304,"published":3305,"modified":3306,"checkedAt":7,"severity":3307,"references":3310,"versionKeys":3319,"packageCount":32,"repositoryCount":3320},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3301,3302,3303],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[187,3303],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3308,3309],{"type":996,"score":1877},{"type":1034,"score":1176},[3311,3313,3315,3317,3318],{"type":1040,"url":3312},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1003,"url":3314},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1100,"url":3316},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1008,"url":1009},{"type":1003,"url":1011},[1018,1019,1020,1021,1022],7,{"id":188,"slug":3322,"dossier":47,"summary":3323,"aliases":3324,"sourceIds":3327,"published":3328,"modified":3329,"checkedAt":7,"severity":3330,"references":3333,"versionKeys":3350,"packageCount":32,"repositoryCount":103},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3325,3326],"CVE-2025-27516","PYSEC-2026-1471",[188,3326],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3331],{"type":996,"score":3332},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3334,3336,3338,3340,3342,3344,3346,3348],{"type":1000,"url":3335},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1003,"url":3337},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1100,"url":3339},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1008,"url":3341},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1000,"url":3343},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1000,"url":3345},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1008,"url":3347},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1003,"url":3349},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3351,3352],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":189,"slug":3354,"dossier":47,"summary":3355,"aliases":3356,"sourceIds":3358,"published":3359,"modified":3360,"checkedAt":7,"severity":3361,"references":3363,"versionKeys":3372,"packageCount":32,"repositoryCount":1864},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3357],"CVE-2026-112915",[189],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3362],{"type":1034,"score":1362},[3364,3366,3368,3369,3370,3371],{"type":1000,"url":3365},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1003,"url":3367},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1000,"url":3081},{"type":1000,"url":3083},{"type":1008,"url":1856},{"type":1000,"url":1858},[1860,1861,1862,1863],{"id":190,"slug":3374,"dossier":47,"summary":3375,"aliases":3376,"sourceIds":3379,"published":3380,"modified":3381,"checkedAt":7,"severity":3382,"references":3385,"versionKeys":3396,"packageCount":32,"repositoryCount":367},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[3377,3378],"CVE-2026-49854","PYSEC-2026-3388",[190,3378],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[3383],{"type":1034,"score":3384},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[3386,3388,3389,3391,3392,3394],{"type":1000,"url":3387},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1008,"url":1463},{"type":1000,"url":3390},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1008,"url":1575},{"type":1003,"url":3393},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1003,"url":3395},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1467,1468,1469,1470,1471],{"id":191,"slug":3398,"dossier":47,"summary":3399,"aliases":3400,"sourceIds":3404,"published":3405,"modified":3406,"checkedAt":7,"severity":3407,"references":3411,"versionKeys":3427,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3401,3402,3403],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[191,3403],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3408,3409],{"type":1034,"score":1035},{"type":996,"score":3410},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3412,3414,3416,3418,3419,3421,3423,3425],{"type":1003,"url":3413},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1000,"url":3415},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1000,"url":3417},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1008,"url":1976},{"type":1000,"url":3420},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1000,"url":3422},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1008,"url":3424},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1003,"url":3426},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[1982],{"id":192,"slug":3429,"dossier":47,"summary":3430,"aliases":3431,"sourceIds":3434,"published":3435,"modified":3436,"checkedAt":7,"severity":3437,"references":3439,"versionKeys":3448,"packageCount":32,"repositoryCount":345},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[3432,3433],"BIT-pillow-2026-112406","CVE-2026-112406",[192],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[3438],{"type":996,"score":1877},[3440,3442,3444,3446,3447],{"type":1000,"url":3441},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1003,"url":3443},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1000,"url":3445},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":193,"slug":3450,"dossier":47,"summary":3451,"aliases":3452,"sourceIds":3456,"published":3457,"modified":3458,"checkedAt":7,"severity":3459,"references":3463,"versionKeys":3481,"packageCount":32,"repositoryCount":103},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[3453,3454,3455],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[193],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[3460,3461],{"type":1034,"score":2831},{"type":996,"score":3462},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3464,3466,3468,3470,3472,3474,3475,3477,3479],{"type":1003,"url":3465},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1000,"url":3467},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1000,"url":3469},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1000,"url":3471},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1000,"url":3473},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1008,"url":1374},{"type":1000,"url":3476},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1000,"url":3478},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1000,"url":3480},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1386,1387],{"id":194,"slug":3483,"dossier":47,"summary":3484,"aliases":3485,"sourceIds":3487,"published":3488,"modified":3489,"checkedAt":7,"severity":3490,"references":3492,"versionKeys":3501,"packageCount":32,"repositoryCount":34},"ghsa-f9j4-qggq-h239-968ed9a4","GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution",[3486],"CVE-2026-110858",[194],"2026-10-27T15:26:50Z","2026-10-27T15:47:24.258288646Z",[3491],{"type":1034,"score":2492},[3493,3495,3497,3499,3500],{"type":1000,"url":3494},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-f9j4-qggq-h239",{"type":1000,"url":3496},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2247",{"type":1000,"url":3498},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F790bb3164948625ffb043d2a162425d55923fe9a",{"type":1008,"url":1049},{"type":1000,"url":1080},[1057,1058,1059],{"id":195,"slug":3503,"dossier":47,"summary":3504,"aliases":3505,"sourceIds":3508,"published":3509,"modified":3510,"checkedAt":7,"severity":3511,"references":3513,"versionKeys":3521,"packageCount":32,"repositoryCount":345},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[3506,3507],"BIT-pillow-2026-112891","CVE-2026-112891",[195],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[3512],{"type":996,"score":2226},[3514,3516,3518,3519,3520],{"type":1000,"url":3515},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1003,"url":3517},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1000,"url":2394},{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":196,"slug":3523,"dossier":47,"summary":3524,"aliases":3525,"sourceIds":3529,"published":3530,"modified":3531,"checkedAt":7,"severity":3532,"references":3535,"versionKeys":3549,"packageCount":32,"repositoryCount":1633},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[3526,3527,3528],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[196,3528],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[3533],{"type":1034,"score":3534},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[3536,3538,3540,3542,3544,3545,3546,3547],{"type":1000,"url":3537},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1003,"url":3539},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1000,"url":3541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1000,"url":3543},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1008,"url":1009},{"type":1000,"url":2131},{"type":1008,"url":2133},{"type":1003,"url":3548},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":197,"slug":3551,"dossier":47,"summary":3552,"aliases":3553,"sourceIds":3556,"published":3557,"modified":3558,"checkedAt":7,"severity":3559,"references":3562,"versionKeys":3572,"packageCount":32,"repositoryCount":34},"ghsa-fjr4-x663-mwxc-324b7aa5","GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)",[3554,3555],"CVE-2026-73624","PYSEC-2026-3995",[197,3555],"2026-07-24T16:41:20Z","2026-09-29T09:10:55.738617943Z",[3560,3561],{"type":1034,"score":1426},{"type":996,"score":1428},[3563,3565,3566,3568,3569,3570],{"type":1040,"url":3564},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fjr4-x663-mwxc",{"type":1000,"url":2306},{"type":1000,"url":3567},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1d51b891d7f236044a6aa17498ec682b63dad6e6",{"type":1008,"url":1049},{"type":1000,"url":2311},{"type":1003,"url":3571},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-diff",[1057,1058,1059],{"id":198,"slug":3574,"dossier":47,"summary":3575,"aliases":3576,"sourceIds":3578,"published":3579,"modified":3580,"checkedAt":7,"severity":3581,"references":3584,"versionKeys":3595,"packageCount":32,"repositoryCount":1864},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[3577],"CVE-2026-112935",[198],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[3582],{"type":1034,"score":3583},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[3585,3587,3589,3591,3593,3594],{"type":1000,"url":3586},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1003,"url":3588},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1000,"url":3590},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1000,"url":3592},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1008,"url":1856},{"type":1000,"url":1858},[1860,1861,1862,1863],{"id":199,"slug":3597,"dossier":47,"summary":3598,"aliases":3599,"sourceIds":3601,"published":3602,"modified":3603,"checkedAt":7,"severity":3604,"references":3607,"versionKeys":3616,"packageCount":32,"repositoryCount":34},"ghsa-fx3j-rwgx-fr94-14d75c26","GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name",[3600],"CVE-2026-110855",[199],"2026-10-27T15:26:32Z","2026-10-27T15:47:24.291028301Z",[3605],{"type":1034,"score":3606},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3608,3610,3612,3614,3615],{"type":1000,"url":3609},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fx3j-rwgx-fr94",{"type":1000,"url":3611},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2255",{"type":1000,"url":3613},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9349ff58ee00c9fb14d515c8e693f33b2144b238",{"type":1008,"url":1049},{"type":1000,"url":1080},[1057,1058,1059],{"id":200,"slug":3618,"dossier":47,"summary":3619,"aliases":3620,"sourceIds":3624,"published":3625,"modified":3626,"checkedAt":7,"severity":3627,"references":3630,"versionKeys":3641,"packageCount":32,"repositoryCount":1323},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[3621,3622,3623],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[200,3623],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[3628,3629],{"type":996,"score":1485},{"type":1034,"score":1128},[3631,3633,3635,3637,3639,3640],{"type":1003,"url":3632},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1003,"url":3634},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1367,"url":3636},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1100,"url":3638},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1008,"url":1009},{"type":1003,"url":1011},[1015,1016,1017,1018,1019,1020,1021,1022],{"id":201,"slug":3643,"dossier":47,"summary":3644,"aliases":3645,"sourceIds":3648,"published":3649,"modified":3650,"checkedAt":7,"severity":3651,"references":3653,"versionKeys":3666,"packageCount":32,"repositoryCount":34},"ghsa-g5vv-9gxw-82hx-203070a6","GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author\u002Fcommitter field parsing",[3646,3647],"CVE-2026-87819","PYSEC-2026-3984",[201,3647],"2026-09-09T12:17:17.120Z","2026-09-30T23:45:04.037560336Z",[3652],{"type":1034,"score":1176},[3654,3656,3658,3660,3661,3662,3664],{"type":1040,"url":3655},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-g5vv-9gxw-82hx",{"type":1000,"url":3657},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2215",{"type":1000,"url":3659},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F751473a5f3221d6f989291cbebcc404353fd3ba8",{"type":1008,"url":1049},{"type":1000,"url":1051},{"type":1000,"url":3663},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3984.yaml",{"type":1003,"url":3665},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-denial-of-service-via-redos",[1057,1058,1059],{"id":202,"slug":3668,"dossier":47,"summary":3669,"aliases":3670,"sourceIds":3673,"published":3674,"modified":3675,"checkedAt":7,"severity":3676,"references":3679,"versionKeys":3690,"packageCount":32,"repositoryCount":345},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[3671,3672],"BIT-pillow-2026-96778","CVE-2026-96778",[202],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[3677],{"type":996,"score":3678},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3680,3682,3684,3686,3688,3689],{"type":1000,"url":3681},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1003,"url":3683},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1000,"url":3685},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1000,"url":3687},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":203,"slug":3692,"dossier":47,"summary":3693,"aliases":3694,"sourceIds":3698,"published":3699,"modified":3700,"checkedAt":7,"severity":3701,"references":3704,"versionKeys":3715,"packageCount":32,"repositoryCount":345},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[3695,3696,3697],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[203,3697],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[3702,3703],{"type":996,"score":1485},{"type":1034,"score":1128},[3705,3707,3709,3711,3713,3714],{"type":1003,"url":3706},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1003,"url":3708},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1367,"url":3710},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1100,"url":3712},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":204,"slug":3717,"dossier":47,"summary":3718,"aliases":3719,"sourceIds":3722,"published":3723,"modified":3724,"checkedAt":7,"severity":3725,"references":3730,"versionKeys":3740,"packageCount":32,"repositoryCount":345},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[3720,3721],"CVE-2026-25645","PYSEC-2026-2275",[204,3721],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[3726,3728],{"type":1034,"score":3727},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1034,"score":3729},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[3731,3733,3735,3737,3738],{"type":1003,"url":3732},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1003,"url":3734},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1100,"url":3736},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1008,"url":2973},{"type":1003,"url":3739},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[2985,2986,3741,3742],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":205,"slug":3744,"dossier":47,"summary":3745,"aliases":3746,"sourceIds":3749,"published":3750,"modified":3751,"checkedAt":7,"severity":3752,"references":3754,"versionKeys":3763,"packageCount":32,"repositoryCount":345},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[3747,3748],"BIT-pillow-2026-112892","CVE-2026-112892",[205],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[3753],{"type":996,"score":1877},[3755,3757,3759,3761,3762],{"type":1000,"url":3756},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1003,"url":3758},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1000,"url":3760},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":206,"slug":3765,"dossier":47,"summary":3766,"aliases":3767,"sourceIds":3770,"published":3771,"modified":3772,"checkedAt":7,"severity":3773,"references":3775,"versionKeys":3787,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[3768,3769],"CVE-2026-97688","PYSEC-2026-4176",[206,3769],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[3774],{"type":996,"score":2226},[3776,3778,3780,3782,3783,3784,3785],{"type":1000,"url":3777},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1003,"url":3779},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1000,"url":3781},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1008,"url":1314},{"type":1000,"url":2760},{"type":1008,"url":1316},{"type":1003,"url":3786},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[2765,2766],{"id":207,"slug":3789,"dossier":47,"summary":3790,"aliases":3791,"sourceIds":3794,"published":3795,"modified":3796,"checkedAt":7,"severity":3797,"references":3799,"versionKeys":3810,"packageCount":32,"repositoryCount":1323},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[3792,3793],"CVE-2025-66418","PYSEC-2026-1998",[207,3793],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[3798],{"type":996,"score":1299},[3800,3802,3804,3806,3807,3808],{"type":1000,"url":3801},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1003,"url":3803},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1100,"url":3805},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1008,"url":1314},{"type":1008,"url":1316},{"type":1003,"url":3809},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1318,1319,1320,1321,1322],{"id":208,"slug":3812,"dossier":47,"summary":3813,"aliases":3814,"sourceIds":3817,"published":3818,"modified":3819,"checkedAt":7,"severity":3820,"references":3823,"versionKeys":3838,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[3815,3816],"CVE-2024-56201","PYSEC-2026-1472",[208,3816],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[3821,3822],{"type":1034,"score":1268},{"type":996,"score":3332},[3824,3826,3828,3830,3832,3833,3835,3836],{"type":1000,"url":3825},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1003,"url":3827},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1000,"url":3829},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1100,"url":3831},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1008,"url":3341},{"type":1000,"url":3834},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1008,"url":3347},{"type":1003,"url":3837},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3351],{"id":209,"slug":3840,"dossier":47,"summary":3841,"aliases":3842,"sourceIds":3844,"published":3845,"modified":3846,"checkedAt":7,"severity":3847,"references":3848,"versionKeys":3857,"packageCount":32,"repositoryCount":34},"ghsa-gq48-pqfc-9p58-0aa8d93f","GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree",[3843],"CVE-2026-110860",[209],"2026-10-27T15:26:57Z","2026-10-27T15:47:24.379897252Z",[],[3849,3851,3853,3855,3856],{"type":1000,"url":3850},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-gq48-pqfc-9p58",{"type":1000,"url":3852},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2232",{"type":1000,"url":3854},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F24b6f95d4b90ab1483fb601c736ac6e7c059cd61",{"type":1008,"url":1049},{"type":1000,"url":1080},[1057,1058,1059],{"id":210,"slug":3859,"dossier":47,"summary":3860,"aliases":3861,"sourceIds":3865,"published":3866,"modified":3867,"checkedAt":7,"severity":3868,"references":3871,"versionKeys":3883,"packageCount":32,"repositoryCount":345},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[3862,3863,3864],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[210,3864],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[3869],{"type":1034,"score":3870},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[3872,3874,3876,3878,3880,3881],{"type":1040,"url":3873},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1003,"url":3875},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1100,"url":3877},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1000,"url":3879},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1008,"url":1976},{"type":1003,"url":3882},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[1982,1983,1984,1985,3884,3885,3886,3887,3888,3889,3890,3891],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":211,"slug":3893,"dossier":47,"summary":3894,"aliases":3895,"sourceIds":3898,"published":3899,"modified":3900,"checkedAt":7,"severity":3901,"references":3903,"versionKeys":3924,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[3896,3897],"CVE-2024-34064","PYSEC-2026-1474",[211,3897],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[3902],{"type":1034,"score":2465},[3904,3906,3908,3910,3911,3913,3915,3917,3919,3921,3922],{"type":1000,"url":3905},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1003,"url":3907},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1100,"url":3909},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1008,"url":3341},{"type":1000,"url":3912},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1000,"url":3914},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1000,"url":3916},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1000,"url":3918},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1000,"url":3920},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1008,"url":3347},{"type":1003,"url":3923},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3351],{"id":212,"slug":3926,"dossier":47,"summary":3927,"aliases":3928,"sourceIds":3931,"published":3932,"modified":3933,"checkedAt":7,"severity":3934,"references":3936,"versionKeys":3951,"packageCount":32,"repositoryCount":34},"ghsa-hh9p-6wh2-4mfc-8e33cff1","GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",[3929,3930],"CVE-2026-76217","PYSEC-2026-3841",[212,3930],"2026-08-07T15:43:56Z","2026-09-10T12:26:07.095223621Z",[3935],{"type":1034,"score":1539},[3937,3939,3941,3942,3944,3945,3946,3948,3949],{"type":1000,"url":3938},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",{"type":1003,"url":3940},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76217",{"type":1000,"url":1700},{"type":1000,"url":3943},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Ff2550b65bf60ca087190981e2c7b6865e201f40c",{"type":1008,"url":1049},{"type":1000,"url":1705},{"type":1000,"url":3947},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-pathspec-from-file",{"type":1008,"url":1284},{"type":1003,"url":3950},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",[1057,1058,1059],{"id":213,"slug":3953,"dossier":47,"summary":3954,"aliases":3955,"sourceIds":3958,"published":3959,"modified":3960,"checkedAt":7,"severity":3961,"references":3966,"versionKeys":3983,"packageCount":32,"repositoryCount":34},"ghsa-hmq2-w58f-27jc-f0b0fe70","GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython",[3956,3957],"CVE-2026-76222","PYSEC-2026-3784",[213,3957],"2026-08-07T15:45:39Z","2026-09-08T21:00:05.149418166Z",[3962,3964],{"type":1034,"score":3963},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",{"type":996,"score":3965},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3967,3969,3971,3973,3975,3977,3978,3979,3981],{"type":1040,"url":3968},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hmq2-w58f-27jc",{"type":1003,"url":3970},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76222",{"type":1000,"url":3972},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2202",{"type":1000,"url":3974},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F4299c990e1ca21896f9485277caf7bb0ae5b404c",{"type":1000,"url":3976},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe4b8e7d026ca6abb4cf604f8e77093432ce23c06",{"type":1008,"url":1049},{"type":1000,"url":1705},{"type":1000,"url":3980},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3784.yaml",{"type":1003,"url":3982},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-gitmodules-submodule-name",[1057,1058,1059],{"id":214,"slug":3985,"dossier":47,"summary":3986,"aliases":3987,"sourceIds":3990,"published":3991,"modified":3992,"checkedAt":7,"severity":3993,"references":3995,"versionKeys":4004,"packageCount":32,"repositoryCount":345},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[3988,3989],"BIT-pillow-2026-112893","CVE-2026-112893",[214],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[3994],{"type":996,"score":997},[3996,3998,4000,4002,4003],{"type":1000,"url":3997},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1003,"url":3999},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1000,"url":4001},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":215,"slug":4006,"dossier":47,"summary":4007,"aliases":4008,"sourceIds":4010,"published":4011,"modified":4012,"checkedAt":7,"severity":4013,"references":4016,"versionKeys":4026,"packageCount":32,"repositoryCount":1864},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4009],"CVE-2026-112936",[215],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4014],{"type":1034,"score":4015},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4017,4019,4021,4023,4024],{"type":1000,"url":4018},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1003,"url":4020},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1000,"url":4022},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1008,"url":1856},{"type":1000,"url":4025},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[1860,1861,1862,1863],{"id":216,"slug":4028,"dossier":47,"summary":4029,"aliases":4030,"sourceIds":4033,"published":4034,"modified":4035,"checkedAt":7,"severity":4036,"references":4038,"versionKeys":4047,"packageCount":32,"repositoryCount":345},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4031,4032],"BIT-pillow-2026-112894","CVE-2026-112894",[216],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4037],{"type":996,"score":1877},[4039,4041,4043,4045,4046],{"type":1000,"url":4040},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1003,"url":4042},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1000,"url":4044},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":217,"slug":4049,"dossier":47,"summary":4050,"aliases":4051,"sourceIds":4054,"published":4055,"modified":4056,"checkedAt":7,"severity":4057,"references":4059,"versionKeys":4069,"packageCount":32,"repositoryCount":3217},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[4052,4053],"CVE-2025-67726","PYSEC-2025-267",[217,4053],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[4058],{"type":1034,"score":1176},[4060,4062,4064,4065,4067,4068],{"type":1003,"url":4061},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1003,"url":4063},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1100,"url":3210},{"type":1000,"url":4066},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1008,"url":1463},{"type":1003,"url":3215},[1467,1468,1469],{"id":218,"slug":4071,"dossier":47,"summary":4072,"aliases":4073,"sourceIds":4077,"published":4078,"modified":4079,"checkedAt":7,"severity":4080,"references":4082,"versionKeys":4096,"packageCount":32,"repositoryCount":1633},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4074,4075,4076],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[218,4076],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4081],{"type":1034,"score":1176},[4083,4085,4087,4089,4091,4092,4093,4094],{"type":1000,"url":4084},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1003,"url":4086},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1000,"url":4088},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1000,"url":4090},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1008,"url":1009},{"type":1000,"url":2131},{"type":1008,"url":2133},{"type":1003,"url":4095},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":219,"slug":4098,"dossier":47,"summary":4099,"aliases":4100,"sourceIds":4103,"published":4104,"modified":4105,"checkedAt":7,"severity":4106,"references":4110,"versionKeys":4120,"packageCount":32,"repositoryCount":34},"ghsa-jm78-9fvv-mhgr-2c167ddc","GitPython: git-config OPTION-name injection via =\u002F#\u002Fwhitespace bypasses name validator, enabling forged core.sshCommand\u002FhooksPath (RCE)",[4101,4102],"CVE-2026-76221","PYSEC-2026-3783",[219,4102],"2026-08-07T15:46:35Z","2026-09-10T03:51:14.296736368Z",[4107,4108],{"type":1034,"score":1268},{"type":996,"score":4109},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4111,4113,4114,4116,4117,4118],{"type":1040,"url":4112},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-jm78-9fvv-mhgr",{"type":1000,"url":1700},{"type":1000,"url":4115},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fa495ccd3b547ccd60b2187215823b72a9c0188bf",{"type":1008,"url":1049},{"type":1000,"url":1705},{"type":1003,"url":4119},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-option-name",[1057,1058,1059],{"id":220,"slug":4122,"dossier":47,"summary":4123,"aliases":4124,"sourceIds":4126,"published":4127,"modified":4128,"checkedAt":7,"severity":4129,"references":4131,"versionKeys":4140,"packageCount":32,"repositoryCount":34},"ghsa-m64x-33q8-m5h7-491ad59c","GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines",[4125],"CVE-2026-110856",[220],"2026-10-27T15:26:24Z","2026-10-27T15:47:24.576766638Z",[4130],{"type":996,"score":1877},[4132,4134,4136,4138,4139],{"type":1000,"url":4133},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-m64x-33q8-m5h7",{"type":1000,"url":4135},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2253",{"type":1000,"url":4137},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8290c98d35465a38090cdcc1b17be69967092a15",{"type":1008,"url":1049},{"type":1000,"url":1080},[1057,1058,1059],{"id":221,"slug":4142,"dossier":47,"summary":4143,"aliases":4144,"sourceIds":4147,"published":4148,"modified":4149,"checkedAt":7,"severity":4150,"references":4153,"versionKeys":4161,"packageCount":32,"repositoryCount":397},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4145,4146],"CVE-2026-44432","PYSEC-2026-142",[221,4146],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4151,4152],{"type":1034,"score":1176},{"type":996,"score":1299},[4154,4156,4158,4160],{"type":1003,"url":4155},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1003,"url":4157},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1000,"url":4159},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1008,"url":1314},[2765],{"id":222,"slug":4163,"dossier":47,"summary":4164,"aliases":4165,"sourceIds":4168,"published":4169,"modified":4170,"checkedAt":7,"severity":4171,"references":4173,"versionKeys":4182,"packageCount":32,"repositoryCount":367},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[4166,4167],"CVE-2026-49855","PYSEC-2026-3389",[222,4167],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[4172],{"type":1034,"score":1176},[4174,4176,4177,4178,4180],{"type":1000,"url":4175},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1008,"url":1463},{"type":1008,"url":1575},{"type":1003,"url":4179},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1003,"url":4181},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1467,1468,1469,1470,1471],{"id":223,"slug":4184,"dossier":47,"summary":4185,"aliases":4186,"sourceIds":4189,"published":4190,"modified":4191,"checkedAt":7,"severity":4192,"references":4194,"versionKeys":4207,"packageCount":32,"repositoryCount":355},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[4187,4188],"CVE-2026-82397","PYSEC-2026-3928",[223,4188],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[4193],{"type":1034,"score":1176},[4195,4197,4199,4200,4202,4203,4204,4205],{"type":1000,"url":4196},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1003,"url":4198},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1000,"url":2689},{"type":1000,"url":4201},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1008,"url":1463},{"type":1000,"url":2696},{"type":1008,"url":1575},{"type":1003,"url":4206},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1467,1468,1469,1470,1471,1472],{"id":224,"slug":4209,"dossier":47,"summary":4210,"aliases":4211,"sourceIds":4214,"published":4215,"modified":4216,"checkedAt":7,"severity":4217,"references":4219,"versionKeys":4230,"packageCount":32,"repositoryCount":345},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[4212,4213],"BIT-pillow-2026-96640","CVE-2026-96640",[224],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[4218],{"type":996,"score":997},[4220,4222,4224,4226,4228,4229],{"type":1000,"url":4221},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1003,"url":4223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1000,"url":4225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1000,"url":4227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":225,"slug":4232,"dossier":47,"summary":4233,"aliases":4234,"sourceIds":4237,"published":4238,"modified":4239,"checkedAt":7,"severity":4240,"references":4243,"versionKeys":4251,"packageCount":32,"repositoryCount":34},"ghsa-mv93-w799-cj2w-4413137a","GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath",[4235,4236],"CVE-2026-67326","PYSEC-2026-3980",[225,4236],"2026-05-08T23:19:02Z","2026-09-17T09:10:55.928803360Z",[4241,4242],{"type":1034,"score":1510},{"type":1034,"score":2436},[4244,4246,4248,4249],{"type":1040,"url":4245},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-mv93-w799-cj2w",{"type":1003,"url":4247},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1008,"url":1049},{"type":1003,"url":4250},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-newline-injection-via-config-writer-section",[1057,1058,1059],{"id":226,"slug":4253,"dossier":47,"summary":4254,"aliases":4255,"sourceIds":4258,"published":4259,"modified":4260,"checkedAt":7,"severity":4261,"references":4263,"versionKeys":4272,"packageCount":32,"repositoryCount":345},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[4256,4257],"BIT-pillow-2026-112895","CVE-2026-112895",[226],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[4262],{"type":996,"score":1877},[4264,4266,4268,4270,4271],{"type":1000,"url":4265},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1003,"url":4267},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1000,"url":4269},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":227,"slug":4274,"dossier":47,"summary":4275,"aliases":4276,"sourceIds":4279,"published":4280,"modified":4281,"checkedAt":7,"severity":4282,"references":4287,"versionKeys":4299,"packageCount":32,"repositoryCount":34},"ghsa-p538-c434-8v24-c303e516","GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count",[4277,4278],"CVE-2026-73621","PYSEC-2026-3950",[227,4278],"2026-08-03T20:23:17Z","2026-09-10T13:10:55.177009469Z",[4283,4285],{"type":1034,"score":4284},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":996,"score":4286},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4288,4290,4292,4294,4295,4297],{"type":1040,"url":4289},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-p538-c434-8v24",{"type":1000,"url":4291},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2184",{"type":1000,"url":4293},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F38553b6fddc7f6a667cdb45a6762343a08fc72b2",{"type":1008,"url":1049},{"type":1000,"url":4296},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.56",{"type":1003,"url":4298},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-truncation-via-commit-count",[1057,1058,1059],{"id":228,"slug":4301,"dossier":47,"summary":4302,"aliases":4303,"sourceIds":4307,"published":4308,"modified":4309,"checkedAt":7,"severity":4310,"references":4312,"versionKeys":4322,"packageCount":32,"repositoryCount":345},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[4304,4305,4306],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[228,4306],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[4311],{"type":1034,"score":1128},[4313,4315,4317,4319,4320,4321],{"type":1003,"url":4314},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1003,"url":4316},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1367,"url":4318},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1100,"url":2050},{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":229,"slug":4324,"dossier":47,"summary":4325,"aliases":4326,"sourceIds":4328,"published":4329,"modified":4330,"checkedAt":7,"severity":4331,"references":4333,"versionKeys":4345,"packageCount":32,"repositoryCount":355},"ghsa-pcg2-g6cj-q92c-613600e5","Tornado: Quadratic CPU usage when parsing HTTP headers with line folding",[4327],"CVE-2026-116577",[229],"2026-10-28T22:43:41Z","2026-10-28T23:00:04.070057045Z",[4332],{"type":1034,"score":1452},[4334,4336,4338,4340,4342,4343],{"type":1000,"url":4335},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pcg2-g6cj-q92c",{"type":1003,"url":4337},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116577",{"type":1000,"url":4339},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3765",{"type":1000,"url":4341},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F1b7a1dc9f340f52de929852e8125aa12f25297c9",{"type":1008,"url":1463},{"type":1000,"url":4344},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.0",[1467,1468,1469,1470,1471,1472],{"id":230,"slug":4347,"dossier":47,"summary":4348,"aliases":4349,"sourceIds":4353,"published":4354,"modified":4355,"checkedAt":7,"severity":4356,"references":4360,"versionKeys":4369,"packageCount":32,"repositoryCount":345},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[4350,4351,4352],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[230,4352],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[4357,4358],{"type":996,"score":3182},{"type":1034,"score":4359},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[4361,4363,4365,4367,4368],{"type":1040,"url":4362},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1003,"url":4364},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1100,"url":4366},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":231,"slug":4371,"dossier":47,"summary":4372,"aliases":4373,"sourceIds":4377,"published":4378,"modified":4379,"checkedAt":7,"severity":4380,"references":4383,"versionKeys":4396,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[4374,4375,4376],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[231,4376],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[4381,4382],{"type":1034,"score":1452},{"type":1034,"score":1176},[4384,4386,4388,4390,4392,4394,4395],{"type":1040,"url":4385},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1003,"url":4387},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1100,"url":4389},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1100,"url":4391},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1000,"url":4393},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1008,"url":1009},{"type":1003,"url":2131},[1018,1019,1020,1021],{"id":232,"slug":4398,"dossier":47,"summary":4399,"aliases":4400,"sourceIds":4404,"published":4405,"modified":4406,"checkedAt":7,"severity":4407,"references":4409,"versionKeys":4420,"packageCount":32,"repositoryCount":1633},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[4401,4402,4403],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[232,4403],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[4408],{"type":1034,"score":1176},[4410,4412,4414,4416,4418,4419],{"type":1040,"url":4411},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1003,"url":4413},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1100,"url":4415},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1000,"url":4417},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1008,"url":1009},{"type":1003,"url":1631},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":233,"slug":4422,"dossier":47,"summary":4423,"aliases":4424,"sourceIds":4427,"published":4428,"modified":4429,"checkedAt":7,"severity":4430,"references":4432,"versionKeys":4444,"packageCount":32,"repositoryCount":1682},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[4425,4426],"CVE-2025-50181","PYSEC-2026-1999",[233,4426],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[4431],{"type":1034,"score":1667},[4433,4435,4437,4439,4440,4441,4442],{"type":1000,"url":4434},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1003,"url":4436},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1100,"url":4438},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1008,"url":1314},{"type":1000,"url":1677},{"type":1008,"url":1316},{"type":1003,"url":4443},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1318,1319,1320,1321],{"id":234,"slug":4446,"dossier":47,"summary":4447,"aliases":4448,"sourceIds":4451,"published":4452,"modified":4453,"checkedAt":7,"severity":4454,"references":4458,"versionKeys":4469,"packageCount":32,"repositoryCount":3217},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[4449,4450],"CVE-2025-67724","PYSEC-2025-265",[234,4450],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[4455,4456],{"type":1034,"score":2465},{"type":1034,"score":4457},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[4459,4461,4463,4465,4467,4468],{"type":1003,"url":4460},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1003,"url":4462},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1100,"url":4464},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1000,"url":4466},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1008,"url":1463},{"type":1003,"url":3215},[1467,1468,1469],{"id":235,"slug":4471,"dossier":47,"summary":4472,"aliases":4473,"sourceIds":4475,"published":4476,"modified":4477,"checkedAt":7,"severity":4478,"references":4481,"versionKeys":4485,"packageCount":32,"repositoryCount":367},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[4474],"CVE-2026-91992",[235],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[4479],{"type":1034,"score":4480},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4482,4484],{"type":1000,"url":4483},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1008,"url":1463},[1467,1468,1469,1470,1471],{"id":236,"slug":4487,"dossier":47,"summary":4488,"aliases":4489,"sourceIds":4491,"published":4492,"modified":4493,"checkedAt":7,"severity":4494,"references":4497,"versionKeys":4512,"packageCount":32,"repositoryCount":355},"ghsa-pw9p-v7r6-gx4p-86e36276","Tornado: Open redirect in RedirectHandler via protocol-relative URLs",[4490],"CVE-2026-116578",[236],"2026-10-28T22:43:45Z","2026-10-28T23:00:04.066537287Z",[4495],{"type":996,"score":4496},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:L\u002FSA:N",[4498,4500,4502,4504,4506,4508,4510,4511],{"type":1000,"url":4499},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw9p-v7r6-gx4p",{"type":1003,"url":4501},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116578",{"type":1000,"url":4503},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3786",{"type":1000,"url":4505},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F940ea725bdd9bc68231d68a105eef17ea6e11233",{"type":1000,"url":4507},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fcc75ab0eb3af459c714895a49f682ad354f50117",{"type":1000,"url":4509},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fccb6a2e5482f17997efd4a74b8200d5b4babc035",{"type":1008,"url":1463},{"type":1000,"url":4344},[1467,1468,1469,1470,1471,1472],{"id":237,"slug":4514,"dossier":47,"summary":4515,"aliases":4516,"sourceIds":4520,"published":4521,"modified":4522,"checkedAt":7,"severity":4523,"references":4527,"versionKeys":4539,"packageCount":32,"repositoryCount":1323},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[4517,4518,4519],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[237,4519],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[4524,4525],{"type":996,"score":2434},{"type":1034,"score":4526},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[4528,4529,4531,4533,4535,4537,4538],{"type":1000,"url":3233},{"type":1100,"url":4530},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1003,"url":4532},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1100,"url":4534},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1100,"url":4536},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1008,"url":1009},{"type":1003,"url":2081},[1013,1014,1015,1016,1017,1018,1019,1020],{"id":238,"slug":4541,"dossier":47,"summary":4542,"aliases":4543,"sourceIds":4546,"published":4547,"modified":4548,"checkedAt":7,"severity":4549,"references":4552,"versionKeys":4565,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[4544,4545],"CVE-2024-56326","PYSEC-2026-1475",[238,4545],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[4550,4551],{"type":1034,"score":2436},{"type":996,"score":3332},[4553,4555,4557,4559,4560,4561,4562,4563],{"type":1000,"url":4554},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1003,"url":4556},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1100,"url":4558},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1008,"url":3341},{"type":1000,"url":3834},{"type":1000,"url":3343},{"type":1008,"url":3347},{"type":1003,"url":4564},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3351],{"id":239,"slug":4567,"dossier":47,"summary":4568,"aliases":4569,"sourceIds":4572,"published":4573,"modified":4574,"checkedAt":7,"severity":4575,"references":4577,"versionKeys":4585,"packageCount":32,"repositoryCount":345},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[4570,4571],"BIT-pillow-2026-112897","CVE-2026-112897",[239],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[4576],{"type":996,"score":2802},[4578,4580,4582,4583,4584],{"type":1000,"url":4579},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1003,"url":4581},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1000,"url":3189},{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":240,"slug":4587,"dossier":47,"summary":4588,"aliases":4589,"sourceIds":4592,"published":4593,"modified":4594,"checkedAt":7,"severity":4595,"references":4598,"versionKeys":4604,"packageCount":32,"repositoryCount":345},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[4590,4591],"CVE-2026-44431","PYSEC-2026-141",[240,4591],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[4596,4597],{"type":1034,"score":2201},{"type":996,"score":3127},[4599,4601,4603],{"type":1003,"url":4600},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1003,"url":4602},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1008,"url":1314},[1318,1319,1320,1321,1322,2765],{"id":241,"slug":4606,"dossier":47,"summary":4607,"aliases":4608,"sourceIds":4612,"published":4613,"modified":4614,"checkedAt":7,"severity":4615,"references":4619,"versionKeys":4637,"packageCount":32,"repositoryCount":2186},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[4609,4610,4611],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[241],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[4616,4617],{"type":1034,"score":2831},{"type":996,"score":4618},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[4620,4622,4624,4626,4628,4630,4631,4633,4635],{"type":1003,"url":4621},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1000,"url":4623},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1000,"url":4625},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1000,"url":4627},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1000,"url":4629},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1008,"url":1374},{"type":1000,"url":4632},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1000,"url":4634},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1000,"url":4636},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1386,1387,1388,2179,2180,2181,2182,2183,2184,2185],{"id":242,"slug":4639,"dossier":47,"summary":4640,"aliases":4641,"sourceIds":4644,"published":4645,"modified":4646,"checkedAt":7,"severity":4647,"references":4650,"versionKeys":4663,"packageCount":32,"repositoryCount":367},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[4642,4643],"CVE-2026-31958","PYSEC-2026-140",[242,4643],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[4648,4649],{"type":1034,"score":1176},{"type":996,"score":1877},[4651,4653,4655,4657,4659,4660,4661],{"type":1003,"url":4652},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1003,"url":4654},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1000,"url":4656},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1000,"url":4658},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1008,"url":1463},{"type":1000,"url":2477},{"type":1000,"url":4662},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1467,1468,1469,1470],{"id":243,"slug":4665,"dossier":47,"summary":4666,"aliases":4667,"sourceIds":4670,"published":4671,"modified":4672,"checkedAt":7,"severity":4673,"references":4676,"versionKeys":4690,"packageCount":32,"repositoryCount":2186},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[4668,4669],"CVE-2026-22701","PYSEC-2026-1374",[243,4669],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[4674],{"type":1034,"score":4675},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[4677,4679,4681,4683,4685,4686,4688],{"type":1000,"url":4678},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1003,"url":4680},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1000,"url":4682},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1000,"url":4684},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1008,"url":1856},{"type":1008,"url":4687},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1003,"url":4689},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2284,2285,2286,2287],{"id":244,"slug":4692,"dossier":47,"summary":4693,"aliases":4694,"sourceIds":4696,"published":4697,"modified":4698,"checkedAt":7,"severity":4699,"references":4701,"versionKeys":4712,"packageCount":32,"repositoryCount":355},"ghsa-r4j5-9xpp-3985-880dec7e","Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks",[4695],"CVE-2026-115927",[244],"2026-10-28T22:43:50Z","2026-10-28T23:00:04.082411607Z",[4700],{"type":1034,"score":1452},[4702,4704,4706,4708,4710,4711],{"type":1000,"url":4703},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-r4j5-9xpp-3985",{"type":1003,"url":4705},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115927",{"type":1000,"url":4707},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3773",{"type":1000,"url":4709},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fceab33581489751a66fba8566ad6d5960d4b01c8",{"type":1008,"url":1463},{"type":1000,"url":4344},[1467,1468,1469,1470,1471,1472],{"id":245,"slug":4714,"dossier":47,"summary":4715,"aliases":4716,"sourceIds":4720,"published":4721,"modified":4722,"checkedAt":7,"severity":4723,"references":4726,"versionKeys":4740,"packageCount":32,"repositoryCount":1323},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[4717,4718,4719],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[245,4719],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[4724,4725],{"type":1034,"score":1362},{"type":996,"score":2067},[4727,4729,4731,4733,4735,4736,4737,4738],{"type":1000,"url":4728},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1003,"url":4730},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1000,"url":4732},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1000,"url":4734},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1008,"url":1009},{"type":1000,"url":2081},{"type":1008,"url":2133},{"type":1003,"url":4739},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1013,1014,1015,1016,1017,1018,1019,1020],{"id":246,"slug":4742,"dossier":47,"summary":4743,"aliases":4744,"sourceIds":4747,"published":4748,"modified":4749,"checkedAt":7,"severity":4750,"references":4753,"versionKeys":4763,"packageCount":32,"repositoryCount":34},"ghsa-r9mr-m37c-5fr3-d43000fc","GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution",[4745,4746],"CVE-2026-73625","PYSEC-2026-3953",[246,4746],"2026-07-24T16:42:57Z","2026-09-10T13:10:47.448946391Z",[4751,4752],{"type":1034,"score":1268},{"type":996,"score":4109},[4754,4756,4757,4759,4760,4761],{"type":1040,"url":4755},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-r9mr-m37c-5fr3",{"type":1000,"url":2306},{"type":1000,"url":4758},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe8d0fbf774d1f6baa3b481adfe48bd262e43b453",{"type":1008,"url":1049},{"type":1000,"url":2311},{"type":1003,"url":4762},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-kwarg-value-smuggling",[1057,1058,1059],{"id":247,"slug":4765,"dossier":47,"summary":4766,"aliases":4767,"sourceIds":4770,"published":4771,"modified":4772,"checkedAt":7,"severity":4773,"references":4776,"versionKeys":4785,"packageCount":32,"repositoryCount":345},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[4768,4769],"BIT-pillow-2026-112898","CVE-2026-112898",[247],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[4774],{"type":996,"score":4775},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4777,4779,4781,4783,4784],{"type":1000,"url":4778},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1003,"url":4780},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1000,"url":4782},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":248,"slug":4787,"dossier":47,"summary":4788,"aliases":4789,"sourceIds":4791,"published":4792,"modified":4793,"checkedAt":7,"severity":4794,"references":4796,"versionKeys":4807,"packageCount":32,"repositoryCount":1864},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[4790],"CVE-2026-112939",[248],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[4795],{"type":1034,"score":3583},[4797,4799,4801,4803,4805,4806],{"type":1000,"url":4798},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1003,"url":4800},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1000,"url":4802},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1000,"url":4804},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1008,"url":1856},{"type":1000,"url":1858},[1860,1861,1862,1863],{"id":249,"slug":4809,"dossier":47,"summary":4810,"aliases":4811,"sourceIds":4814,"published":4815,"modified":4816,"checkedAt":7,"severity":4817,"references":4820,"versionKeys":4833,"packageCount":32,"repositoryCount":2083},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[4812,4813],"CVE-2026-25087","PYSEC-2026-113",[249,4813],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[4818],{"type":1034,"score":4819},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[4821,4823,4825,4827,4829,4831],{"type":1003,"url":4822},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1100,"url":4824},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1008,"url":4826},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1000,"url":4828},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1003,"url":4830},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1003,"url":4832},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[4834,4835,4836,4837],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":250,"slug":4839,"dossier":47,"summary":4840,"aliases":4841,"sourceIds":4844,"published":4845,"modified":4846,"checkedAt":7,"severity":4847,"references":4849,"versionKeys":4857,"packageCount":32,"repositoryCount":34},"ghsa-rpm5-65cw-6hj4-6c97dd77","GitPython has Command Injection via Git options bypass",[4842,4843],"CVE-2026-42215","PYSEC-2026-2160",[250,4843],"2026-04-25T23:42:16Z","2026-09-10T03:51:03.167884784Z",[4848],{"type":1034,"score":1268},[4850,4852,4854,4855],{"type":1040,"url":4851},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1003,"url":4853},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42215",{"type":1008,"url":1049},{"type":1100,"url":4856},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.47",[1057,1058,1059],{"id":251,"slug":4859,"dossier":47,"summary":4860,"aliases":4861,"sourceIds":4865,"published":3457,"modified":4866,"checkedAt":7,"severity":4867,"references":4870,"versionKeys":4888,"packageCount":32,"repositoryCount":1323},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[4862,4863,4864],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[251],"2026-09-10T03:49:48.419046410Z",[4868,4869],{"type":1034,"score":2831},{"type":996,"score":4618},[4871,4873,4875,4877,4879,4881,4882,4884,4886],{"type":1003,"url":4872},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1000,"url":4874},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1000,"url":4876},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1000,"url":4878},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1000,"url":4880},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1008,"url":1374},{"type":1000,"url":4883},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1000,"url":4885},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1000,"url":4887},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[4889,4890,4891,1386,1387,1388,2179,2180,2181,2182,2183,2184,2185],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":252,"slug":4893,"dossier":47,"summary":4894,"aliases":4895,"sourceIds":4898,"published":4899,"modified":4900,"checkedAt":7,"severity":4901,"references":4903,"versionKeys":4921,"packageCount":32,"repositoryCount":34},"ghsa-rwj8-pgh3-r573-0bf779f8","GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL",[4896,4897],"CVE-2026-67322","PYSEC-2026-3842",[252,4897],"2026-07-21T22:06:09Z","2026-09-24T18:28:17.149390188Z",[4902],{"type":1034,"score":2800},[4904,4906,4908,4910,4911,4913,4914,4916,4918,4919],{"type":1000,"url":4905},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1003,"url":4907},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67322",{"type":1000,"url":4909},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2172",{"type":1000,"url":2912},{"type":1003,"url":4912},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1008,"url":1049},{"type":1000,"url":4915},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.52",{"type":1000,"url":4917},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3842.yaml",{"type":1008,"url":1284},{"type":1000,"url":4920},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-clone-from",[1057,1058,1059],{"id":253,"slug":4923,"dossier":47,"summary":4924,"aliases":4925,"sourceIds":4927,"published":4928,"modified":4929,"checkedAt":7,"severity":4930,"references":4932,"versionKeys":4941,"packageCount":32,"repositoryCount":1864},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[4926],"CVE-2026-112940",[253],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[4931],{"type":1034,"score":2409},[4933,4935,4937,4938,4939,4940],{"type":1000,"url":4934},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1003,"url":4936},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1000,"url":3081},{"type":1000,"url":3083},{"type":1008,"url":1856},{"type":1000,"url":1858},[1860,1861,1862,1863],{"id":254,"slug":4943,"dossier":47,"summary":4944,"aliases":4945,"sourceIds":4948,"published":4949,"modified":4950,"checkedAt":7,"severity":4951,"references":4953,"versionKeys":4961,"packageCount":32,"repositoryCount":34},"ghsa-v87r-6q3f-2j67-81913ca6","GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath",[4946,4947],"CVE-2026-44244","PYSEC-2026-2163",[254,4947],"2026-05-06T21:58:00Z","2026-09-10T03:50:47.691444343Z",[4952],{"type":1034,"score":2436},[4954,4956,4958,4959],{"type":1040,"url":4955},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-v87r-6q3f-2j67",{"type":1003,"url":4957},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44244",{"type":1008,"url":1049},{"type":1100,"url":4960},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.49",[1057,1058,1059],{"id":255,"slug":4963,"dossier":47,"summary":4964,"aliases":4965,"sourceIds":4969,"published":4970,"modified":4971,"checkedAt":7,"severity":4972,"references":4974,"versionKeys":4985,"packageCount":32,"repositoryCount":1323},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[4966,4967,4968],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[255,4968],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[4973],{"type":1034,"score":1241},[4975,4977,4979,4981,4983,4984],{"type":1003,"url":4976},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1003,"url":4978},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1367,"url":4980},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1100,"url":4982},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1008,"url":1009},{"type":1003,"url":1011},[1015,1016,1017,1018,1019,1020,1021,1022],{"id":256,"slug":4987,"dossier":47,"summary":4988,"aliases":4989,"sourceIds":4993,"published":3457,"modified":4994,"checkedAt":7,"severity":4995,"references":4998,"versionKeys":5013,"packageCount":32,"repositoryCount":355},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[4990,4991,4992],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[256],"2026-06-10T17:41:15.774477397Z",[4996,4997],{"type":1034,"score":2831},{"type":996,"score":3462},[4999,5001,5002,5003,5004,5006,5007,5009,5011],{"type":1003,"url":5000},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1000,"url":3467},{"type":1000,"url":3469},{"type":1000,"url":3471},{"type":1000,"url":5005},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1008,"url":1374},{"type":1000,"url":5008},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1000,"url":5010},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1000,"url":5012},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1386,1387,1388,2179,2180,2181,2182],{"id":257,"slug":5015,"dossier":47,"summary":5016,"aliases":5017,"sourceIds":5021,"published":5022,"modified":5023,"checkedAt":7,"severity":5024,"references":5026,"versionKeys":5040,"packageCount":32,"repositoryCount":1633},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5018,5019,5020],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[257,5020],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5025],{"type":996,"score":1877},[5027,5029,5031,5033,5035,5036,5037,5038],{"type":1000,"url":5028},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1003,"url":5030},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1000,"url":5032},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1000,"url":5034},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1008,"url":1009},{"type":1000,"url":2131},{"type":1008,"url":2133},{"type":1003,"url":5039},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":258,"slug":5042,"dossier":47,"summary":5043,"aliases":5044,"sourceIds":5047,"published":5048,"modified":5049,"checkedAt":7,"severity":5050,"references":5053,"versionKeys":5068,"packageCount":32,"repositoryCount":397},"ghsa-vqfr-h8mv-ghfj-49515033","h11 accepts some malformed Chunked-Encoding bodies",[5045,5046],"CVE-2025-43859","PYSEC-2026-348",[258,5046],"2025-04-24T16:07:56Z","2026-10-27T16:45:03.535584040Z",[5051],{"type":1034,"score":5052},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[5054,5056,5058,5060,5062,5064,5066],{"type":1000,"url":5055},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fsecurity\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",{"type":1003,"url":5057},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-43859",{"type":1000,"url":5059},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fcommit\u002F114803a29ce50116dc47951c690ad4892b1a36ed",{"type":1000,"url":5061},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fh11\u002FPYSEC-2026-348.yaml",{"type":1008,"url":5063},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11",{"type":1008,"url":5065},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fh11",{"type":1003,"url":5067},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",[5069],"pypi:h11@0.14.0",{"id":259,"slug":5071,"dossier":47,"summary":5072,"aliases":5073,"sourceIds":5076,"published":5077,"modified":5078,"checkedAt":7,"severity":5079,"references":5085,"versionKeys":5111,"packageCount":32,"repositoryCount":397},"ghsa-vqwp-45wm-r9r5-eaa960a2","Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission",[5074,5075],"CVE-2026-10804","PYSEC-2026-212",[259,5075],"2026-06-04T12:16:24.620Z","2026-07-23T15:00:23.893493649Z",[5080,5082,5084],{"type":1034,"score":5081},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":996,"score":5083},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1034,"score":3583},[5086,5088,5090,5092,5094,5096,5098,5099,5101,5103,5105,5107,5109],{"type":1003,"url":5087},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10804",{"type":1100,"url":5089},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fissues\u002F14622",{"type":1100,"url":5091},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F14635",{"type":1000,"url":5093},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F15397",{"type":1000,"url":5095},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002Ffec0f584dae9261abed16cad35b32922104bb933",{"type":1000,"url":5097},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstreamlit\u002FPYSEC-2026-212.yaml",{"type":1008,"url":2617},{"type":1003,"url":5100},"https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-10804",{"type":1003,"url":5102},"https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F831508",{"type":1003,"url":5104},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253",{"type":1367,"url":5106},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253\u002Fcti",{"type":1000,"url":5108},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002F",{"type":1003,"url":5110},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqwp-45wm-r9r5",[2621,2622,2623],{"id":260,"slug":5113,"dossier":47,"summary":5114,"aliases":5115,"sourceIds":5117,"published":5118,"modified":5119,"checkedAt":7,"severity":5120,"references":5122,"versionKeys":5129,"packageCount":32,"repositoryCount":345},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[5116],"CVE-2026-112899",[260],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[5121],{"type":996,"score":2226},[5123,5125,5127,5128],{"type":1000,"url":5124},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1000,"url":5126},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":261,"slug":5131,"dossier":90,"summary":5132,"aliases":5133,"sourceIds":5136,"published":5137,"modified":5138,"checkedAt":7,"severity":5139,"references":5141,"versionKeys":5153,"packageCount":32,"repositoryCount":2241},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[5134,5135],"CVE-2026-97689","PYSEC-2026-4177",[261,5135],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[5140],{"type":996,"score":1299},[5142,5144,5146,5148,5149,5150,5151],{"type":1000,"url":5143},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1003,"url":5145},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1000,"url":5147},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1008,"url":1314},{"type":1000,"url":2760},{"type":1008,"url":1316},{"type":1003,"url":5152},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1318,1319,1320,1321,1322,2765,2766],{"id":262,"slug":5155,"dossier":47,"summary":5156,"aliases":5157,"sourceIds":5160,"published":5161,"modified":5162,"checkedAt":7,"severity":5163,"references":5166,"versionKeys":5183,"packageCount":32,"repositoryCount":2186},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[5158,5159],"CVE-2025-68146","PYSEC-2026-1375",[262,5159],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[5164],{"type":1034,"score":5165},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5167,5169,5171,5172,5174,5176,5178,5179,5181],{"type":1000,"url":5168},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1000,"url":5170},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1008,"url":1856},{"type":1000,"url":5173},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1000,"url":5175},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1000,"url":5177},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1008,"url":4687},{"type":1003,"url":5180},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1003,"url":5182},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2284,2285,2286,2287],{"id":263,"slug":5185,"dossier":47,"summary":5186,"aliases":5187,"sourceIds":5190,"published":5191,"modified":5192,"checkedAt":7,"severity":5193,"references":5196,"versionKeys":5205,"packageCount":32,"repositoryCount":345},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[5188,5189],"BIT-pillow-2026-112900","CVE-2026-112900",[263],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[5194],{"type":996,"score":5195},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[5197,5199,5201,5203,5204],{"type":1000,"url":5198},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1003,"url":5200},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1000,"url":5202},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1008,"url":1009},{"type":1000,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":264,"slug":5207,"dossier":47,"summary":5208,"aliases":5209,"sourceIds":5211,"published":5212,"modified":5213,"checkedAt":7,"severity":5214,"references":5216,"versionKeys":5225,"packageCount":32,"repositoryCount":34},"ghsa-w8jc-g24h-crhw-5553514f","GitPython command wrappers omit unsafe protocol and option checks",[5210],"CVE-2026-110857",[264],"2026-10-27T15:26:43Z","2026-10-27T15:47:24.947223105Z",[5215],{"type":1034,"score":2661},[5217,5219,5221,5223,5224],{"type":1000,"url":5218},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-w8jc-g24h-crhw",{"type":1000,"url":5220},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2251",{"type":1000,"url":5222},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9ad28cc4c7176d22cd6181d69805058a719dd03b",{"type":1008,"url":1049},{"type":1000,"url":1080},[1057,1058,1059],{"id":265,"slug":5227,"dossier":47,"summary":5228,"aliases":5229,"sourceIds":5233,"published":5234,"modified":5235,"checkedAt":7,"severity":5236,"references":5239,"versionKeys":5277,"packageCount":32,"repositoryCount":1323},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[5230,5231,5232],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[265,5232],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[5237,5238],{"type":1034,"score":1176},{"type":996,"score":1877},[5240,5242,5244,5246,5248,5249,5251,5253,5255,5257,5259,5261,5262,5264,5266,5268,5269,5271,5273,5275],{"type":1000,"url":5241},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1003,"url":5243},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1000,"url":5245},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1000,"url":5247},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1008,"url":1009},{"type":1000,"url":5250},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1000,"url":5252},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1000,"url":5254},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1003,"url":5256},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1003,"url":5258},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1003,"url":5260},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1003,"url":3256},{"type":1003,"url":5263},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1003,"url":5265},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1003,"url":5267},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1003,"url":3258},{"type":1003,"url":5270},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1003,"url":5272},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1003,"url":5274},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1003,"url":5276},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1013,1014,1015,1016,1017,1018,1019,1020],{"id":266,"slug":5279,"dossier":47,"summary":5280,"aliases":5281,"sourceIds":5285,"published":5286,"modified":5287,"checkedAt":7,"severity":5288,"references":5291,"versionKeys":5300,"packageCount":32,"repositoryCount":1323},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[5282,5283,5284],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[266,5284],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[5289,5290],{"type":1034,"score":1362},{"type":996,"score":2067},[5292,5294,5296,5298,5299],{"type":1003,"url":5293},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1003,"url":5295},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1000,"url":5297},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1008,"url":1009},{"type":1003,"url":2081},[1013,1014,1015,1016,1017,1018,1019,1020],{"id":267,"slug":5302,"dossier":47,"summary":5303,"aliases":5304,"sourceIds":5307,"published":5308,"modified":5309,"checkedAt":7,"severity":5310,"references":5312,"versionKeys":5327,"packageCount":32,"repositoryCount":34},"ghsa-wvpp-8hx9-p66j-188b3951","GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution",[5305,5306],"CVE-2026-76220","PYSEC-2026-3843",[267,5306],"2026-08-07T15:49:07Z","2026-09-10T12:26:01.792035310Z",[5311],{"type":1034,"score":1268},[5313,5315,5317,5318,5320,5321,5322,5324,5325],{"type":1000,"url":5314},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",{"type":1003,"url":5316},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76220",{"type":1000,"url":1700},{"type":1000,"url":5319},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F96a888f4d782cb2f80452148e48e60ce4af6d541",{"type":1008,"url":1049},{"type":1000,"url":1705},{"type":1000,"url":5323},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-execution-via-split-single-char-options",{"type":1008,"url":1284},{"type":1003,"url":5326},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",[1057,1058,1059],{"id":268,"slug":5329,"dossier":47,"summary":5330,"aliases":5331,"sourceIds":5333,"published":5334,"modified":5335,"checkedAt":7,"severity":5336,"references":5339,"versionKeys":5351,"packageCount":32,"repositoryCount":103},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[5332],"CVE-2026-91991",[268],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[5337],{"type":996,"score":5338},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5340,5342,5343,5345,5347,5349,5350],{"type":1000,"url":5341},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1000,"url":2689},{"type":1000,"url":5344},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1000,"url":5346},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1000,"url":5348},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1008,"url":1463},{"type":1000,"url":2696},[1471,1472],{"id":269,"slug":5353,"dossier":47,"summary":5354,"aliases":5355,"sourceIds":5358,"published":5359,"modified":5360,"checkedAt":7,"severity":5361,"references":5364,"versionKeys":5373,"packageCount":32,"repositoryCount":34},"ghsa-x2qx-6953-8485-107f8fe2","GitPython: Unsafe option check validates multi_options before shlex.split transformation",[5356,5357],"CVE-2026-42284","PYSEC-2026-2161",[269,5357],"2026-04-25T23:41:49Z","2026-09-10T03:51:03.787491179Z",[5362,5363],{"type":1034,"score":2492},{"type":1034,"score":1241},[5365,5367,5369,5370,5371],{"type":1040,"url":5366},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-x2qx-6953-8485",{"type":1003,"url":5368},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42284",{"type":1008,"url":1049},{"type":1100,"url":4856},{"type":1000,"url":5372},"https:\u002F\u002Fwww.tenable.com\u002Fcve\u002FCVE-2026-32686",[1057,1058,1059],{"id":270,"slug":5375,"dossier":47,"summary":5376,"aliases":5377,"sourceIds":5381,"published":5382,"modified":5383,"checkedAt":7,"severity":5384,"references":5389,"versionKeys":5405,"packageCount":32,"repositoryCount":103},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[5378,5379,5380],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[270],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[5385,5387],{"type":1034,"score":5386},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":996,"score":5388},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5390,5392,5394,5396,5398,5399,5401,5403],{"type":1003,"url":5391},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1000,"url":5393},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1000,"url":5395},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1000,"url":5397},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1008,"url":1374},{"type":1000,"url":5400},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1000,"url":5402},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1000,"url":5404},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1386,1387],{"id":271,"slug":5407,"dossier":47,"summary":5408,"aliases":5409,"sourceIds":5413,"published":5414,"modified":5415,"checkedAt":7,"severity":5416,"references":5418,"versionKeys":5432,"packageCount":32,"repositoryCount":377},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[5410,5411,5412],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[271,5412],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[5417],{"type":1034,"score":2409},[5419,5421,5423,5425,5427,5429,5430],{"type":1003,"url":5420},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1003,"url":5422},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1000,"url":5424},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1100,"url":5426},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1000,"url":5428},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1008,"url":1009},{"type":1000,"url":5431},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1016],{"id":272,"slug":5434,"dossier":47,"summary":5435,"aliases":5436,"sourceIds":5440,"published":5441,"modified":5442,"checkedAt":7,"severity":5443,"references":5446,"versionKeys":5455,"packageCount":32,"repositoryCount":345},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[5437,5438,5439],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[272,5439],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[5444,5445],{"type":996,"score":2226},{"type":1034,"score":1176},[5447,5449,5451,5453,5454],{"type":1100,"url":5448},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1003,"url":5450},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1100,"url":5452},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":273,"slug":5457,"dossier":47,"summary":5458,"aliases":5459,"sourceIds":5463,"published":5464,"modified":5465,"checkedAt":7,"severity":5466,"references":5469,"versionKeys":5480,"packageCount":32,"repositoryCount":1633},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[5460,5461,5462],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[273,5462],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[5467],{"type":1034,"score":5468},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5470,5472,5474,5476,5478,5479],{"type":1040,"url":5471},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1003,"url":5473},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1100,"url":5475},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1100,"url":5477},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1008,"url":1009},{"type":1003,"url":2131},[1013,1014,1015,1016,1017,1018,1019,1020,1021],{"id":274,"slug":5482,"dossier":47,"summary":5483,"aliases":5484,"sourceIds":5485,"published":5486,"modified":5487,"checkedAt":7,"severity":5488,"references":5491,"versionKeys":5501,"packageCount":32,"repositoryCount":345},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[274],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[5489],{"type":996,"score":5490},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[5492,5494,5496,5498,5499],{"type":1000,"url":5493},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1000,"url":5495},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1000,"url":5497},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1008,"url":1976},{"type":1000,"url":5500},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[1982,1983,1984,1985,3884,3885,3886,3887,3888,3889,3890,3891],{"id":275,"slug":5503,"dossier":47,"summary":5504,"aliases":5505,"sourceIds":5508,"published":5509,"modified":5510,"checkedAt":7,"severity":5511,"references":5516,"versionKeys":5531,"packageCount":32,"repositoryCount":345},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[5506,5507],"CVE-2026-112902","PYSEC-2026-4363",[275,5507],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[5512,5514],{"type":996,"score":5513},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1034,"score":5515},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5517,5519,5521,5523,5525,5527,5529,5530],{"type":1100,"url":5518},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1003,"url":5520},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1000,"url":5522},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1100,"url":5524},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1100,"url":5526},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1000,"url":5528},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1008,"url":1009},{"type":1003,"url":1011},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022],{"id":276,"slug":5533,"dossier":47,"summary":83,"aliases":5534,"sourceIds":5537,"published":5538,"modified":5539,"checkedAt":7,"severity":5540,"references":5543,"versionKeys":5552,"packageCount":32,"repositoryCount":32},"pysec-2025-112-653e8a7c",[5535,5536],"CVE-2025-64429","GHSA-vmp8-hg63-v2hp",[276],"2025-11-12T22:15:49.813Z","2026-05-20T09:18:59.601738Z",[5541],{"type":1034,"score":5542},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[5544,5546,5548,5550],{"type":1000,"url":5545},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fblob\u002F029a5b87ff5b1cd22f7f9717d48cd8830d00807c\u002Fsrc\u002Fcommon\u002Frandom_engine.cpp#L20",{"type":1003,"url":5547},"https:\u002F\u002Fduckdb.org\u002F2025\u002F09\u002F16\u002Fannouncing-duckdb-140.html",{"type":1003,"url":5549},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fsecurity\u002Fadvisories\u002FGHSA-vmp8-hg63-v2hp",{"type":1100,"url":5551},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fpull\u002F17275",[5553],"pypi:duckdb@1.4.1",{"id":277,"slug":5555,"dossier":47,"summary":83,"aliases":5556,"sourceIds":5559,"published":5560,"modified":5561,"checkedAt":7,"severity":5562,"references":5564,"versionKeys":5573,"packageCount":32,"repositoryCount":103},"pysec-2025-198-62b25ed4",[5557,5558],"BIT-pytorch-2025-46148","CVE-2025-46148",[277],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[5563],{"type":1034,"score":2201},[5565,5567,5569,5571],{"type":1003,"url":5566},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1003,"url":5568},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1367,"url":5570},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1100,"url":5572},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1386,1387],{"id":278,"slug":5575,"dossier":47,"summary":83,"aliases":5576,"sourceIds":5579,"published":5580,"modified":5581,"checkedAt":7,"severity":5582,"references":5584,"versionKeys":5590,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[5577,5578],"BIT-pytorch-2025-46149","CVE-2025-46149",[278],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[5583],{"type":1034,"score":2201},[5585,5586,5588],{"type":1003,"url":5566},{"type":1367,"url":5587},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1100,"url":5589},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1387],{"id":279,"slug":5592,"dossier":47,"summary":83,"aliases":5593,"sourceIds":5596,"published":5597,"modified":5598,"checkedAt":7,"severity":5599,"references":5601,"versionKeys":5609,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[5594,5595],"BIT-pytorch-2025-46150","CVE-2025-46150",[279],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[5600],{"type":1034,"score":2201},[5602,5603,5605,5607],{"type":1003,"url":5566},{"type":1367,"url":5604},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1367,"url":5606},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1100,"url":5608},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1387],{"id":280,"slug":5611,"dossier":47,"summary":83,"aliases":5612,"sourceIds":5615,"published":5616,"modified":5617,"checkedAt":7,"severity":5618,"references":5620,"versionKeys":5626,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[5613,5614],"BIT-pytorch-2025-46152","CVE-2025-46152",[280],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[5619],{"type":1034,"score":1452},[5621,5622,5624],{"type":1003,"url":5566},{"type":1367,"url":5623},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1100,"url":5625},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1387],{"id":281,"slug":5628,"dossier":47,"summary":83,"aliases":5629,"sourceIds":5632,"published":5633,"modified":5634,"checkedAt":7,"severity":5635,"references":5637,"versionKeys":5647,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[5630,5631],"BIT-pytorch-2025-46153","CVE-2025-46153",[281],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[5636],{"type":1034,"score":2201},[5638,5640,5641,5643,5645],{"type":1000,"url":5639},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1003,"url":5566},{"type":1003,"url":5642},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1367,"url":5644},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1100,"url":5646},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1387],{"id":282,"slug":5649,"dossier":47,"summary":83,"aliases":5650,"sourceIds":5653,"published":5654,"modified":5655,"checkedAt":7,"severity":5656,"references":5658,"versionKeys":5663,"packageCount":32,"repositoryCount":3217},"pysec-2025-203-2febb201",[5651,5652],"BIT-pytorch-2025-55551","CVE-2025-55551",[282],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[5657],{"type":1034,"score":1176},[5659,5661],{"type":1003,"url":5660},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1367,"url":5662},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1386,1387,1388,2179,2180,2181],{"id":283,"slug":5665,"dossier":47,"summary":83,"aliases":5666,"sourceIds":5669,"published":5670,"modified":5671,"checkedAt":7,"severity":5672,"references":5674,"versionKeys":5678,"packageCount":32,"repositoryCount":3217},"pysec-2025-204-cdae47da",[5667,5668],"BIT-pytorch-2025-55552","CVE-2025-55552",[283],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[5673],{"type":1034,"score":1176},[5675,5676],{"type":1003,"url":5660},{"type":1367,"url":5677},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1386,1387,1388,2179,2180,2181],{"id":284,"slug":5680,"dossier":47,"summary":83,"aliases":5681,"sourceIds":5684,"published":5685,"modified":5686,"checkedAt":7,"severity":5687,"references":5689,"versionKeys":5695,"packageCount":32,"repositoryCount":397},"pysec-2025-205-fd5e58fd",[5682,5683],"BIT-pytorch-2025-55553","CVE-2025-55553",[284],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[5688],{"type":1034,"score":1176},[5690,5691,5693],{"type":1003,"url":5660},{"type":1367,"url":5692},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1100,"url":5694},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1386,1387,1388],{"id":285,"slug":5697,"dossier":47,"summary":83,"aliases":5698,"sourceIds":5701,"published":5702,"modified":5703,"checkedAt":7,"severity":5704,"references":5706,"versionKeys":5710,"packageCount":32,"repositoryCount":3217},"pysec-2025-206-58322476",[5699,5700],"BIT-pytorch-2025-55554","CVE-2025-55554",[285],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[5705],{"type":1034,"score":1452},[5707,5708],{"type":1003,"url":5660},{"type":1367,"url":5709},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1386,1387,1388,2179,2180,2181],{"id":286,"slug":5712,"dossier":47,"summary":83,"aliases":5713,"sourceIds":5716,"published":5717,"modified":5718,"checkedAt":7,"severity":5719,"references":5721,"versionKeys":5727,"packageCount":32,"repositoryCount":397},"pysec-2025-207-2abef3fc",[5714,5715],"BIT-pytorch-2025-55557","CVE-2025-55557",[286],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[5720],{"type":1034,"score":1176},[5722,5723,5725],{"type":1003,"url":5660},{"type":1367,"url":5724},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1100,"url":5726},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1386,1387,1388],{"id":287,"slug":5729,"dossier":47,"summary":83,"aliases":5730,"sourceIds":5733,"published":5734,"modified":5735,"checkedAt":7,"severity":5736,"references":5738,"versionKeys":5744,"packageCount":32,"repositoryCount":397},"pysec-2025-208-6e93fe9d",[5731,5732],"BIT-pytorch-2025-55558","CVE-2025-55558",[287],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[5737],{"type":1034,"score":1176},[5739,5740,5742],{"type":1003,"url":5660},{"type":1367,"url":5741},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1100,"url":5743},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1386,1387,1388],{"id":288,"slug":5746,"dossier":47,"summary":83,"aliases":5747,"sourceIds":5750,"published":5751,"modified":5752,"checkedAt":7,"severity":5753,"references":5755,"versionKeys":5761,"packageCount":32,"repositoryCount":397},"pysec-2025-209-e6f352b0",[5748,5749],"BIT-pytorch-2025-55560","CVE-2025-55560",[288],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[5754],{"type":1034,"score":1176},[5756,5757,5759],{"type":1003,"url":5660},{"type":1367,"url":5758},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1100,"url":5760},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1386,1387,1388],{"id":289,"slug":5763,"dossier":47,"summary":83,"aliases":5764,"sourceIds":5767,"published":5768,"modified":5769,"checkedAt":7,"severity":5770,"references":5772,"versionKeys":5783,"packageCount":32,"repositoryCount":1229},"pysec-2026-139-96951ff6",[5765,5766],"BIT-pytorch-2026-4538","CVE-2026-4538",[289],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[5771],{"type":1034,"score":2436},[5773,5775,5777,5779,5781],{"type":1000,"url":5774},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1003,"url":5776},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1003,"url":5778},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1367,"url":5780},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1100,"url":5782},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[4889,1386,1387,1388,2179,2180,2181,2182,2183,2184,2185],1794474423066]