[{"data":1,"prerenderedAt":6800},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14333":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":76,"entity":77,"evidence":325,"related":328},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-12T08:58:58.139Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-12T08:57:16.613Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5071,5059,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":42,"licenseExpressionCount":66,"knownLicensePackageCount":67,"unknownLicensePackageCount":68,"advisoryCount":69,"matchedAdvisoryRepositoryCount":70,"topPackage":71},2865,51,9911,63,2827,38,1097,43,{"id":72,"slug":73,"label":74,"repositoryCount":33,"repositoryShare":75},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":78,"slug":79,"gitlabProjectId":80,"name":81,"pathWithNamespace":82,"description":83,"webUrl":84,"commitSha":85,"commitUrl":86,"lastActivityAt":87,"headCommittedAt":88,"tree":89,"files":92,"resolvedComponentCount":100,"artifactResolvedComponentCount":100,"exactManifestPinCount":39,"packageCount":100,"ecosystems":101,"aiPackageCount":103,"licenseExpressionCount":104,"unknownLicensePackageCount":32,"advisoryIds":105,"advisoryCount":323,"providers":324},"opencode:14333","opencode-14333",14333,"URBAN.KI AirGuardAI","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai","25e76382daca051de472efd8a32f7fa276ae36d0","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai\u002F-\u002Fcommit\u002F25e76382daca051de472efd8a32f7fa276ae36d0","2026-11-11T20:31:43.634Z","2026-11-11T20:31:28.000Z",{"complete":90,"entryCount":91,"truncated":47},true,95,[93],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},"uv-lock","d8e9658e0c9c7ed8859da5223f957aa8010f39de","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai\u002F-\u002Fblob\u002F25e76382daca051de472efd8a32f7fa276ae36d0\u002Fuv.lock","59cb0231b92ede8e7f9c5ef5b78867b9fa36e7a4e0fc2600956a5c532b08c9e0",313514,"parsed",102,[102],"pypi",7,18,[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322],"GHSA-22hg-r758-rrw9","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-29pf-2h5f-8g72","GHSA-2c2j-9gv5-cj73","GHSA-2fqr-mr3j-6wp8","GHSA-2g87-pp6c-29x5","GHSA-2vrm-gr82-f7m5","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-379c-qx7v-6h59","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3j72-p6qg-6xp7","GHSA-3wq7-rqq7-wx6j","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-494j-54xm-rwp3","GHSA-4fvr-rgm6-gqmc","GHSA-4j2p-28q2-5m79","GHSA-4m7w-qmgq-4wj5","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-53q9-r3pm-6pq6","GHSA-54jq-c3m8-4m76","GHSA-54p9-h82j-f925","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59g5-xgcq-4qw3","GHSA-59p9-h35m-wg4g","GHSA-5p39-cfhj-2xmp","GHSA-5rjg-fvgr-3xxf","GHSA-5rvq-cxj2-64vf","GHSA-5wr8-gcqf-gqf3","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-63hf-3vf5-4wqf","GHSA-63hw-fmq6-xxg2","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69f9-5gxw-wvc2","GHSA-69hj-f68j-2879","GHSA-69w3-r845-3855","GHSA-6cjc-53gc-5rqm","GHSA-6jhg-hg63-jvvf","GHSA-6jv3-5f52-599m","GHSA-6mq8-rvhq-8wgg","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-74r2-7ff9-mjj2","GHSA-768j-98cg-p3fv","GHSA-78g4-xqwv-q3g8","GHSA-7f5h-v6xp-fcq8","GHSA-7mwm-ghpf-9vrm","GHSA-82r6-8w77-94w6","GHSA-82w8-qh3p-5jfq","GHSA-86qp-5c8j-p5mr","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mx5-7m5m-r77g","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-9548-qrrj-x5pj","GHSA-966j-vmvw-g2g9","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-9x8q-7h8h-wcw9","GHSA-9xw5-w5jj-pvcg","GHSA-c427-h43c-vf67","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-cfh3-3jmp-rvhc","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cq5v-8q36-5273","GHSA-cwqr-hh33-gh44","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f96h-pmfr-66vw","GHSA-f9xw-jh8m-3mwq","GHSA-fc9g-5qg7-mf45","GHSA-fgcw-684q-jj6r","GHSA-fh55-r93g-j68g","GHSA-fj7v-r99m-22gq","GHSA-fpwr-67px-3qhx","GHSA-fq56-3cx3-fjxp","GHSA-g3cq-j2xw-wf74","GHSA-g4qv-2jxx-769h","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-g84x-mcqj-x9qq","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gx76-c99x-2c96","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hcc4-c3v8-rx92","GHSA-hg6j-4rv6-33pg","GHSA-hpj7-wq8m-9hgp","GHSA-hx9q-6w63-j58v","GHSA-hxxf-235m-72v3","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg22-mg44-37j8","GHSA-jg86-v3jv-hrpm","GHSA-jj3x-wxrx-4x23","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jp82-jpqv-5vv3","GHSA-jw8x-6495-233v","GHSA-m5qp-6w8w-w647","GHSA-m6qw-4cw2-hm4m","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mfx4-hv73-q22v","GHSA-mj87-hwqh-73pj","GHSA-mq44-7p77-q5h7","GHSA-mqqc-3gqh-h2x8","GHSA-mrfp-p49p-3hf2","GHSA-mwh4-6h8g-pg8w","GHSA-p4wg-p73j-c528","GHSA-p8hx-v2p6-rp84","GHSA-p998-jp59-783m","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pp6c-gr5w-3c5g","GHSA-pq67-6m6q-mj2v","GHSA-pqxq-w44r-73xw","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r73j-pqj5-w3x7","GHSA-rcv9-qm8p-9p6j","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rrmf-rvhw-rf47","GHSA-v4x8-3wr5-3wq8","GHSA-v9pg-7xvm-68hf","GHSA-v9pv-5gc8-w2m6","GHSA-vffw-93wf-4j4q","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w2fm-2cpv-w7v5","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wp53-j4wj-2cfg","GHSA-wqp7-x3pw-xc5r","GHSA-wrfc-pvp9-mr9g","GHSA-x3gm-94wq-g975","GHSA-x746-7m8f-x49c","GHSA-x9r9-c232-4q39","GHSA-xcgm-r5h9-7989","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xrqw-3rrv-vx5w","GHSA-xvh5-g6gv-559v","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139",217,[],{"files":326,"occurrenceCount":100},[327],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},{"packages":329,"vulnerabilities":1266},[330,344,355,365,375,384,393,403,415,426,436,446,456,465,475,484,494,504,514,523,532,541,550,559,570,579,589,598,608,618,627,636,645,654,663,672,681,690,699,708,717,726,734,743,752,761,770,779,788,797,805,814,823,832,841,850,859,868,878,887,896,905,914,923,932,941,950,959,968,977,986,994,1003,1011,1021,1029,1038,1046,1055,1064,1073,1082,1091,1100,1110,1119,1128,1137,1146,1155,1163,1172,1181,1189,1197,1203,1212,1221,1230,1239,1248,1257],{"id":331,"slug":332,"identity":333,"label":334,"aiRelevant":90,"provider":335,"advisoryCount":338,"licenseExpressions":339,"versions":341,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":343},"package:pypi:transformers","transformers-65289303","pypi:transformers","Transformers",{"id":336,"label":337},"hugging-face","Hugging Face",27,[340],"Apache-2.0",[342],"5.8.0",[56],{"id":345,"slug":346,"identity":347,"label":348,"aiRelevant":90,"provider":83,"advisoryCount":349,"licenseExpressions":350,"versions":352,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":354},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[351],"BSD-3-Clause",[353],"2.11.0",[56],{"id":356,"slug":357,"identity":358,"label":359,"aiRelevant":90,"provider":360,"advisoryCount":32,"licenseExpressions":361,"versions":362,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":364},"package:pypi:datasets","datasets-e12c1359","pypi:datasets","Hugging Face Datasets",{"id":336,"label":337},[340],[363],"4.8.5",[56],{"id":366,"slug":367,"identity":368,"label":369,"aiRelevant":90,"provider":83,"advisoryCount":32,"licenseExpressions":370,"versions":372,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":374},"package:pypi:accelerate","accelerate-7fac5dd9","pypi:accelerate","Accelerate",[340,371],"non-standard",[373],"1.13.0",[56],{"id":376,"slug":377,"identity":378,"label":379,"aiRelevant":90,"provider":83,"advisoryCount":32,"licenseExpressions":380,"versions":381,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":383},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",[351,371],[382],"1.8.0",[56],{"id":385,"slug":386,"identity":387,"label":388,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":389,"versions":390,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":392},"package:pypi:tokenizers","tokenizers-7ba00902","pypi:tokenizers","Hugging Face Tokenizers",[371],[391],"0.22.2",[56],{"id":394,"slug":395,"identity":396,"label":397,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":398,"versions":400,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":402},"package:pypi:lightgbm","lightgbm-da1283c4","pypi:lightgbm","LightGBM",[399],"MIT",[401],"4.6.0",[56],{"id":404,"slug":405,"identity":406,"label":407,"aiRelevant":47,"provider":83,"advisoryCount":408,"licenseExpressions":409,"versions":412,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":414},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",61,[410,411],"HPND","MIT-CMU",[413],"12.2.0",[56],{"id":416,"slug":417,"identity":418,"label":419,"aiRelevant":47,"provider":83,"advisoryCount":420,"licenseExpressions":421,"versions":423,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":425},"package:pypi:aiohttp","aiohttp-5a806a63","pypi:aiohttp","aiohttp",41,[340,422],"Apache-2.0 AND MIT",[424],"3.13.5",[56],{"id":427,"slug":428,"identity":429,"label":430,"aiRelevant":47,"provider":83,"advisoryCount":431,"licenseExpressions":432,"versions":434,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":435},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",11,[399,433],"Unlicense",[27],[56],{"id":437,"slug":438,"identity":439,"label":440,"aiRelevant":47,"provider":83,"advisoryCount":441,"licenseExpressions":442,"versions":443,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":445},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[399],[444],"2.7.0",[56],{"id":447,"slug":448,"identity":449,"label":450,"aiRelevant":47,"provider":83,"advisoryCount":451,"licenseExpressions":452,"versions":453,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":455},"package:pypi:python-multipart","python-multipart-7d2a810e","pypi:python-multipart","python-multipart",8,[340],[454],"0.0.28",[56],{"id":457,"slug":458,"identity":459,"label":460,"aiRelevant":47,"provider":83,"advisoryCount":451,"licenseExpressions":461,"versions":462,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":464},"package:pypi:starlette","starlette-beb9e527","pypi:starlette","starlette",[351],[463],"1.0.0",[56],{"id":466,"slug":467,"identity":468,"label":469,"aiRelevant":47,"provider":83,"advisoryCount":470,"licenseExpressions":471,"versions":472,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":474},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[351,371],[473],"3.1.6",[56],{"id":476,"slug":477,"identity":478,"label":479,"aiRelevant":47,"provider":83,"advisoryCount":470,"licenseExpressions":480,"versions":481,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":483},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[399],[482],"81.0.0",[56],{"id":485,"slug":486,"identity":487,"label":488,"aiRelevant":47,"provider":83,"advisoryCount":489,"licenseExpressions":490,"versions":491,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":493},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[340],[492],"2.34.0",[56],{"id":495,"slug":496,"identity":497,"label":498,"aiRelevant":47,"provider":83,"advisoryCount":499,"licenseExpressions":500,"versions":501,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":503},"package:pypi:anyio","anyio-399e5280","pypi:anyio","anyio",2,[399],[502],"4.13.0",[56],{"id":505,"slug":506,"identity":507,"label":508,"aiRelevant":47,"provider":83,"advisoryCount":499,"licenseExpressions":509,"versions":511,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":513},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[510],"MPL-2.0",[512],"2026.4.22",[56],{"id":515,"slug":516,"identity":517,"label":518,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":519,"versions":520,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":522},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[399],[521],"4.62.1",[56],{"id":524,"slug":525,"identity":526,"label":527,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":528,"versions":529,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":531},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[351],[530],"2026.2.0",[56],{"id":533,"slug":534,"identity":535,"label":536,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":537,"versions":538,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":540},"package:pypi:h11","h11-48165ab1","pypi:h11","h11",[399],[539],"0.16.0",[56],{"id":542,"slug":543,"identity":544,"label":545,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":546,"versions":547,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":549},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[351,371],[548],"3.14",[56],{"id":551,"slug":552,"identity":553,"label":554,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":555,"versions":556,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":558},"package:pypi:multidict","multidict-b407a4ac","pypi:multidict","multidict",[340],[557],"6.7.1",[56],{"id":560,"slug":561,"identity":562,"label":563,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":564,"versions":567,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":569},"package:pypi:orjson","orjson-0293c856","pypi:orjson","orjson",[565,566],"Apache-2.0 OR MIT","MPL-2.0 AND (Apache-2.0 OR MIT)",[568],"3.11.9",[56],{"id":571,"slug":572,"identity":573,"label":574,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":575,"versions":576,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":578},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[340,371],[577],"24.0.0",[56],{"id":580,"slug":581,"identity":582,"label":583,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":584,"versions":586,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":588},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[585],"BSD-2-Clause",[587],"2.20.0",[56],{"id":590,"slug":591,"identity":592,"label":593,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":594,"versions":595,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":597},"package:pypi:python-dotenv","python-dotenv-27b12285","pypi:python-dotenv","python-dotenv",[351],[596],"1.2.2",[56],{"id":599,"slug":600,"identity":601,"label":602,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":603,"versions":605,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":607},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[604],"MIT AND MPL-2.0",[606],"4.67.3",[56],{"id":609,"slug":610,"identity":611,"label":612,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":613,"versions":615,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":617},"package:pypi:aiohappyeyeballs","aiohappyeyeballs-ea4657b8","pypi:aiohappyeyeballs","aiohappyeyeballs",[614],"PSF-2.0",[616],"2.6.1",[56],{"id":619,"slug":620,"identity":621,"label":622,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":623,"versions":624,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":626},"package:pypi:aiosignal","aiosignal-b6794e75","pypi:aiosignal","aiosignal",[340],[625],"1.4.0",[56],{"id":628,"slug":629,"identity":630,"label":631,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":632,"versions":633,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":635},"package:pypi:annotated-doc","annotated-doc-9568e1af","pypi:annotated-doc","annotated-doc",[399],[634],"0.0.4",[56],{"id":637,"slug":638,"identity":639,"label":640,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":641,"versions":642,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":644},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[399],[643],"26.1.0",[56],{"id":646,"slug":647,"identity":648,"label":649,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":650,"versions":651,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":653},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[399],[652],"3.4.7",[56],{"id":655,"slug":656,"identity":657,"label":658,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":659,"versions":660,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":662},"package:pypi:click","click-ef97f731","pypi:click","click",[351,371],[661],"8.3.3",[56],{"id":664,"slug":665,"identity":666,"label":667,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":668,"versions":669,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":671},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[371],[670],"0.4.6",[56],{"id":673,"slug":674,"identity":675,"label":676,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":677,"versions":678,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":680},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[351],[679],"1.3.3",[56],{"id":682,"slug":683,"identity":684,"label":685,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":686,"versions":687,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":689},"package:pypi:cuda-bindings","cuda-bindings-63e94baa","pypi:cuda-bindings","cuda-bindings",[371],[688],"13.2.0",[56],{"id":691,"slug":692,"identity":693,"label":694,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":695,"versions":696,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":698},"package:pypi:cuda-pathfinder","cuda-pathfinder-6d2ddb13","pypi:cuda-pathfinder","cuda-pathfinder",[340],[697],"1.5.4",[56],{"id":700,"slug":701,"identity":702,"label":703,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":704,"versions":705,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":707},"package:pypi:cuda-toolkit","cuda-toolkit-96ffd01e","pypi:cuda-toolkit","cuda-toolkit",[],[706],"13.0.2",[56],{"id":709,"slug":710,"identity":711,"label":712,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":713,"versions":714,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":716},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[351],[715],"0.12.1",[56],{"id":718,"slug":719,"identity":720,"label":721,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":722,"versions":723,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":725},"package:pypi:dill","dill-e2d26698","pypi:dill","dill",[351],[724],"0.4.1",[56],{"id":727,"slug":728,"identity":729,"label":730,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":731,"versions":732,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":733},"package:pypi:frozenlist","frozenlist-110237da","pypi:frozenlist","frozenlist",[340],[382],[56],{"id":735,"slug":736,"identity":737,"label":738,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":739,"versions":740,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":742},"package:pypi:gradio-client","gradio-client-f28a3144","pypi:gradio-client","gradio-client",[340],[741],"2.5.0",[56],{"id":744,"slug":745,"identity":746,"label":747,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":748,"versions":749,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":751},"package:pypi:hf-xet","hf-xet-732ec6c8","pypi:hf-xet","hf-xet",[340],[750],"1.5.0",[56],{"id":753,"slug":754,"identity":755,"label":756,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":757,"versions":758,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":760},"package:pypi:httpcore","httpcore-ba6ae671","pypi:httpcore","httpcore",[351],[759],"1.0.9",[56],{"id":762,"slug":763,"identity":764,"label":765,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":766,"versions":767,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":769},"package:pypi:httptools","httptools-b6cca685","pypi:httptools","httptools",[399],[768],"0.7.1",[56],{"id":771,"slug":772,"identity":773,"label":774,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":775,"versions":776,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":778},"package:pypi:httpx","httpx-a512a166","pypi:httpx","httpx",[351],[777],"0.28.1",[56],{"id":780,"slug":781,"identity":782,"label":783,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":784,"versions":785,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":787},"package:pypi:huggingface-hub","huggingface-hub-443ec6ef","pypi:huggingface-hub","huggingface-hub",[340],[786],"1.14.0",[56],{"id":789,"slug":790,"identity":791,"label":792,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":793,"versions":794,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":796},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[351],[795],"1.5.3",[56],{"id":798,"slug":799,"identity":800,"label":801,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":802,"versions":803,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":804},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[371],[750],[56],{"id":806,"slug":807,"identity":808,"label":809,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":810,"versions":811,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":813},"package:pypi:markdown-it-py","markdown-it-py-27073f5e","pypi:markdown-it-py","markdown-it-py",[399],[812],"4.2.0",[56],{"id":815,"slug":816,"identity":817,"label":818,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":819,"versions":820,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":822},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[351],[821],"3.0.3",[56],{"id":824,"slug":825,"identity":826,"label":827,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":828,"versions":829,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":831},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[371],[830],"3.10.9",[56],{"id":833,"slug":834,"identity":835,"label":836,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":837,"versions":838,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":840},"package:pypi:mdurl","mdurl-e6f5f075","pypi:mdurl","mdurl",[399],[839],"0.1.2",[56],{"id":842,"slug":843,"identity":844,"label":845,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":846,"versions":847,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":849},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[351],[848],"1.3.0",[56],{"id":851,"slug":852,"identity":853,"label":854,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":855,"versions":856,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":858},"package:pypi:multiprocess","multiprocess-9b2083dd","pypi:multiprocess","multiprocess",[351],[857],"0.70.19",[56],{"id":860,"slug":861,"identity":862,"label":863,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":864,"versions":865,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":867},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[351,371],[866],"3.6.1",[56],{"id":869,"slug":870,"identity":871,"label":872,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":873,"versions":875,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":877},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[874,371],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[876],"2.4.4",[56],{"id":879,"slug":880,"identity":881,"label":882,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":883,"versions":884,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":886},"package:pypi:nvidia-cublas","nvidia-cublas-6a0535be","pypi:nvidia-cublas","nvidia-cublas",[371],[885],"13.1.0.3",[56],{"id":888,"slug":889,"identity":890,"label":891,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":892,"versions":893,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":895},"package:pypi:nvidia-cuda-cupti","nvidia-cuda-cupti-28886b51","pypi:nvidia-cuda-cupti","nvidia-cuda-cupti",[371],[894],"13.0.85",[56],{"id":897,"slug":898,"identity":899,"label":900,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":901,"versions":902,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":904},"package:pypi:nvidia-cuda-nvrtc","nvidia-cuda-nvrtc-79a057fb","pypi:nvidia-cuda-nvrtc","nvidia-cuda-nvrtc",[371],[903],"13.0.88",[56],{"id":906,"slug":907,"identity":908,"label":909,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":910,"versions":911,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":913},"package:pypi:nvidia-cuda-runtime","nvidia-cuda-runtime-55699b1c","pypi:nvidia-cuda-runtime","nvidia-cuda-runtime",[371],[912],"13.0.96",[56],{"id":915,"slug":916,"identity":917,"label":918,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":919,"versions":920,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":922},"package:pypi:nvidia-cudnn-cu13","nvidia-cudnn-cu13-2486f81c","pypi:nvidia-cudnn-cu13","nvidia-cudnn-cu13",[371],[921],"9.19.0.56",[56],{"id":924,"slug":925,"identity":926,"label":927,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":928,"versions":929,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":931},"package:pypi:nvidia-cufft","nvidia-cufft-b2cd0527","pypi:nvidia-cufft","nvidia-cufft",[371],[930],"12.0.0.61",[56],{"id":933,"slug":934,"identity":935,"label":936,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":937,"versions":938,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":940},"package:pypi:nvidia-cufile","nvidia-cufile-52c06111","pypi:nvidia-cufile","nvidia-cufile",[371],[939],"1.15.1.6",[56],{"id":942,"slug":943,"identity":944,"label":945,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":946,"versions":947,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":949},"package:pypi:nvidia-curand","nvidia-curand-05859d58","pypi:nvidia-curand","nvidia-curand",[371],[948],"10.4.0.35",[56],{"id":951,"slug":952,"identity":953,"label":954,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":955,"versions":956,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":958},"package:pypi:nvidia-cusolver","nvidia-cusolver-6f33f83d","pypi:nvidia-cusolver","nvidia-cusolver",[371],[957],"12.0.4.66",[56],{"id":960,"slug":961,"identity":962,"label":963,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":964,"versions":965,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":967},"package:pypi:nvidia-cusparse","nvidia-cusparse-6ffaf037","pypi:nvidia-cusparse","nvidia-cusparse",[371],[966],"12.6.3.3",[56],{"id":969,"slug":970,"identity":971,"label":972,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":973,"versions":974,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":976},"package:pypi:nvidia-cusparselt-cu13","nvidia-cusparselt-cu13-bf1c94c0","pypi:nvidia-cusparselt-cu13","nvidia-cusparselt-cu13",[371],[975],"0.8.0",[56],{"id":978,"slug":979,"identity":980,"label":981,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":982,"versions":983,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":985},"package:pypi:nvidia-nccl-cu13","nvidia-nccl-cu13-e883df84","pypi:nvidia-nccl-cu13","nvidia-nccl-cu13",[371],[984],"2.28.9",[56],{"id":987,"slug":988,"identity":989,"label":990,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":991,"versions":992,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":993},"package:pypi:nvidia-nvjitlink","nvidia-nvjitlink-c5d1771c","pypi:nvidia-nvjitlink","nvidia-nvjitlink",[371],[903],[56],{"id":995,"slug":996,"identity":997,"label":998,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":999,"versions":1000,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1002},"package:pypi:nvidia-nvshmem-cu13","nvidia-nvshmem-cu13-8f04166d","pypi:nvidia-nvshmem-cu13","nvidia-nvshmem-cu13",[371],[1001],"3.4.5",[56],{"id":1004,"slug":1005,"identity":1006,"label":1007,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1008,"versions":1009,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1010},"package:pypi:nvidia-nvtx","nvidia-nvtx-2bf32610","pypi:nvidia-nvtx","nvidia-nvtx",[340],[894],[56],{"id":1012,"slug":1013,"identity":1014,"label":1015,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1016,"versions":1018,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1020},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[1017,371],"Apache-2.0 OR BSD-2-Clause",[1019],"26.2",[56],{"id":1022,"slug":1023,"identity":1024,"label":1025,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1026,"versions":1027,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1028},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[351,371],[821],[56],{"id":1030,"slug":1031,"identity":1032,"label":1033,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1034,"versions":1035,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1037},"package:pypi:polars","polars-f649ebed","pypi:polars","polars",[399],[1036],"1.40.1",[56],{"id":1039,"slug":1040,"identity":1041,"label":1042,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1043,"versions":1044,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1045},"package:pypi:polars-runtime-32","polars-runtime-32-7674b461","pypi:polars-runtime-32","polars-runtime-32",[399],[1036],[56],{"id":1047,"slug":1048,"identity":1049,"label":1050,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1051,"versions":1052,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1054},"package:pypi:propcache","propcache-1fcd6be4","pypi:propcache","propcache",[340],[1053],"0.5.2",[56],{"id":1056,"slug":1057,"identity":1058,"label":1059,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1060,"versions":1061,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1063},"package:pypi:psutil","psutil-840b9a74","pypi:psutil","psutil",[351],[1062],"7.2.2",[56],{"id":1065,"slug":1066,"identity":1067,"label":1068,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1069,"versions":1070,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1072},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[399],[1071],"3.3.2",[56],{"id":1074,"slug":1075,"identity":1076,"label":1077,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1078,"versions":1079,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1081},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[399],[1080],"3.7.2",[56],{"id":1083,"slug":1084,"identity":1085,"label":1086,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1087,"versions":1088,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1090},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[371],[1089],"2.9.0.post0",[56],{"id":1092,"slug":1093,"identity":1094,"label":1095,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1096,"versions":1097,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1099},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[399],[1098],"6.0.3",[56],{"id":1101,"slug":1102,"identity":1103,"label":1104,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1105,"versions":1107,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1109},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[340,1106],"Apache-2.0 AND CNRI-Python",[1108],"2026.5.9",[56],{"id":1111,"slug":1112,"identity":1113,"label":1114,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1115,"versions":1116,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1118},"package:pypi:rich","rich-23b343f7","pypi:rich","rich",[399],[1117],"15.0.0",[56],{"id":1120,"slug":1121,"identity":1122,"label":1123,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1124,"versions":1125,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1127},"package:pypi:safetensors","safetensors-2a32c77a","pypi:safetensors","safetensors",[371],[1126],"0.7.0",[56],{"id":1129,"slug":1130,"identity":1131,"label":1132,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1133,"versions":1134,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1136},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[371],[1135],"1.17.1",[56],{"id":1138,"slug":1139,"identity":1140,"label":1141,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1142,"versions":1144,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1145},"package:pypi:shellingham","shellingham-fceabe5b","pypi:shellingham","shellingham",[1143],"ISC",[697],[56],{"id":1147,"slug":1148,"identity":1149,"label":1150,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1151,"versions":1152,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1154},"package:pypi:six","six-3c3888bd","pypi:six","six",[399],[1153],"1.17.0",[56],{"id":1156,"slug":1157,"identity":1158,"label":1159,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1160,"versions":1161,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1162},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[351,399,371],[786],[56],{"id":1164,"slug":1165,"identity":1166,"label":1167,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1168,"versions":1169,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1171},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[351],[1170],"3.6.0",[56],{"id":1173,"slug":1174,"identity":1175,"label":1176,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1177,"versions":1178,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1180},"package:pypi:trackio","trackio-de70160f","pypi:trackio","trackio",[399],[1179],"0.25.1",[56],{"id":1182,"slug":1183,"identity":1184,"label":1185,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1186,"versions":1187,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1188},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[399],[1170],[56],{"id":1190,"slug":1191,"identity":1192,"label":1193,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1194,"versions":1195,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1196},"package:pypi:typer","typer-b291ff1c","pypi:typer","typer",[399],[1179],[56],{"id":72,"slug":73,"identity":1198,"label":74,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1199,"versions":1200,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1202},"pypi:typing-extensions",[614,371],[1201],"4.15.0",[56],{"id":1204,"slug":1205,"identity":1206,"label":1207,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1208,"versions":1209,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1211},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[340],[1210],"2026.2",[56],{"id":1213,"slug":1214,"identity":1215,"label":1216,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1217,"versions":1218,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1220},"package:pypi:uvicorn","uvicorn-07c7a595","pypi:uvicorn","uvicorn",[351],[1219],"0.46.0",[56],{"id":1222,"slug":1223,"identity":1224,"label":1225,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1226,"versions":1227,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1229},"package:pypi:uvloop","uvloop-7921eb0f","pypi:uvloop","uvloop",[399],[1228],"0.22.1",[56],{"id":1231,"slug":1232,"identity":1233,"label":1234,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1235,"versions":1236,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1238},"package:pypi:watchfiles","watchfiles-d200b8ce","pypi:watchfiles","watchfiles",[399],[1237],"1.1.1",[56],{"id":1240,"slug":1241,"identity":1242,"label":1243,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1244,"versions":1245,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1247},"package:pypi:websockets","websockets-047236a0","pypi:websockets","websockets",[351],[1246],"16.0",[56],{"id":1249,"slug":1250,"identity":1251,"label":1252,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1253,"versions":1254,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1256},"package:pypi:xxhash","xxhash-908d556a","pypi:xxhash","xxhash",[585,371],[1255],"3.7.0",[56],{"id":1258,"slug":1259,"identity":1260,"label":1261,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1262,"versions":1263,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1265},"package:pypi:yarl","yarl-05cd1b35","pypi:yarl","yarl",[340],[1264],"1.23.0",[56],[1267,1306,1342,1366,1388,1412,1456,1490,1523,1557,1600,1625,1661,1683,1726,1766,1792,1818,1844,1867,1894,1919,1941,1967,1988,2008,2044,2062,2086,2110,2136,2165,2204,2230,2255,2284,2312,2335,2362,2385,2423,2460,2484,2502,2526,2549,2570,2599,2629,2679,2706,2725,2751,2779,2800,2823,2849,2876,2896,2919,2941,2964,3000,3026,3049,3070,3102,3126,3158,3181,3208,3227,3278,3315,3347,3369,3388,3411,3436,3460,3482,3520,3546,3573,3593,3623,3643,3663,3688,3720,3742,3797,3820,3852,3879,3899,3930,3951,3984,4009,4030,4050,4089,4113,4141,4164,4187,4206,4231,4255,4288,4313,4338,4365,4386,4410,4433,4461,4482,4516,4550,4572,4595,4615,4650,4680,4701,4723,4755,4776,4799,4826,4851,4872,4901,4925,4944,4965,4995,5023,5046,5071,5094,5117,5139,5160,5183,5205,5229,5256,5281,5305,5326,5350,5371,5397,5419,5446,5467,5487,5520,5547,5574,5601,5629,5656,5678,5700,5730,5764,5785,5807,5831,5854,5882,5909,5938,5956,5980,6003,6033,6055,6107,6130,6156,6190,6215,6247,6266,6294,6313,6340,6363,6388,6409,6435,6465,6485,6502,6521,6538,6559,6576,6591,6608,6623,6640,6657,6674,6687,6700,6713,6726,6739,6752,6765,6778],{"id":106,"slug":1268,"dossier":90,"summary":1269,"aliases":1270,"sourceIds":1273,"published":1274,"modified":1275,"checkedAt":7,"severity":1276,"references":1280,"versionKeys":1294,"packageCount":32,"repositoryCount":1305},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[1271,1272],"BIT-pillow-2026-112390","CVE-2026-112390",[106],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[1277],{"type":1278,"score":1279},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1281,1284,1287,1289,1292],{"type":1282,"url":1283},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1285,"url":1286},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1282,"url":1288},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1290,"url":1291},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1282,"url":1293},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",19,{"id":107,"slug":1307,"dossier":47,"summary":1308,"aliases":1309,"sourceIds":1312,"published":1313,"modified":1314,"checkedAt":7,"severity":1315,"references":1319,"versionKeys":1340,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1310,1311],"CVE-2024-39689","PYSEC-2024-230",[107,1311],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1316],{"type":1317,"score":1318},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1320,1322,1324,1327,1329,1331,1334,1336,1338],{"type":1285,"url":1321},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1285,"url":1323},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1325,"url":1326},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1290,"url":1328},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1282,"url":1330},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1332,"url":1333},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1282,"url":1335},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1285,"url":1337},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1285,"url":1339},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1341],"pypi:certifi@2024.6.2",{"id":108,"slug":1343,"dossier":90,"summary":1344,"aliases":1345,"sourceIds":1348,"published":1349,"modified":1350,"checkedAt":7,"severity":1351,"references":1354,"versionKeys":1365,"packageCount":32,"repositoryCount":1305},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1346,1347],"BIT-pillow-2026-96638","CVE-2026-96638",[108],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1352],{"type":1317,"score":1353},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1355,1357,1359,1361,1363,1364],{"type":1282,"url":1356},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1285,"url":1358},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1282,"url":1360},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1282,"url":1362},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":109,"slug":1367,"dossier":90,"summary":1368,"aliases":1369,"sourceIds":1372,"published":1373,"modified":1374,"checkedAt":7,"severity":1375,"references":1378,"versionKeys":1387,"packageCount":32,"repositoryCount":1305},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1370,1371],"BIT-pillow-2026-112391","CVE-2026-112391",[109],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1376],{"type":1278,"score":1377},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1379,1381,1383,1385,1386],{"type":1282,"url":1380},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1285,"url":1382},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1282,"url":1384},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":110,"slug":1389,"dossier":90,"summary":1390,"aliases":1391,"sourceIds":1395,"published":1396,"modified":1397,"checkedAt":7,"severity":1398,"references":1402,"versionKeys":1411,"packageCount":32,"repositoryCount":1305},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1392,1393,1394],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[110,1394],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1399,1400],{"type":1278,"score":1279},{"type":1317,"score":1401},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1403,1405,1407,1409,1410],{"type":1325,"url":1404},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1285,"url":1406},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1325,"url":1408},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":111,"slug":1413,"dossier":47,"summary":1414,"aliases":1415,"sourceIds":1418,"published":1419,"modified":1420,"checkedAt":7,"severity":1421,"references":1424,"versionKeys":1445,"packageCount":32,"repositoryCount":1455},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1416,1417],"CVE-2026-104851","PYSEC-2026-4217",[111,1417],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1422],{"type":1317,"score":1423},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1425,1427,1429,1431,1433,1435,1437,1439,1441,1443],{"type":1282,"url":1426},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1285,"url":1428},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1282,"url":1430},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1282,"url":1432},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1282,"url":1434},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1282,"url":1436},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1290,"url":1438},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1282,"url":1440},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1290,"url":1442},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1285,"url":1444},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1446,1447,1448,1449,1450,1451,1452,1453,1454],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",15,{"id":112,"slug":1457,"dossier":47,"summary":1458,"aliases":1459,"sourceIds":1462,"published":1463,"modified":1464,"checkedAt":7,"severity":1465,"references":1468,"versionKeys":1480,"packageCount":32,"repositoryCount":431},"ghsa-29pf-2h5f-8g72-1d83ebb4","HuggingFace transformers vulnerable to remote code execution",[1460,1461],"CVE-2026-4372","PYSEC-2026-2289",[112,1461],"2026-05-24T14:16:16.917Z","2026-09-10T03:50:45.254378086Z",[1466],{"type":1317,"score":1467},"CVSS:3.0\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1469,1471,1473,1475,1478],{"type":1285,"url":1470},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4372",{"type":1325,"url":1472},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fa7f8e7ff37d87d1a1a0c8cf607971c607741452f",{"type":1290,"url":1474},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers",{"type":1476,"url":1477},"EVIDENCE","https:\u002F\u002Fhuntr.com\u002Fbounties\u002F1f693a6e-6836-4b8b-a0bd-ca036fba8884",{"type":1285,"url":1479},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-29pf-2h5f-8g72",[1481,1482,1483,1484,1485,1486,1487,1488,1489],"pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6",{"id":113,"slug":1491,"dossier":47,"summary":1492,"aliases":1493,"sourceIds":1496,"published":1497,"modified":1498,"checkedAt":7,"severity":1499,"references":1502,"versionKeys":1519,"packageCount":32,"repositoryCount":470},"ghsa-2c2j-9gv5-cj73-60bc1f35","Starlette has possible denial-of-service vector when parsing large files in multipart forms",[1494,1495],"CVE-2025-54121","PYSEC-2026-1941",[113,1495],"2025-07-21T19:34:23Z","2026-09-10T03:50:25.704876348Z",[1500],{"type":1317,"score":1501},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1503,1505,1507,1509,1511,1513,1515,1517],{"type":1282,"url":1504},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-2c2j-9gv5-cj73",{"type":1285,"url":1506},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54121",{"type":1325,"url":1508},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fcommit\u002F9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1",{"type":1290,"url":1510},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette",{"type":1282,"url":1512},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fblob\u002Ffa5355442753f794965ae1af0f87f9fec1b9a3de\u002Fstarlette\u002Fdatastructures.py#L436C5-L447C14",{"type":1282,"url":1514},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fdiscussions\u002F2927#discussioncomment-13721403",{"type":1290,"url":1516},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fstarlette",{"type":1285,"url":1518},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2c2j-9gv5-cj73",[1520,1521,1522],"pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2",{"id":114,"slug":1524,"dossier":47,"summary":1525,"aliases":1526,"sourceIds":1529,"published":1530,"modified":1531,"checkedAt":7,"severity":1532,"references":1536,"versionKeys":1547,"packageCount":32,"repositoryCount":431},"ghsa-2fqr-mr3j-6wp8-5ee7c60f","aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence",[1527,1528],"CVE-2026-54279","PYSEC-2026-2112",[114,1528],"2026-06-15T20:08:51Z","2026-11-03T16:45:04.163545105Z",[1533,1534],{"type":1317,"score":1401},{"type":1278,"score":1535},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:L\u002FSI:N\u002FSA:N\u002FE:U",[1537,1539,1541,1543,1545],{"type":1285,"url":1538},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2fqr-mr3j-6wp8",{"type":1285,"url":1540},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54279",{"type":1325,"url":1542},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa329a7aacad5284f087af36103aff778746da0f2",{"type":1290,"url":1544},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp",{"type":1282,"url":1546},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Faiohttp\u002FPYSEC-2026-2112.yaml",[1548,1549,1550,1551,1552,1553,1554,1555,1556],"pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5",{"id":115,"slug":1558,"dossier":47,"summary":1559,"aliases":1560,"sourceIds":1562,"published":1563,"modified":1564,"checkedAt":7,"severity":1565,"references":1568,"versionKeys":1596,"packageCount":32,"repositoryCount":1599},"ghsa-2g87-pp6c-29x5-5aaa26fd","aiohttp: Multiple instances of excessive or unbounded memory\u002FCPU use",[1561],"CVE-2026-123817",[115],"2026-10-19T17:07:23Z","2026-11-09T21:30:07.738926065Z",[1566],{"type":1278,"score":1567},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1569,1571,1573,1575,1577,1579,1581,1583,1585,1587,1589,1591,1593,1594],{"type":1282,"url":1570},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2g87-pp6c-29x5",{"type":1282,"url":1572},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F09bcaa73ff084a0c539bbf16a0a78743acb7141f",{"type":1282,"url":1574},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0ae507423f681161efa77d20052b4054397c7fb6",{"type":1282,"url":1576},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F3d850ee9b92573c7e913821cbcb96005beb3f4df",{"type":1282,"url":1578},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F47babd8c23ca79e2bae6cc8dcb5752b61e369fc7",{"type":1282,"url":1580},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F615fec3d4f088f30d2ee72cad760152e92aa1c53",{"type":1282,"url":1582},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6963ee0befec1502b6bb7b4db6c72d044c08f4fa",{"type":1282,"url":1584},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6a4f6682817839313b04b8e5cea2b39c1a88ab4f",{"type":1282,"url":1586},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F8cfbe9abe5e11b84006a10f9bdf82bf607671dab",{"type":1282,"url":1588},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa555ab698e08e9baea7386d5b4c0761cb8956fdd",{"type":1282,"url":1590},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc6ac0e44c3c573ff9616f4a6a532992538b31e43",{"type":1282,"url":1592},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fd925a80539ffd227da1d93ab4a5bff123cc777db",{"type":1290,"url":1544},{"type":1282,"url":1595},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.4",[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],"pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3",13,{"id":116,"slug":1601,"dossier":47,"summary":1602,"aliases":1603,"sourceIds":1606,"published":1607,"modified":1608,"checkedAt":7,"severity":1609,"references":1614,"versionKeys":1624,"packageCount":32,"repositoryCount":441},"ghsa-2vrm-gr82-f7m5-5092ea0c","AIOHTTP has CRLF injection through multipart part content type header construction",[1604,1605],"CVE-2026-34514","PYSEC-2026-2096",[116,1605],"2026-04-01T21:16:59.417Z","2026-09-10T03:50:42.288164171Z",[1610,1612],{"type":1278,"score":1611},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":1613},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[1615,1617,1619,1621,1622],{"type":1325,"url":1616},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2vrm-gr82-f7m5",{"type":1285,"url":1618},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34514",{"type":1325,"url":1620},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06",{"type":1290,"url":1544},{"type":1285,"url":1623},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.13.4",[1548,1549,1550,1551,1552,1553,1554,1555],{"id":117,"slug":1626,"dossier":47,"summary":1627,"aliases":1628,"sourceIds":1631,"published":1632,"modified":1633,"checkedAt":7,"severity":1634,"references":1637,"versionKeys":1654,"packageCount":32,"repositoryCount":1660},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1629,1630],"CVE-2025-66471","PYSEC-2026-1994",[117,1630],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1635],{"type":1278,"score":1636},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1638,1640,1642,1644,1646,1648,1650,1652],{"type":1282,"url":1639},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1285,"url":1641},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1325,"url":1643},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1282,"url":1645},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1285,"url":1647},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1282,"url":1649},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1290,"url":1651},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1290,"url":1653},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1655,1656,1657,1658,1659],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":118,"slug":1662,"dossier":90,"summary":1663,"aliases":1664,"sourceIds":1667,"published":1668,"modified":1669,"checkedAt":7,"severity":1670,"references":1673,"versionKeys":1682,"packageCount":32,"repositoryCount":1305},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1665,1666],"BIT-pillow-2026-112393","CVE-2026-112393",[118],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1671],{"type":1278,"score":1672},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1674,1676,1678,1680,1681],{"type":1282,"url":1675},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1285,"url":1677},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1282,"url":1679},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":119,"slug":1684,"dossier":47,"summary":1685,"aliases":1686,"sourceIds":1690,"published":1691,"modified":1692,"checkedAt":7,"severity":1693,"references":1700,"versionKeys":1722,"packageCount":32,"repositoryCount":489},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1687,1688,1689],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[119,1689],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1694,1696,1698],{"type":1317,"score":1695},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1278,"score":1697},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1317,"score":1699},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1701,1703,1706,1708,1710,1712,1714,1716,1718,1720],{"type":1285,"url":1702},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1704,"url":1705},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1704,"url":1707},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1282,"url":1709},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1290,"url":1711},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1282,"url":1713},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1704,"url":1715},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1285,"url":1717},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1285,"url":1719},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1285,"url":1721},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1723,1724,1725],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":120,"slug":1727,"dossier":47,"summary":1728,"aliases":1729,"sourceIds":1732,"published":1733,"modified":1734,"checkedAt":7,"severity":1735,"references":1742,"versionKeys":1759,"packageCount":32,"repositoryCount":34},"ghsa-379c-qx7v-6h59-ebbf4eb1","Hugging Face Datasets folder-based builders allow path traversal through file_name metadata",[1730,1731],"CVE-2026-66007","PYSEC-2026-3716",[120,1731],"2026-07-24T15:19:07.493Z","2026-10-15T14:45:06.499774727Z",[1736,1738,1740],{"type":1317,"score":1737},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1278,"score":1739},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1278,"score":1741},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1743,1745,1747,1749,1751,1753,1755,1757],{"type":1285,"url":1744},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-66007",{"type":1704,"url":1746},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fissues\u002F8324",{"type":1325,"url":1748},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fpull\u002F8325",{"type":1325,"url":1750},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fcommit\u002Ff989ef9b4cc6c0039a7a82458eebca49e2b58b4b",{"type":1290,"url":1752},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets",{"type":1282,"url":1754},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fdatasets\u002FPYSEC-2026-3716.yaml",{"type":1325,"url":1756},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fdatasets-path-traversal-via-unsanitized-file-name-metadata",{"type":1285,"url":1758},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-379c-qx7v-6h59",[1760,1761,1762,1763,1764,1765],"pypi:datasets@3.2.0","pypi:datasets@3.5.1","pypi:datasets@3.6.0","pypi:datasets@4.3.0","pypi:datasets@4.4.1","pypi:datasets@4.8.5",{"id":121,"slug":1767,"dossier":47,"summary":1768,"aliases":1769,"sourceIds":1772,"published":1773,"modified":1774,"checkedAt":7,"severity":1775,"references":1777,"versionKeys":1791,"packageCount":32,"repositoryCount":489},"ghsa-37mw-44qp-f5jm-fb05555e","Transformers is vulnerable to ReDoS attack through its DonutProcessor class",[1770,1771],"CVE-2025-3933","PYSEC-2026-1977",[121,1771],"2025-07-11T12:30:32Z","2026-09-10T03:50:57.888142744Z",[1776],{"type":1317,"score":1501},[1778,1780,1782,1784,1785,1787,1789],{"type":1285,"url":1779},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3933",{"type":1282,"url":1781},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F37788",{"type":1282,"url":1783},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Febbe9b12dd75b69f92100d684c47f923ee262a93",{"type":1290,"url":1474},{"type":1282,"url":1786},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25282953-5827-4384-bb6f-5790d275721b",{"type":1290,"url":1788},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftransformers",{"type":1285,"url":1790},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-37mw-44qp-f5jm",[1481,1482,1483],{"id":122,"slug":1793,"dossier":47,"summary":1794,"aliases":1795,"sourceIds":1798,"published":1799,"modified":1800,"checkedAt":7,"severity":1801,"references":1804,"versionKeys":1817,"packageCount":32,"repositoryCount":1660},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1796,1797],"CVE-2026-21441","PYSEC-2026-1996",[122,1797],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1802,1803],{"type":1317,"score":1401},{"type":1278,"score":1636},[1805,1807,1809,1811,1812,1814,1815],{"type":1282,"url":1806},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1285,"url":1808},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1325,"url":1810},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1290,"url":1651},{"type":1282,"url":1813},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1290,"url":1653},{"type":1285,"url":1816},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1655,1656,1657,1658,1659],{"id":123,"slug":1819,"dossier":90,"summary":1820,"aliases":1821,"sourceIds":1825,"published":1826,"modified":1827,"checkedAt":7,"severity":1828,"references":1832,"versionKeys":1843,"packageCount":32,"repositoryCount":1305},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1822,1823,1824],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[123,1824],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1829,1831],{"type":1278,"score":1830},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":1353},[1833,1835,1837,1839,1841,1842],{"type":1285,"url":1834},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1285,"url":1836},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1704,"url":1838},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1325,"url":1840},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":124,"slug":1845,"dossier":47,"summary":1846,"aliases":1847,"sourceIds":1850,"published":1851,"modified":1852,"checkedAt":7,"severity":1853,"references":1857,"versionKeys":1866,"packageCount":32,"repositoryCount":441},"ghsa-3wq7-rqq7-wx6j-29b8d785","AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS",[1848,1849],"CVE-2026-34517","PYSEC-2026-2099",[124,1849],"2026-04-01T21:16:59.870Z","2026-09-10T03:50:42.683852324Z",[1854,1856],{"type":1278,"score":1855},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":1501},[1858,1860,1862,1864,1865],{"type":1325,"url":1859},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-3wq7-rqq7-wx6j",{"type":1285,"url":1861},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34517",{"type":1325,"url":1863},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fcbb774f38330563422ca0c413a71021d7b944145",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":125,"slug":1868,"dossier":90,"summary":1869,"aliases":1870,"sourceIds":1874,"published":1875,"modified":1876,"checkedAt":7,"severity":1877,"references":1882,"versionKeys":1893,"packageCount":32,"repositoryCount":1305},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[1871,1872,1873],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[125,1873],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[1878,1880],{"type":1278,"score":1879},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":1881},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[1883,1885,1887,1889,1891,1892],{"type":1476,"url":1884},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1285,"url":1886},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1282,"url":1888},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1325,"url":1890},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":126,"slug":1895,"dossier":47,"summary":1896,"aliases":1897,"sourceIds":1901,"published":1902,"modified":1903,"checkedAt":7,"severity":1904,"references":1906,"versionKeys":1918,"packageCount":32,"repositoryCount":104},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[1898,1899,1900],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[126,1900],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[1905],{"type":1317,"score":1401},[1907,1909,1911,1913,1915,1916],{"type":1476,"url":1908},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1285,"url":1910},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1325,"url":1912},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1282,"url":1914},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1290,"url":1291},{"type":1285,"url":1917},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":127,"slug":1920,"dossier":90,"summary":1921,"aliases":1922,"sourceIds":1925,"published":1926,"modified":1927,"checkedAt":7,"severity":1928,"references":1931,"versionKeys":1940,"packageCount":32,"repositoryCount":1305},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[1923,1924],"BIT-pillow-2026-112395","CVE-2026-112395",[127],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[1929],{"type":1317,"score":1930},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[1932,1934,1936,1938,1939],{"type":1282,"url":1933},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1285,"url":1935},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1282,"url":1937},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":128,"slug":1942,"dossier":47,"summary":1943,"aliases":1944,"sourceIds":1947,"published":1948,"modified":1949,"checkedAt":7,"severity":1950,"references":1953,"versionKeys":1966,"packageCount":32,"repositoryCount":451},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[1945,1946],"CVE-2025-50182","PYSEC-2026-1997",[128,1946],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[1951],{"type":1317,"score":1952},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1954,1956,1958,1960,1961,1963,1964],{"type":1282,"url":1955},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1285,"url":1957},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1325,"url":1959},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1290,"url":1651},{"type":1282,"url":1962},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1290,"url":1653},{"type":1285,"url":1965},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1655,1656,1657,1658],{"id":129,"slug":1968,"dossier":47,"summary":1969,"aliases":1970,"sourceIds":1972,"published":1973,"modified":1974,"checkedAt":7,"severity":1975,"references":1978,"versionKeys":1987,"packageCount":32,"repositoryCount":1599},"ghsa-494j-54xm-rwp3-eab1773e","AIOHTTP: Secure attribute not enforced for shared cookie",[1971],"CVE-2026-111063",[129],"2026-10-19T17:07:47Z","2026-10-26T15:00:05.287728271Z",[1976],{"type":1278,"score":1977},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1979,1981,1983,1985,1986],{"type":1282,"url":1980},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-494j-54xm-rwp3",{"type":1285,"url":1982},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111063",{"type":1282,"url":1984},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F999c356d61e966faffa97b06ab0d0455226d36c5",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":130,"slug":1989,"dossier":47,"summary":1990,"aliases":1991,"sourceIds":1994,"published":1995,"modified":1996,"checkedAt":7,"severity":1997,"references":2001,"versionKeys":2007,"packageCount":32,"repositoryCount":431},"ghsa-4fvr-rgm6-gqmc-c8b35c87","aiohttp: HTTP\u002F1 Pipelined Requests Queue Without Limit",[1992,1993],"CVE-2026-54273","PYSEC-2026-2107",[130,1993],"2026-06-15T20:10:32Z","2026-09-10T03:51:07.881817751Z",[1998,2000],{"type":1278,"score":1999},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":1401},[2002,2004,2006],{"type":1285,"url":2003},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-4fvr-rgm6-gqmc",{"type":1325,"url":2005},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":131,"slug":2009,"dossier":47,"summary":2010,"aliases":2011,"sourceIds":2014,"published":2015,"modified":2016,"checkedAt":7,"severity":2017,"references":2022,"versionKeys":2039,"packageCount":32,"repositoryCount":470},"ghsa-4j2p-28q2-5m79-f1478ba7","Accelerate path traversal and denial of service via sharded checkpoint weight_map entries",[2012,2013],"CVE-2026-69112","PYSEC-2026-3804",[131,2013],"2026-08-10T21:32:04Z","2026-09-10T12:25:52.792193450Z",[2018,2020],{"type":1317,"score":2019},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",{"type":1278,"score":2021},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2023,2025,2027,2029,2031,2033,2035,2037],{"type":1285,"url":2024},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69112",{"type":1282,"url":2026},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fissues\u002F4067",{"type":1282,"url":2028},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fpull\u002F4070",{"type":1282,"url":2030},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fpull\u002F4138",{"type":1290,"url":2032},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate",{"type":1282,"url":2034},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fhugging-face-accelerate-path-traversal-and-dos-via-weight-map",{"type":1290,"url":2036},"https:\u002F\u002Fpypi.org\u002Fproject\u002Faccelerate",{"type":1285,"url":2038},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4j2p-28q2-5m79",[2040,2041,2042,2043],"pypi:accelerate@1.11.0","pypi:accelerate@1.12.0","pypi:accelerate@1.13.0","pypi:accelerate@1.2.1",{"id":132,"slug":2045,"dossier":47,"summary":2046,"aliases":2047,"sourceIds":2050,"published":2051,"modified":2052,"checkedAt":7,"severity":2053,"references":2057,"versionKeys":2061,"packageCount":32,"repositoryCount":431},"ghsa-4m7w-qmgq-4wj5-f98433d3","aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections",[2048,2049],"CVE-2026-54275","PYSEC-2026-237",[132,2049],"2026-06-15T20:11:13Z","2026-09-10T03:50:48.205198252Z",[2054,2056],{"type":1278,"score":2055},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":1401},[2058,2060],{"type":1285,"url":2059},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-4m7w-qmgq-4wj5",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":133,"slug":2063,"dossier":90,"summary":2064,"aliases":2065,"sourceIds":2069,"published":2070,"modified":2071,"checkedAt":7,"severity":2072,"references":2074,"versionKeys":2085,"packageCount":32,"repositoryCount":1305},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[2066,2067,2068],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[133,2068],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[2073],{"type":1317,"score":1353},[2075,2077,2079,2081,2083,2084],{"type":1285,"url":2076},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1285,"url":2078},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1704,"url":2080},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1325,"url":2082},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":134,"slug":2087,"dossier":47,"summary":2088,"aliases":2089,"sourceIds":2093,"published":2094,"modified":2095,"checkedAt":7,"severity":2096,"references":2100,"versionKeys":2109,"packageCount":32,"repositoryCount":431},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[2090,2091,2092],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[134,2092],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[2097,2099],{"type":1317,"score":2098},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1317,"score":1401},[2101,2103,2105,2107,2108],{"type":1476,"url":2102},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1285,"url":2104},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1325,"url":2106},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1290,"url":1291},{"type":1285,"url":1293},[1299,1300,1301,1302,1303,1304],{"id":135,"slug":2111,"dossier":47,"summary":2112,"aliases":2113,"sourceIds":2116,"published":2117,"modified":2118,"checkedAt":7,"severity":2119,"references":2122,"versionKeys":2135,"packageCount":32,"repositoryCount":470},"ghsa-4w7r-h757-3r74-ca8973bc","Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer",[2114,2115],"CVE-2025-6921","PYSEC-2026-1980",[135,2115],"2025-09-23T15:31:09Z","2026-09-10T03:50:27.867584538Z",[2120],{"type":1317,"score":2121},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2123,2125,2127,2129,2130,2132,2133],{"type":1285,"url":2124},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6921",{"type":1282,"url":2126},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F47c34fba5c303576560cb29767efb452ff12b8be",{"type":1282,"url":2128},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fd37f7517972f67e3f2194c000ed0f87f064e5099",{"type":1290,"url":1474},{"type":1282,"url":2131},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F287d15a7-6e7c-45d2-8c05-11e305776f1f",{"type":1290,"url":1788},{"type":1285,"url":2134},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4w7r-h757-3r74",[1481,1482,1483,1484],{"id":136,"slug":2137,"dossier":47,"summary":2138,"aliases":2139,"sourceIds":2143,"published":2144,"modified":2145,"checkedAt":7,"severity":2146,"references":2149,"versionKeys":2164,"packageCount":32,"repositoryCount":104},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[2140,2141,2142],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[136,2142],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[2147],{"type":1317,"score":2148},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2150,2152,2154,2156,2158,2160,2162,2163],{"type":1476,"url":2151},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1285,"url":2153},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1325,"url":2155},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1325,"url":2157},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1325,"url":2159},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1282,"url":2161},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1290,"url":1291},{"type":1285,"url":1917},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":137,"slug":2166,"dossier":47,"summary":2167,"aliases":2168,"sourceIds":2171,"published":2172,"modified":2173,"checkedAt":7,"severity":2174,"references":2177,"versionKeys":2200,"packageCount":32,"repositoryCount":2203},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[2169,2170],"CVE-2026-4539","PYSEC-2026-2987",[137,2170],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[2175,2176],{"type":1317,"score":1695},{"type":1278,"score":1697},[2178,2180,2182,2184,2186,2188,2190,2192,2194,2196,2198],{"type":1285,"url":2179},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1282,"url":2181},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1282,"url":2183},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1282,"url":2185},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1290,"url":2187},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1282,"url":2189},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1282,"url":2191},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1282,"url":2193},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1282,"url":2195},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1290,"url":2197},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1285,"url":2199},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[2201,2202],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",16,{"id":138,"slug":2205,"dossier":47,"summary":2206,"aliases":2207,"sourceIds":2211,"published":2212,"modified":2213,"checkedAt":7,"severity":2214,"references":2219,"versionKeys":2229,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[2208,2209,2210],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[138,2210],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[2215,2217],{"type":1278,"score":2216},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":2218},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2220,2222,2224,2226,2228],{"type":1285,"url":2221},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1285,"url":2223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1282,"url":2225},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1282,"url":2227},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1290,"url":1711},[1723],{"id":139,"slug":2231,"dossier":47,"summary":2232,"aliases":2233,"sourceIds":2236,"published":2237,"modified":2238,"checkedAt":7,"severity":2239,"references":2242,"versionKeys":2254,"packageCount":32,"repositoryCount":451},"ghsa-54jq-c3m8-4m76-bba4b2d3","AIOHTTP vulnerable to brute-force leak of internal static file path components",[2234,2235],"CVE-2025-69226","PYSEC-2026-1097",[139,2235],"2026-01-05T23:09:51Z","2026-09-10T03:50:32.751498447Z",[2240],{"type":1278,"score":2241},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[2243,2245,2247,2249,2250,2252],{"type":1282,"url":2244},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-54jq-c3m8-4m76",{"type":1285,"url":2246},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69226",{"type":1325,"url":2248},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Ff2a86fd5ac0383000d1715afddfa704413f0711e",{"type":1290,"url":1544},{"type":1290,"url":2251},"https:\u002F\u002Fpypi.org\u002Fproject\u002Faiohttp",{"type":1285,"url":2253},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-54jq-c3m8-4m76",[1548,1549,1550,1551,1552,1553,1554],{"id":140,"slug":2256,"dossier":47,"summary":2257,"aliases":2258,"sourceIds":2261,"published":2262,"modified":2263,"checkedAt":7,"severity":2264,"references":2266,"versionKeys":2281,"packageCount":32,"repositoryCount":451},"ghsa-54p9-h82j-f925-623d2ef6","Multidict: Reference leak in CIMultiDict\u002FMultiDict items-view union and subtraction",[2259,2260],"CVE-2026-104874","PYSEC-2026-4244",[140,2260],"2026-10-05T23:40:58Z","2026-10-15T14:56:05.601333622Z",[2265],{"type":1317,"score":1501},[2267,2269,2271,2273,2275,2277,2279],{"type":1282,"url":2268},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Fsecurity\u002Fadvisories\u002FGHSA-54p9-h82j-f925",{"type":1285,"url":2270},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104874",{"type":1282,"url":2272},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Fcommit\u002F350b4a07bf8ff851b6d7544e81b1c748bdc74c40",{"type":1290,"url":2274},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict",{"type":1282,"url":2276},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Freleases\u002Ftag\u002Fv6.9.1",{"type":1290,"url":2278},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fmultidict",{"type":1285,"url":2280},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-54p9-h82j-f925",[2282,2283],"pypi:multidict@6.7.0","pypi:multidict@6.7.1",{"id":141,"slug":2285,"dossier":47,"summary":2286,"aliases":2287,"sourceIds":2289,"published":2290,"modified":2291,"checkedAt":7,"severity":2292,"references":2295,"versionKeys":2306,"packageCount":32,"repositoryCount":2311},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[2288],"CVE-2026-112907",[141],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[2293],{"type":1317,"score":2294},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2296,2298,2300,2302,2304],{"type":1282,"url":2297},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1282,"url":2299},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1282,"url":2301},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1290,"url":2303},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1282,"url":2305},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[2307,2308,2309,2310],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":142,"slug":2313,"dossier":90,"summary":2314,"aliases":2315,"sourceIds":2319,"published":2320,"modified":2321,"checkedAt":7,"severity":2322,"references":2325,"versionKeys":2334,"packageCount":32,"repositoryCount":1305},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[2316,2317,2318],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[142,2318],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[2323,2324],{"type":1278,"score":1567},{"type":1317,"score":1401},[2326,2328,2330,2332,2333],{"type":1476,"url":2327},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1285,"url":2329},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1325,"url":2331},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":143,"slug":2336,"dossier":47,"summary":2337,"aliases":2338,"sourceIds":2341,"published":2342,"modified":2343,"checkedAt":7,"severity":2344,"references":2347,"versionKeys":2360,"packageCount":32,"repositoryCount":32},"ghsa-59g5-xgcq-4qw3-949fce0e","Denial of service (DoS) via deformation `multipart\u002Fform-data` boundary",[2339,2340],"CVE-2024-53981","PYSEC-2026-1851",[143,2340],"2024-12-02T21:37:04Z","2026-09-10T03:50:21.270678783Z",[2345,2346],{"type":1317,"score":1401},{"type":1278,"score":1567},[2348,2350,2352,2354,2356,2358],{"type":1282,"url":2349},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-59g5-xgcq-4qw3",{"type":1285,"url":2351},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-53981",{"type":1282,"url":2353},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fcommit\u002Fc4fe4d3cebc08c660e57dd709af1ffa7059b3177",{"type":1290,"url":2355},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart",{"type":1290,"url":2357},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpython-multipart",{"type":1285,"url":2359},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59g5-xgcq-4qw3",[2361],"pypi:python-multipart@0.0.9",{"id":144,"slug":2363,"dossier":47,"summary":2364,"aliases":2365,"sourceIds":2368,"published":2369,"modified":2370,"checkedAt":7,"severity":2371,"references":2373,"versionKeys":2384,"packageCount":32,"repositoryCount":470},"ghsa-59p9-h35m-wg4g-68657c65","Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer",[2366,2367],"CVE-2025-6638","PYSEC-2026-1981",[144,2367],"2025-09-12T12:30:23Z","2026-09-10T03:50:58.113501288Z",[2372],{"type":1317,"score":2121},[2374,2376,2377,2378,2379,2381,2382],{"type":1285,"url":2375},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6638",{"type":1282,"url":2126},{"type":1282,"url":2128},{"type":1290,"url":1474},{"type":1282,"url":2380},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F6a6c933f-9ce8-4ded-8b3b-2c1444c61f36",{"type":1290,"url":1788},{"type":1285,"url":2383},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59p9-h35m-wg4g",[1481,1482,1483,1484],{"id":145,"slug":2386,"dossier":47,"summary":2387,"aliases":2388,"sourceIds":2391,"published":2392,"modified":2393,"checkedAt":7,"severity":2394,"references":2397,"versionKeys":2414,"packageCount":32,"repositoryCount":2203},"ghsa-5p39-cfhj-2xmp-77a62550","AnyIO process-pool workers can block indefinitely on undrained stderr",[2389,2390],"CVE-2026-64847","PYSEC-2026-4024",[145,2390],"2026-09-18T17:17:10Z","2026-10-01T17:55:57.336188727Z",[2395],{"type":1278,"score":2396},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2398,2400,2402,2404,2406,2408,2410,2412],{"type":1282,"url":2399},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1282,"url":2401},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1207",{"type":1282,"url":2403},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002Ff1b7301c8264b0d2e8d24a5788fd29e93dea4040",{"type":1290,"url":2405},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio",{"type":1282,"url":2407},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Freleases\u002Ftag\u002F4.14.2",{"type":1290,"url":2409},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fanyio",{"type":1285,"url":2411},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1285,"url":2413},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-64847",[2415,2416,2417,2418,2419,2420,2421,2422],"pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0",{"id":146,"slug":2424,"dossier":47,"summary":2425,"aliases":2426,"sourceIds":2430,"published":2431,"modified":2432,"checkedAt":7,"severity":2433,"references":2438,"versionKeys":2455,"packageCount":32,"repositoryCount":470},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[2427,2428,2429],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[146,2429],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[2434,2436],{"type":1278,"score":2435},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1317,"score":2437},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2439,2441,2443,2445,2447,2449,2451,2453],{"type":1476,"url":2440},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1285,"url":2442},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1704,"url":2444},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1325,"url":2446},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1282,"url":2448},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1290,"url":2450},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1282,"url":2452},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1332,"url":2454},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2456,2457,2458,2459],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":147,"slug":2461,"dossier":47,"summary":2462,"aliases":2463,"sourceIds":2466,"published":2467,"modified":2468,"checkedAt":7,"severity":2469,"references":2471,"versionKeys":2480,"packageCount":32,"repositoryCount":103},"ghsa-5rvq-cxj2-64vf-5e3e7388","python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service",[2464,2465],"CVE-2026-53539","PYSEC-2026-3036",[147,2465],"2026-06-15T20:24:09Z","2026-09-10T03:50:48.426087467Z",[2470],{"type":1317,"score":1401},[2472,2474,2475,2476,2478],{"type":1282,"url":2473},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-5rvq-cxj2-64vf",{"type":1290,"url":2355},{"type":1290,"url":2357},{"type":1285,"url":2477},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5rvq-cxj2-64vf",{"type":1285,"url":2479},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53539",[2481,2482,2483,2361],"pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28",{"id":148,"slug":2485,"dossier":47,"summary":2486,"aliases":2487,"sourceIds":2489,"published":2490,"modified":2491,"checkedAt":7,"severity":2492,"references":2494,"versionKeys":2501,"packageCount":32,"repositoryCount":1599},"ghsa-5wr8-gcqf-gqf3-8b4786ad","aiohttp server lacks an initial request\u002Fheader timeout",[2488],"CVE-2026-111064",[148],"2026-10-19T17:08:04Z","2026-10-19T17:15:04.139404381Z",[2493],{"type":1278,"score":1279},[2495,2497,2499,2500],{"type":1282,"url":2496},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-5wr8-gcqf-gqf3",{"type":1282,"url":2498},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbe846822b4b3a5a54b6163e794b42dc06fba54a3",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":149,"slug":2503,"dossier":90,"summary":2504,"aliases":2505,"sourceIds":2509,"published":2510,"modified":2511,"checkedAt":7,"severity":2512,"references":2516,"versionKeys":2525,"packageCount":32,"repositoryCount":1305},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2506,2507,2508],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[149,2508],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2513,2515],{"type":1278,"score":2514},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":2218},[2517,2519,2521,2523,2524],{"type":1476,"url":2518},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1285,"url":2520},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1325,"url":2522},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":150,"slug":2527,"dossier":47,"summary":2528,"aliases":2529,"sourceIds":2533,"published":2534,"modified":2535,"checkedAt":7,"severity":2536,"references":2538,"versionKeys":2548,"packageCount":32,"repositoryCount":104},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2530,2531,2532],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[150,2532],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2537],{"type":1317,"score":1401},[2539,2541,2543,2544,2546,2547],{"type":1476,"url":2540},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1285,"url":2542},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1325,"url":1912},{"type":1282,"url":2545},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1290,"url":1291},{"type":1285,"url":1917},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":151,"slug":2550,"dossier":90,"summary":2551,"aliases":2552,"sourceIds":2555,"published":2556,"modified":2557,"checkedAt":7,"severity":2558,"references":2560,"versionKeys":2569,"packageCount":32,"repositoryCount":1305},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2553,2554],"BIT-pillow-2026-112399","CVE-2026-112399",[151],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2559],{"type":1278,"score":1567},[2561,2563,2565,2567,2568],{"type":1282,"url":2562},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1285,"url":2564},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1282,"url":2566},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":152,"slug":2571,"dossier":47,"summary":2572,"aliases":2573,"sourceIds":2577,"published":2578,"modified":2579,"checkedAt":7,"severity":2580,"references":2584,"versionKeys":2598,"packageCount":32,"repositoryCount":1599},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2574,2575,2576],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[152,2576],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2581,2582],{"type":1317,"score":1699},{"type":1278,"score":2583},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2585,2587,2589,2591,2593,2595,2596],{"type":1285,"url":2586},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1285,"url":2588},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1282,"url":2590},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1282,"url":2592},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1282,"url":2594},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1290,"url":1291},{"type":1285,"url":2597},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1298,1299,1300,1301,1302],{"id":153,"slug":2600,"dossier":47,"summary":2601,"aliases":2602,"sourceIds":2606,"published":2607,"modified":2608,"checkedAt":7,"severity":2609,"references":2612,"versionKeys":2628,"packageCount":32,"repositoryCount":104},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2603,2604,2605],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[153,2605],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2610],{"type":1278,"score":2611},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2613,2615,2617,2619,2621,2622,2624,2626],{"type":1282,"url":2614},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1285,"url":2616},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1282,"url":2618},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1282,"url":2620},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1290,"url":1291},{"type":1282,"url":2623},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1290,"url":2625},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1285,"url":2627},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":154,"slug":2630,"dossier":47,"summary":2631,"aliases":2632,"sourceIds":2637,"published":2638,"modified":2639,"checkedAt":7,"severity":2640,"references":2642,"versionKeys":2670,"packageCount":32,"repositoryCount":2678},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2633,2634,2635,2636],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[154,2636],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2641],{"type":1317,"score":1423},[2643,2645,2647,2649,2651,2653,2655,2657,2659,2661,2662,2664,2666,2668],{"type":1285,"url":2644},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1285,"url":2646},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1704,"url":2648},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1285,"url":2650},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1282,"url":2652},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1704,"url":2654},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1285,"url":2656},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1282,"url":2658},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1282,"url":2660},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1290,"url":1711},{"type":1325,"url":2663},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1285,"url":2665},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1282,"url":2667},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1282,"url":2669},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1723,1724,1725,2671,2672,2673,2674,2675,2676,2677],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":155,"slug":2680,"dossier":47,"summary":2681,"aliases":2682,"sourceIds":2685,"published":2686,"modified":2687,"checkedAt":7,"severity":2688,"references":2694,"versionKeys":2705,"packageCount":32,"repositoryCount":441},"ghsa-63hf-3vf5-4wqf-aadd9f0f","AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection\u002Fsecurity bypass",[2683,2684],"CVE-2026-34520","PYSEC-2026-2102",[155,2684],"2026-04-01T21:17:00.333Z","2026-09-10T03:50:43.255807027Z",[2689,2691,2692],{"type":1317,"score":2690},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1278,"score":1611},{"type":1278,"score":2693},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2695,2697,2699,2701,2702,2703],{"type":1325,"url":2696},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-63hf-3vf5-4wqf",{"type":1285,"url":2698},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34520",{"type":1325,"url":2700},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9370b9714a7a56003cacd31a9b4ae16eab109ba4",{"type":1290,"url":1544},{"type":1285,"url":1623},{"type":1282,"url":2704},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Faiohttp\u002FPYSEC-2026-2102.yaml",[1548,1549,1550,1551,1552,1553,1554,1555],{"id":156,"slug":2707,"dossier":47,"summary":2708,"aliases":2709,"sourceIds":2712,"published":2713,"modified":2714,"checkedAt":7,"severity":2715,"references":2718,"versionKeys":2724,"packageCount":32,"repositoryCount":431},"ghsa-63hw-fmq6-xxg2-00aac622","aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines",[2710,2711],"CVE-2026-54277","PYSEC-2026-2110",[156,2711],"2026-06-15T20:09:16Z","2026-09-10T03:50:48.460120366Z",[2716,2717],{"type":1278,"score":1999},{"type":1317,"score":1401},[2719,2721,2723],{"type":1285,"url":2720},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-63hw-fmq6-xxg2",{"type":1325,"url":2722},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F5ab61bb4cd88f19b712f12c7c9295fe262bf804d",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":157,"slug":2726,"dossier":47,"summary":2727,"aliases":2728,"sourceIds":2732,"published":2733,"modified":2734,"checkedAt":7,"severity":2735,"references":2739,"versionKeys":2750,"packageCount":32,"repositoryCount":1455},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2729,2730,2731],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[157,2731],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2736,2737],{"type":1278,"score":1977},{"type":1317,"score":2738},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2740,2742,2744,2746,2748,2749],{"type":1285,"url":2741},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1285,"url":2743},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1704,"url":2745},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1325,"url":2747},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1290,"url":1291},{"type":1285,"url":1293},[1298,1299,1300,1301,1302,1303,1304],{"id":158,"slug":2752,"dossier":90,"summary":2753,"aliases":2754,"sourceIds":2757,"published":2758,"modified":2759,"checkedAt":7,"severity":2760,"references":2764,"versionKeys":2773,"packageCount":32,"repositoryCount":2778},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2755,2756],"CVE-2026-45409","PYSEC-2026-215",[158,2756],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2761,2762],{"type":1317,"score":1501},{"type":1278,"score":2763},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2765,2767,2769,2771],{"type":1285,"url":2766},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1285,"url":2768},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1290,"url":2770},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1282,"url":2772},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2774,2775,2776,2777],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":159,"slug":2780,"dossier":90,"summary":2781,"aliases":2782,"sourceIds":2785,"published":2786,"modified":2787,"checkedAt":7,"severity":2788,"references":2790,"versionKeys":2799,"packageCount":32,"repositoryCount":1305},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2783,2784],"BIT-pillow-2026-112400","CVE-2026-112400",[159],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2789],{"type":1278,"score":1567},[2791,2793,2795,2797,2798],{"type":1282,"url":2792},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1285,"url":2794},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1282,"url":2796},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":160,"slug":2801,"dossier":47,"summary":2802,"aliases":2803,"sourceIds":2806,"published":2807,"modified":2808,"checkedAt":7,"severity":2809,"references":2811,"versionKeys":2822,"packageCount":32,"repositoryCount":451},"ghsa-69f9-5gxw-wvc2-eec14573","AIOHTTP's unicode processing of header values could cause parsing discrepancies",[2804,2805],"CVE-2025-69224","PYSEC-2026-1099",[160,2805],"2026-01-05T22:58:57Z","2026-09-10T03:49:54.440954011Z",[2810],{"type":1278,"score":1611},[2812,2814,2816,2818,2819,2820],{"type":1282,"url":2813},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-69f9-5gxw-wvc2",{"type":1285,"url":2815},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69224",{"type":1325,"url":2817},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F32677f2adfd907420c078dda6b79225c6f4ebce0",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":2821},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69f9-5gxw-wvc2",[1548,1549,1550,1551,1552,1553,1554],{"id":161,"slug":2824,"dossier":90,"summary":2825,"aliases":2826,"sourceIds":2828,"published":2829,"modified":2830,"checkedAt":7,"severity":2831,"references":2834,"versionKeys":2843,"packageCount":32,"repositoryCount":1305},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2827],"CVE-2026-112909",[161],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2832],{"type":1317,"score":2833},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2835,2837,2839,2840,2841,2842],{"type":1282,"url":2836},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1285,"url":2838},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1282,"url":2299},{"type":1282,"url":2301},{"type":1290,"url":2303},{"type":1282,"url":2305},[2844,2845,2846,2847,2848,2307,2308,2309,2310],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":162,"slug":2850,"dossier":47,"summary":2851,"aliases":2852,"sourceIds":2855,"published":2856,"modified":2857,"checkedAt":7,"severity":2858,"references":2863,"versionKeys":2875,"packageCount":32,"repositoryCount":431},"ghsa-69w3-r845-3855-1b4edc28","HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class",[2853,2854],"CVE-2026-1839","PYSEC-2026-2288",[162,2854],"2026-04-07T06:16:41.490Z","2026-09-10T03:50:43.300048881Z",[2859,2861],{"type":1317,"score":2860},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:H",{"type":1317,"score":2862},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2864,2866,2868,2869,2871,2873],{"type":1285,"url":2865},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1839",{"type":1325,"url":2867},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396",{"type":1290,"url":1474},{"type":1282,"url":2870},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Freleases\u002Ftag\u002Fv5.0.0rc3",{"type":1476,"url":2872},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c77bb97-e493-493d-9a88-c57f5c536485",{"type":1285,"url":2874},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69w3-r845-3855",[1481,1482,1483,1484,1485,1486,1487,1488,1489],{"id":163,"slug":2877,"dossier":47,"summary":2878,"aliases":2879,"sourceIds":2881,"published":2882,"modified":2883,"checkedAt":7,"severity":2884,"references":2886,"versionKeys":2895,"packageCount":32,"repositoryCount":1599},"ghsa-6cjc-53gc-5rqm-f1beb40a","AIOHTTP: Connector pool exhaustion via Max-Age overflow",[2880],"CVE-2026-111065",[163],"2026-10-20T19:57:24Z","2026-10-20T20:15:05.286053785Z",[2885],{"type":1278,"score":2763},[2887,2889,2891,2893,2894],{"type":1282,"url":2888},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6cjc-53gc-5rqm",{"type":1285,"url":2890},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111065",{"type":1282,"url":2892},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9dd8eaf4e31f1237ef2c1574a8c82a739fca5805",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":164,"slug":2897,"dossier":47,"summary":2898,"aliases":2899,"sourceIds":2902,"published":2903,"modified":2904,"checkedAt":7,"severity":2905,"references":2907,"versionKeys":2918,"packageCount":32,"repositoryCount":451},"ghsa-6jhg-hg63-jvvf-74cd77d8","AIOHTTP vulnerable to  denial of service through large payloads",[2900,2901],"CVE-2025-69228","PYSEC-2026-1100",[164,2901],"2026-01-05T23:13:14Z","2026-09-10T03:50:32.839537992Z",[2906],{"type":1278,"score":1999},[2908,2910,2912,2914,2915,2916],{"type":1282,"url":2909},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6jhg-hg63-jvvf",{"type":1285,"url":2911},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69228",{"type":1325,"url":2913},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fb7dbd35375aedbcd712cbae8ad513d56d11cce60",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":2917},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6jhg-hg63-jvvf",[1548,1549,1550,1551,1552,1553,1554],{"id":165,"slug":2920,"dossier":47,"summary":2921,"aliases":2922,"sourceIds":2925,"published":2926,"modified":2927,"checkedAt":7,"severity":2928,"references":2931,"versionKeys":2940,"packageCount":32,"repositoryCount":103},"ghsa-6jv3-5f52-599m-dd700d26","python-multipart: Semicolon treated as querystring field separator enables parameter smuggling",[2923,2924],"CVE-2026-53538","PYSEC-2026-3037",[165,2924],"2026-06-15T20:22:25Z","2026-09-10T03:51:07.925895532Z",[2929],{"type":1317,"score":2930},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2932,2934,2935,2936,2938],{"type":1282,"url":2933},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-6jv3-5f52-599m",{"type":1290,"url":2355},{"type":1290,"url":2357},{"type":1285,"url":2937},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6jv3-5f52-599m",{"type":1285,"url":2939},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53538",[2481,2482,2483,2361],{"id":166,"slug":2942,"dossier":47,"summary":2943,"aliases":2944,"sourceIds":2947,"published":2948,"modified":2949,"checkedAt":7,"severity":2950,"references":2952,"versionKeys":2963,"packageCount":32,"repositoryCount":451},"ghsa-6mq8-rvhq-8wgg-d94d738f","AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb",[2945,2946],"CVE-2025-69223","PYSEC-2026-1101",[166,2946],"2026-01-05T22:58:41Z","2026-09-10T03:50:32.830751052Z",[2951],{"type":1317,"score":1401},[2953,2955,2957,2959,2960,2961],{"type":1282,"url":2954},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6mq8-rvhq-8wgg",{"type":1285,"url":2956},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69223",{"type":1325,"url":2958},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F2b920c39002cee0ec5b402581779bbaaf7c9138a",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":2962},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6mq8-rvhq-8wgg",[1548,1549,1550,1551,1552,1553,1554],{"id":167,"slug":2965,"dossier":90,"summary":2966,"aliases":2967,"sourceIds":2969,"published":2970,"modified":2971,"checkedAt":7,"severity":2972,"references":2975,"versionKeys":2987,"packageCount":32,"repositoryCount":2999},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2968],"PYSEC-2026-4320",[167,2968],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2973],{"type":1278,"score":2974},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2976,2978,2980,2982,2983,2985],{"type":1282,"url":2977},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1282,"url":2979},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1282,"url":2981},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1290,"url":1328},{"type":1290,"url":2984},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1285,"url":2986},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2988,1341,2989,2990,2991,2992,2993,2994,2995,2996,2997,2998],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":168,"slug":3001,"dossier":47,"summary":3002,"aliases":3003,"sourceIds":3007,"published":3008,"modified":3009,"checkedAt":7,"severity":3010,"references":3012,"versionKeys":3025,"packageCount":32,"repositoryCount":104},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[3004,3005,3006],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[168,3006],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[3011],{"type":1317,"score":1401},[3013,3015,3017,3019,3021,3023,3024],{"type":1476,"url":3014},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1285,"url":3016},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1325,"url":3018},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1325,"url":3020},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1282,"url":3022},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1290,"url":1291},{"type":1285,"url":2623},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":169,"slug":3027,"dossier":47,"summary":3028,"aliases":3029,"sourceIds":3032,"published":3033,"modified":3034,"checkedAt":7,"severity":3035,"references":3037,"versionKeys":3048,"packageCount":32,"repositoryCount":32},"ghsa-6rvg-6v2m-4j46-e04ee614","Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3030,3031],"CVE-2024-12720","PYSEC-2026-1982",[169,3031],"2025-03-20T12:32:43Z","2026-08-13T20:11:58.209202163Z",[3036],{"type":1317,"score":2121},[3038,3040,3042,3043,3045,3046],{"type":1285,"url":3039},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-12720",{"type":1282,"url":3041},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fdeac971c469bcbb182c2e52da0b82fb3bf54cccf",{"type":1290,"url":1474},{"type":1282,"url":3044},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F4bed1214-7835-4252-a853-22bbad891f98",{"type":1290,"url":1788},{"type":1285,"url":3047},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6rvg-6v2m-4j46",[1481],{"id":170,"slug":3050,"dossier":90,"summary":3051,"aliases":3052,"sourceIds":3055,"published":3056,"modified":3057,"checkedAt":7,"severity":3058,"references":3060,"versionKeys":3069,"packageCount":32,"repositoryCount":1305},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[3053,3054],"BIT-pillow-2026-112401","CVE-2026-112401",[170],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[3059],{"type":1278,"score":2763},[3061,3063,3065,3067,3068],{"type":1282,"url":3062},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1285,"url":3064},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1282,"url":3066},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":171,"slug":3071,"dossier":47,"summary":3072,"aliases":3073,"sourceIds":3076,"published":3077,"modified":3078,"checkedAt":7,"severity":3079,"references":3082,"versionKeys":3095,"packageCount":32,"repositoryCount":451},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[3074,3075],"CVE-2025-66034","PYSEC-2026-1389",[171,3075],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[3080],{"type":1317,"score":3081},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[3083,3085,3087,3089,3091,3093],{"type":1282,"url":3084},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1285,"url":3086},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1282,"url":3088},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1290,"url":3090},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1290,"url":3092},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1285,"url":3094},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[3096,3097,3098,3099,3100,3101],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",{"id":172,"slug":3103,"dossier":47,"summary":3104,"aliases":3105,"sourceIds":3106,"published":3107,"modified":3108,"checkedAt":7,"severity":3109,"references":3112,"versionKeys":3125,"packageCount":32,"repositoryCount":1660},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[172],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[3110],{"type":1317,"score":3111},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3113,3115,3117,3119,3121,3122,3123],{"type":1282,"url":3114},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1282,"url":3116},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1282,"url":3118},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1282,"url":3120},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1290,"url":1291},{"type":1282,"url":1293},{"type":1282,"url":3124},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1297,1298,1299,1300,1301,1302,1303,1304],{"id":173,"slug":3127,"dossier":47,"summary":3128,"aliases":3129,"sourceIds":3132,"published":3133,"modified":3134,"checkedAt":7,"severity":3135,"references":3137,"versionKeys":3154,"packageCount":32,"repositoryCount":34},"ghsa-7f5h-v6xp-fcq8-9393173e","Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``",[3130,3131],"CVE-2025-62727","PYSEC-2026-1942",[173,3131],"2025-10-28T20:38:01Z","2026-09-10T03:50:29.490992457Z",[3136],{"type":1317,"score":1401},[3138,3140,3142,3144,3147,3149,3151,3152],{"type":1282,"url":3139},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-7f5h-v6xp-fcq8",{"type":1285,"url":3141},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-62727",{"type":1325,"url":3143},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F4ea6e22b489ec388d6004cfbca52dd5b147127c5",{"type":3145,"url":3146},"INTRODUCED","https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F69ed26a85956ef4bd0161807eb27abf49be7cd3c",{"type":1290,"url":3148},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette",{"type":1282,"url":3150},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Freleases\u002Ftag\u002F0.49.1",{"type":1290,"url":1516},{"type":1285,"url":3153},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7f5h-v6xp-fcq8",[1521,1522,3155,3156,3157],"pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0",{"id":174,"slug":3159,"dossier":90,"summary":3160,"aliases":3161,"sourceIds":3165,"published":3166,"modified":3167,"checkedAt":7,"severity":3168,"references":3171,"versionKeys":3180,"packageCount":32,"repositoryCount":1305},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[3162,3163,3164],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[174,3164],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[3169,3170],{"type":1278,"score":1567},{"type":1317,"score":1401},[3172,3174,3176,3178,3179],{"type":1325,"url":3173},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1285,"url":3175},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1325,"url":3177},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":175,"slug":3182,"dossier":47,"summary":3183,"aliases":3184,"sourceIds":3187,"published":3188,"modified":3189,"checkedAt":7,"severity":3190,"references":3193,"versionKeys":3207,"packageCount":32,"repositoryCount":2203},"ghsa-82r6-8w77-94w6-217253d8","AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing",[3185,3186],"CVE-2026-63374","PYSEC-2026-4025",[175,3186],"2026-09-18T17:17:18Z","2026-10-01T17:56:11.058322399Z",[3191],{"type":1278,"score":3192},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3194,3196,3198,3200,3201,3202,3203,3205],{"type":1282,"url":3195},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1282,"url":3197},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1208",{"type":1282,"url":3199},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002F68f58915f82d9be8109ebbbd8f5d70577d43f2ce",{"type":1290,"url":2405},{"type":1282,"url":2407},{"type":1290,"url":2409},{"type":1285,"url":3204},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1285,"url":3206},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-63374",[2415,2416,2417,2418,2419,2420,2421,2422],{"id":176,"slug":3209,"dossier":47,"summary":3210,"aliases":3211,"sourceIds":3214,"published":3215,"modified":3216,"checkedAt":7,"severity":3217,"references":3219,"versionKeys":3223,"packageCount":32,"repositoryCount":441},"ghsa-82w8-qh3p-5jfq-a05ef51e","Starlette: request.form() limits silently ignored for application\u002Fx-www-form-urlencoded enable DoS",[3212,3213],"CVE-2026-54283","PYSEC-2026-249",[176,3213],"2026-06-15T20:39:53Z","2026-09-10T03:51:08.156199030Z",[3218],{"type":1317,"score":1401},[3220,3222],{"type":1285,"url":3221},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-82w8-qh3p-5jfq",{"type":1290,"url":3148},[1520,1521,1522,3155,3156,3157,3224,3225,3226],"pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0",{"id":177,"slug":3228,"dossier":47,"summary":3229,"aliases":3230,"sourceIds":3234,"published":3235,"modified":3236,"checkedAt":7,"severity":3237,"references":3240,"versionKeys":3277,"packageCount":32,"repositoryCount":441},"ghsa-86qp-5c8j-p5mr-13e563cb","Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks",[3231,3232,3233],"CVE-2026-48710","PYSEC-2026-161","X41-2026-002",[177,3232],"2026-05-22T13:10:03Z","2026-09-10T03:51:08.121685407Z",[3238],{"type":1317,"score":3239},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[3241,3243,3245,3247,3249,3251,3253,3255,3257,3259,3260,3262,3265,3267,3269,3271,3273,3275],{"type":1285,"url":3242},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-86qp-5c8j-p5mr",{"type":1285,"url":3244},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48710",{"type":1325,"url":3246},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F764dab0dcfb9033d75442d7a359645c9f94648c6",{"type":1282,"url":3248},"https:\u002F\u002Fwww.x41-dsec.de\u002Flab\u002Fadvisories\u002Fx41-2026-002-starlette",{"type":1332,"url":3250},"https:\u002F\u002Fwww.secwest.net\u002Fstarlette",{"type":1282,"url":3252},"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-48710",{"type":1282,"url":3254},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-48710.json",{"type":1282,"url":3256},"https:\u002F\u002Fostif.org\u002Fdisclosing-the-badhost-vulnerability-in-starlette",{"type":1282,"url":3258},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstarlette\u002FPYSEC-2026-161.yaml",{"type":1290,"url":3148},{"type":1282,"url":3261},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2481742",{"type":3263,"url":3264},"DETECTION","https:\u002F\u002Fbadhost.org\u002F",{"type":1282,"url":3266},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-48710",{"type":1282,"url":3268},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:60520",{"type":1282,"url":3270},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:51357",{"type":1282,"url":3272},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:44696",{"type":1332,"url":3274},"https:\u002F\u002Fostif.org\u002Fdisclosing-the-badhost-vulnerability-in-starlette\u002F",{"type":1285,"url":3276},"https:\u002F\u002Fwww.x41-dsec.de\u002Flab\u002Fadvisories\u002Fx41-2026-002-starlette\u002F",[1520,1521,1522,3155,3156,3157,3224,3225,3226],{"id":178,"slug":3279,"dossier":47,"summary":3280,"aliases":3281,"sourceIds":3285,"published":3286,"modified":3287,"checkedAt":7,"severity":3288,"references":3292,"versionKeys":3314,"packageCount":32,"repositoryCount":451},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[3282,3283,3284],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[178,3284],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[3289,3290],{"type":1317,"score":1695},{"type":1278,"score":3291},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3293,3295,3297,3299,3301,3303,3304,3306,3308,3310,3312],{"type":1285,"url":3294},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1282,"url":3296},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1282,"url":3298},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1282,"url":3300},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1282,"url":3302},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1290,"url":1711},{"type":1282,"url":3305},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1282,"url":3307},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1282,"url":3309},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1290,"url":3311},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1285,"url":3313},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1723,1724,1725,2671,2672],{"id":179,"slug":3316,"dossier":90,"summary":3317,"aliases":3318,"sourceIds":3321,"published":3322,"modified":3323,"checkedAt":7,"severity":3324,"references":3327,"versionKeys":3344,"packageCount":32,"repositoryCount":2778},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[3319,3320],"CVE-2026-97687","PYSEC-2026-4175",[179,3320],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[3325],{"type":1278,"score":3326},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3328,3330,3332,3334,3336,3338,3339,3341,3342],{"type":1282,"url":3329},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1285,"url":3331},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1282,"url":3333},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1282,"url":3335},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1282,"url":3337},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1290,"url":1651},{"type":1282,"url":3340},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1290,"url":1653},{"type":1285,"url":3343},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1655,1656,1657,1658,1659,3345,3346],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":180,"slug":3348,"dossier":47,"summary":3349,"aliases":3350,"sourceIds":3354,"published":3355,"modified":3356,"checkedAt":7,"severity":3357,"references":3360,"versionKeys":3368,"packageCount":32,"repositoryCount":1305},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[3351,3352,3353],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[180,3353],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[3358,3359],{"type":1278,"score":2514},{"type":1317,"score":2218},[3361,3363,3365,3366,3367],{"type":1476,"url":3362},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1285,"url":3364},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1325,"url":2522},{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":181,"slug":3370,"dossier":47,"summary":3371,"aliases":3372,"sourceIds":3374,"published":3375,"modified":3376,"checkedAt":7,"severity":3377,"references":3380,"versionKeys":3387,"packageCount":32,"repositoryCount":1305},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[3373],"CVE-2026-112910",[181],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[3378],{"type":1317,"score":3379},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[3381,3383,3384,3385,3386],{"type":1282,"url":3382},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1282,"url":2299},{"type":1282,"url":2301},{"type":1290,"url":2303},{"type":1282,"url":2305},[2844,2845,2846,2847,2848,2307,2308,2309,2310],{"id":182,"slug":3389,"dossier":47,"summary":3390,"aliases":3391,"sourceIds":3395,"published":3396,"modified":3397,"checkedAt":7,"severity":3398,"references":3400,"versionKeys":3410,"packageCount":32,"repositoryCount":104},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[3392,3393,3394],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[182,3394],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[3399],{"type":1317,"score":1401},[3401,3403,3405,3406,3408,3409],{"type":1476,"url":3402},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1285,"url":3404},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1325,"url":1912},{"type":1282,"url":3407},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1290,"url":1291},{"type":1285,"url":1917},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":183,"slug":3412,"dossier":47,"summary":3413,"aliases":3414,"sourceIds":3417,"published":3418,"modified":3419,"checkedAt":7,"severity":3420,"references":3422,"versionKeys":3435,"packageCount":32,"repositoryCount":470},"ghsa-9356-575x-2w9m-908a1f8c","Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3415,3416],"CVE-2025-5197","PYSEC-2026-1983",[183,3416],"2025-08-06T12:31:20Z","2026-09-10T03:50:26.988216861Z",[3421],{"type":1317,"score":2121},[3423,3425,3427,3429,3430,3432,3433],{"type":1285,"url":3424},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-5197",{"type":1282,"url":3426},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F701caef704e356dc2f9331cc3fd5df0eccb4720a",{"type":1282,"url":3428},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F944b56000be5e9b61af8301aa340838770ad8a0b",{"type":1290,"url":1474},{"type":1282,"url":3431},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3f8b3fd0-166b-46e7-b60f-60dd9d2678bf",{"type":1290,"url":1788},{"type":1285,"url":3434},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9356-575x-2w9m",[1481,1482,1483,1484],{"id":184,"slug":3437,"dossier":47,"summary":3438,"aliases":3439,"sourceIds":3442,"published":3443,"modified":3444,"checkedAt":7,"severity":3445,"references":3448,"versionKeys":3459,"packageCount":32,"repositoryCount":470},"ghsa-9548-qrrj-x5pj-6121f213","AIOHTTP is vulnerable to HTTP Request\u002FResponse Smuggling through incorrect parsing of chunked trailer sections",[3440,3441],"CVE-2025-53643","PYSEC-2026-1104",[184,3441],"2025-07-14T19:33:31Z","2026-09-10T03:50:26.231846188Z",[3446],{"type":1278,"score":3447},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[3449,3451,3453,3455,3456,3457],{"type":1282,"url":3450},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9548-qrrj-x5pj",{"type":1285,"url":3452},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-53643",{"type":1325,"url":3454},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fe8d774f635dc6d1cd3174d0e38891da5de0e2b6a",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":3458},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9548-qrrj-x5pj",[1548,1549,1550,1551],{"id":185,"slug":3461,"dossier":47,"summary":3462,"aliases":3463,"sourceIds":3466,"published":3467,"modified":3468,"checkedAt":7,"severity":3469,"references":3472,"versionKeys":3481,"packageCount":32,"repositoryCount":441},"ghsa-966j-vmvw-g2g9-dad9a989","AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect",[3464,3465],"CVE-2026-34518","PYSEC-2026-2100",[185,3465],"2026-04-01T21:17:00.020Z","2026-09-10T03:51:01.374434696Z",[3470,3471],{"type":1317,"score":2738},{"type":1278,"score":2241},[3473,3475,3477,3479,3480],{"type":1325,"url":3474},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-966j-vmvw-g2g9",{"type":1285,"url":3476},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34518",{"type":1325,"url":3478},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F5351c980dcec7ad385730efdf4e1f4338b24fdb6",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":186,"slug":3483,"dossier":47,"summary":3484,"aliases":3485,"sourceIds":3488,"published":3489,"modified":3490,"checkedAt":7,"severity":3491,"references":3494,"versionKeys":3517,"packageCount":32,"repositoryCount":451},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[3486,3487],"CVE-2024-47081","PYSEC-2026-1872",[186,3487],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[3492],{"type":1317,"score":3493},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3495,3497,3499,3501,3503,3505,3507,3509,3511,3513,3515],{"type":1282,"url":3496},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1285,"url":3498},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1282,"url":3500},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1325,"url":3502},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1285,"url":3504},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1290,"url":3506},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1282,"url":3508},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1282,"url":3510},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1290,"url":3512},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1282,"url":3514},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1282,"url":3516},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3518,3519],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":187,"slug":3521,"dossier":47,"summary":3522,"aliases":3523,"sourceIds":3527,"published":3528,"modified":3529,"checkedAt":7,"severity":3530,"references":3532,"versionKeys":3545,"packageCount":32,"repositoryCount":104},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3524,3525,3526],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[187,3526],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3531],{"type":1317,"score":1401},[3533,3535,3537,3539,3541,3543,3544],{"type":1476,"url":3534},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1285,"url":3536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1325,"url":3538},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1325,"url":3540},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1282,"url":3542},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1290,"url":1291},{"type":1285,"url":2623},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":188,"slug":3547,"dossier":47,"summary":3548,"aliases":3549,"sourceIds":3553,"published":3554,"modified":3555,"checkedAt":7,"severity":3556,"references":3561,"versionKeys":3572,"packageCount":32,"repositoryCount":1305},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3550,3551,3552],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[188,3552],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3557,3559],{"type":1278,"score":3558},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":3560},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3562,3564,3566,3568,3570,3571],{"type":1285,"url":3563},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1285,"url":3565},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1704,"url":3567},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1325,"url":3569},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":189,"slug":3574,"dossier":47,"summary":3575,"aliases":3576,"sourceIds":3578,"published":3579,"modified":3580,"checkedAt":7,"severity":3581,"references":3583,"versionKeys":3592,"packageCount":32,"repositoryCount":2311},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3577],"CVE-2026-112913",[189],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3582],{"type":1317,"score":1695},[3584,3586,3588,3590,3591],{"type":1282,"url":3585},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1282,"url":3587},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1282,"url":3589},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1290,"url":2303},{"type":1282,"url":2305},[2307,2308,2309,2310],{"id":190,"slug":3594,"dossier":47,"summary":3595,"aliases":3596,"sourceIds":3599,"published":3600,"modified":3601,"checkedAt":7,"severity":3602,"references":3605,"versionKeys":3622,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3597,3598],"CVE-2024-35195","PYSEC-2026-1873",[190,3598],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3603],{"type":1317,"score":3604},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3606,3608,3610,3612,3614,3615,3617,3619,3620],{"type":1282,"url":3607},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1285,"url":3609},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1282,"url":3611},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1325,"url":3613},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1290,"url":3506},{"type":1282,"url":3616},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1282,"url":3618},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1290,"url":3512},{"type":1285,"url":3621},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3518],{"id":191,"slug":3624,"dossier":47,"summary":3625,"aliases":3626,"sourceIds":3629,"published":3630,"modified":3631,"checkedAt":7,"severity":3632,"references":3636,"versionKeys":3642,"packageCount":32,"repositoryCount":431},"ghsa-9x8q-7h8h-wcw9-af94166e","aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect",[3627,3628],"CVE-2026-54280","PYSEC-2026-2113",[191,3628],"2026-06-15T20:10:44Z","2026-09-10T03:50:55.382836820Z",[3633,3635],{"type":1278,"score":3634},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":1401},[3637,3639,3641],{"type":1285,"url":3638},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9x8q-7h8h-wcw9",{"type":1325,"url":3640},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa762eda5242f6490d6ba667533193f8b473ad587",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":192,"slug":3644,"dossier":47,"summary":3645,"aliases":3646,"sourceIds":3648,"published":3649,"modified":3650,"checkedAt":7,"severity":3651,"references":3653,"versionKeys":3662,"packageCount":32,"repositoryCount":1599},"ghsa-9xw5-w5jj-pvcg-5b93a500","AIOHTTP: File descriptor exhaustion in multipart requests",[3647],"CVE-2026-111066",[192],"2026-10-20T19:52:09Z","2026-10-20T20:00:04.692319554Z",[3652],{"type":1278,"score":1279},[3654,3656,3658,3660,3661],{"type":1282,"url":3655},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9xw5-w5jj-pvcg",{"type":1285,"url":3657},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111066",{"type":1282,"url":3659},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F2d94633b7f1b4c1ba07d647b629a8440652b2d09",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":193,"slug":3664,"dossier":47,"summary":3665,"aliases":3666,"sourceIds":3669,"published":3670,"modified":3671,"checkedAt":7,"severity":3672,"references":3676,"versionKeys":3687,"packageCount":32,"repositoryCount":441},"ghsa-c427-h43c-vf67-fa5b38aa","AIOHTTP accepts duplicate Host headers",[3667,3668],"CVE-2026-34525","PYSEC-2026-2103",[193,3668],"2026-04-01T21:17:00.490Z","2026-09-10T03:51:01.505705751Z",[3673,3675],{"type":1278,"score":3674},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:L\u002FSI:L\u002FSA:N",{"type":1317,"score":1613},[3677,3679,3681,3683,3685,3686],{"type":1325,"url":3678},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-c427-h43c-vf67",{"type":1285,"url":3680},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34525",{"type":1325,"url":3682},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F53e2e6fc58b89c6185be7820bd2c9f40216b3000",{"type":1325,"url":3684},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fe00ca3cca92c465c7913c4beb763a72da9ed8349",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":194,"slug":3689,"dossier":47,"summary":3690,"aliases":3691,"sourceIds":3695,"published":3696,"modified":3697,"checkedAt":7,"severity":3698,"references":3703,"versionKeys":3719,"packageCount":32,"repositoryCount":499},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3692,3693,3694],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[194],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3699,3701],{"type":1317,"score":3700},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1278,"score":3702},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3704,3706,3708,3710,3711,3713,3715,3717],{"type":1285,"url":3705},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1282,"url":3707},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1282,"url":3709},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1290,"url":1711},{"type":1282,"url":3712},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1282,"url":3714},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1282,"url":3716},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1282,"url":3718},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1723,1724],{"id":195,"slug":3721,"dossier":47,"summary":3722,"aliases":3723,"sourceIds":3726,"published":3727,"modified":3728,"checkedAt":7,"severity":3729,"references":3732,"versionKeys":3741,"packageCount":32,"repositoryCount":1305},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3724,3725],"BIT-pillow-2026-112404","CVE-2026-112404",[195],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3730],{"type":1278,"score":3731},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3733,3735,3737,3739,3740],{"type":1282,"url":3734},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1285,"url":3736},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1282,"url":3738},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":196,"slug":3743,"dossier":47,"summary":3744,"aliases":3745,"sourceIds":3749,"published":3750,"modified":3751,"checkedAt":7,"severity":3752,"references":3756,"versionKeys":3796,"packageCount":32,"repositoryCount":2203},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3746,3747,3748],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[196,3748],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3753,3755],{"type":1278,"score":3754},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":1401},[3757,3759,3761,3763,3765,3767,3768,3770,3772,3774,3776,3778,3780,3782,3784,3786,3788,3790,3792,3794],{"type":1282,"url":3758},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1285,"url":3760},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1282,"url":3762},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1282,"url":3764},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1282,"url":3766},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1290,"url":1291},{"type":1282,"url":3769},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1282,"url":3771},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1282,"url":3773},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1285,"url":3775},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1285,"url":3777},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1285,"url":3779},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1285,"url":3781},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1285,"url":3783},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1285,"url":3785},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1285,"url":3787},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1285,"url":3789},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1285,"url":3791},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1285,"url":3793},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1285,"url":3795},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1295,1296,1297,1298,1299,1300,1301],{"id":197,"slug":3798,"dossier":47,"summary":3799,"aliases":3800,"sourceIds":3804,"published":3805,"modified":3806,"checkedAt":7,"severity":3807,"references":3810,"versionKeys":3819,"packageCount":32,"repositoryCount":103},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3801,3802,3803],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[197,3803],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3808,3809],{"type":1278,"score":1567},{"type":1317,"score":1401},[3811,3813,3815,3817,3818],{"type":1476,"url":3812},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1285,"url":3814},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1325,"url":3816},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1290,"url":1291},{"type":1285,"url":1293},[1300,1301,1302,1303,1304],{"id":198,"slug":3821,"dossier":47,"summary":3822,"aliases":3823,"sourceIds":3826,"published":3827,"modified":3828,"checkedAt":7,"severity":3829,"references":3832,"versionKeys":3849,"packageCount":32,"repositoryCount":499},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3824,3825],"CVE-2025-27516","PYSEC-2026-1471",[198,3825],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3830],{"type":1278,"score":3831},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3833,3835,3837,3839,3841,3843,3845,3847],{"type":1282,"url":3834},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1285,"url":3836},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1325,"url":3838},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1290,"url":3840},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1282,"url":3842},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1282,"url":3844},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1290,"url":3846},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1285,"url":3848},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3850,3851],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":199,"slug":3853,"dossier":47,"summary":3854,"aliases":3855,"sourceIds":3858,"published":3859,"modified":3860,"checkedAt":7,"severity":3861,"references":3863,"versionKeys":3878,"packageCount":32,"repositoryCount":42},"ghsa-cq5v-8q36-5273-b5e8d025","AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)",[3856,3857],"CVE-2026-69244","PYSEC-2026-3545",[199,3857],"2026-08-03T20:51:13Z","2026-09-10T03:51:13.983479281Z",[3862],{"type":1278,"score":1830},[3864,3866,3868,3870,3871,3873,3874,3876],{"type":1282,"url":3865},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-cq5v-8q36-5273",{"type":1282,"url":3867},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F13223",{"type":1282,"url":3869},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F49f65d54150397892f7bcc4aae887767d51c322d",{"type":1290,"url":1544},{"type":1282,"url":3872},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.3",{"type":1290,"url":2251},{"type":1285,"url":3875},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cq5v-8q36-5273",{"type":1285,"url":3877},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69244",[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597],{"id":200,"slug":3880,"dossier":47,"summary":3881,"aliases":3882,"sourceIds":3884,"published":3885,"modified":3886,"checkedAt":7,"severity":3887,"references":3889,"versionKeys":3898,"packageCount":32,"repositoryCount":2311},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3883],"CVE-2026-112915",[200],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3888],{"type":1317,"score":1699},[3890,3892,3894,3895,3896,3897],{"type":1282,"url":3891},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1285,"url":3893},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1282,"url":3587},{"type":1282,"url":3589},{"type":1290,"url":2303},{"type":1282,"url":2305},[2307,2308,2309,2310],{"id":201,"slug":3900,"dossier":47,"summary":3901,"aliases":3902,"sourceIds":3906,"published":3907,"modified":3908,"checkedAt":7,"severity":3909,"references":3913,"versionKeys":3929,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3903,3904,3905],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[201,3905],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3910,3911],{"type":1317,"score":1423},{"type":1278,"score":3912},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3914,3916,3918,3920,3921,3923,3925,3927],{"type":1285,"url":3915},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1282,"url":3917},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1282,"url":3919},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1290,"url":2450},{"type":1282,"url":3922},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1282,"url":3924},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1290,"url":3926},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1285,"url":3928},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2456],{"id":202,"slug":3931,"dossier":47,"summary":3932,"aliases":3933,"sourceIds":3936,"published":3937,"modified":3938,"checkedAt":7,"severity":3939,"references":3941,"versionKeys":3950,"packageCount":32,"repositoryCount":1305},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[3934,3935],"BIT-pillow-2026-112406","CVE-2026-112406",[202],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[3940],{"type":1278,"score":1567},[3942,3944,3946,3948,3949],{"type":1282,"url":3943},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1285,"url":3945},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1282,"url":3947},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":203,"slug":3952,"dossier":47,"summary":3953,"aliases":3954,"sourceIds":3958,"published":3959,"modified":3960,"checkedAt":7,"severity":3961,"references":3965,"versionKeys":3983,"packageCount":32,"repositoryCount":499},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[3955,3956,3957],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[203],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[3962,3963],{"type":1317,"score":3379},{"type":1278,"score":3964},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3966,3968,3970,3972,3974,3976,3977,3979,3981],{"type":1285,"url":3967},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1282,"url":3969},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1282,"url":3971},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1282,"url":3973},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1282,"url":3975},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1290,"url":1711},{"type":1282,"url":3978},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1282,"url":3980},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1282,"url":3982},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1723,1724],{"id":204,"slug":3985,"dossier":47,"summary":3986,"aliases":3987,"sourceIds":3990,"published":3991,"modified":3992,"checkedAt":7,"severity":3993,"references":3997,"versionKeys":4008,"packageCount":32,"repositoryCount":32},"ghsa-f96h-pmfr-66vw-6763f20e","Starlette Denial of service (DoS) via multipart\u002Fform-data",[3988,3989],"CVE-2024-47874","PYSEC-2026-1943",[204,3989],"2024-10-15T18:12:57Z","2026-09-10T03:50:19.756287586Z",[3994,3996],{"type":1317,"score":3995},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:N",{"type":1278,"score":1567},[3998,4000,4002,4004,4005,4006],{"type":1282,"url":3999},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-f96h-pmfr-66vw",{"type":1285,"url":4001},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47874",{"type":1325,"url":4003},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fcommit\u002Ffd038f3070c302bff17ef7d173dbb0b007617733",{"type":1290,"url":1510},{"type":1290,"url":1516},{"type":1285,"url":4007},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-f96h-pmfr-66vw",[1520],{"id":205,"slug":4010,"dossier":47,"summary":4011,"aliases":4012,"sourceIds":4014,"published":4015,"modified":4016,"checkedAt":7,"severity":4017,"references":4020,"versionKeys":4029,"packageCount":32,"repositoryCount":1599},"ghsa-f9xw-jh8m-3mwq-43205cf6","AIOHTTP: Absolute-form request targets can spoof Request.scheme",[4013],"CVE-2026-111748",[205],"2026-10-20T20:01:40Z","2026-10-20T20:15:05.218624757Z",[4018],{"type":1278,"score":4019},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4021,4023,4025,4027,4028],{"type":1282,"url":4022},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-f9xw-jh8m-3mwq",{"type":1285,"url":4024},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111748",{"type":1282,"url":4026},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6d4e7b01f9b951aa084a75d7356e907d4ee80411",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":206,"slug":4031,"dossier":47,"summary":4032,"aliases":4033,"sourceIds":4036,"published":4037,"modified":4038,"checkedAt":7,"severity":4039,"references":4041,"versionKeys":4049,"packageCount":32,"repositoryCount":1305},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[4034,4035],"BIT-pillow-2026-112891","CVE-2026-112891",[206],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[4040],{"type":1278,"score":2763},[4042,4044,4046,4047,4048],{"type":1282,"url":4043},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1285,"url":4045},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1282,"url":3066},{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":207,"slug":4051,"dossier":47,"summary":4052,"aliases":4053,"sourceIds":4056,"published":4057,"modified":4058,"checkedAt":7,"severity":4059,"references":4064,"versionKeys":4088,"packageCount":32,"repositoryCount":431},"ghsa-fgcw-684q-jj6r-9fe55ba1","huggingface\u002Ftransformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path",[4054,4055],"CVE-2026-5241","PYSEC-2026-2290",[207,4055],"2026-06-03T14:16:46.337Z","2026-09-10T03:50:49.345942449Z",[4060,4062],{"type":1317,"score":4061},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",{"type":1317,"score":4063},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[4065,4067,4069,4071,4073,4075,4077,4079,4080,4082,4084,4086],{"type":1285,"url":4066},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-5241",{"type":1325,"url":4068},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F676559d5022b74aaa0cee1cee0842b7f27c5320e",{"type":1285,"url":4070},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34456",{"type":1285,"url":4072},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1282,"url":4074},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",{"type":1282,"url":4076},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-5241",{"type":1704,"url":4078},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484384",{"type":1290,"url":1474},{"type":1282,"url":4081},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2026-2290.yaml",{"type":1476,"url":4083},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fceb3ce1a-4c45-497a-b25e-cb9a7685e619",{"type":1282,"url":4085},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-5241.json",{"type":1285,"url":4087},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fgcw-684q-jj6r",[1481,1482,1483,1484,1485,1486,1487,1488,1489],{"id":208,"slug":4090,"dossier":47,"summary":4091,"aliases":4092,"sourceIds":4095,"published":4096,"modified":4097,"checkedAt":7,"severity":4098,"references":4101,"versionKeys":4112,"packageCount":32,"repositoryCount":451},"ghsa-fh55-r93g-j68g-a231bc8e","AIOHTTP Vulnerable to Cookie Parser Warning Storm",[4093,4094],"CVE-2025-69230","PYSEC-2026-1105",[208,4094],"2026-01-05T23:13:46Z","2026-09-10T03:50:33.047685052Z",[4099],{"type":1278,"score":4100},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[4102,4104,4106,4108,4109,4110],{"type":1282,"url":4103},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-fh55-r93g-j68g",{"type":1285,"url":4105},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69230",{"type":1325,"url":4107},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F64629a0834f94e46d9881f4e99c41a137e1f3326",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":4111},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fh55-r93g-j68g",[1548,1549,1550,1551,1552,1553,1554],{"id":209,"slug":4114,"dossier":47,"summary":4115,"aliases":4116,"sourceIds":4120,"published":4121,"modified":4122,"checkedAt":7,"severity":4123,"references":4126,"versionKeys":4140,"packageCount":32,"repositoryCount":104},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[4117,4118,4119],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[209,4119],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[4124],{"type":1317,"score":4125},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[4127,4129,4131,4133,4135,4136,4137,4138],{"type":1282,"url":4128},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1285,"url":4130},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1282,"url":4132},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1282,"url":4134},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1290,"url":1291},{"type":1282,"url":2623},{"type":1290,"url":2625},{"type":1285,"url":4139},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":210,"slug":4142,"dossier":47,"summary":3028,"aliases":4143,"sourceIds":4146,"published":4147,"modified":4148,"checkedAt":7,"severity":4149,"references":4152,"versionKeys":4163,"packageCount":32,"repositoryCount":32},"ghsa-fpwr-67px-3qhx-94f30126",[4144,4145],"CVE-2025-1194","PYSEC-2026-1984",[210,4145],"2025-04-29T12:30:21Z","2026-08-13T20:11:58.399313771Z",[4150],{"type":1317,"score":4151},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[4153,4155,4157,4158,4160,4161],{"type":1285,"url":4154},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1194",{"type":1282,"url":4156},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F92c5ca9dd70de3ade2af2eb835c96215cc50e815",{"type":1290,"url":1474},{"type":1282,"url":4159},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F86f58dcd-683f-4adc-a735-849f51e9abb2",{"type":1290,"url":1788},{"type":1285,"url":4162},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fpwr-67px-3qhx",[1481],{"id":211,"slug":4165,"dossier":47,"summary":4166,"aliases":4167,"sourceIds":4169,"published":4170,"modified":4171,"checkedAt":7,"severity":4172,"references":4175,"versionKeys":4186,"packageCount":32,"repositoryCount":2311},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[4168],"CVE-2026-112935",[211],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[4173],{"type":1317,"score":4174},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4176,4178,4180,4182,4184,4185],{"type":1282,"url":4177},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1285,"url":4179},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1282,"url":4181},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1282,"url":4183},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1290,"url":2303},{"type":1282,"url":2305},[2307,2308,2309,2310],{"id":212,"slug":4188,"dossier":47,"summary":4189,"aliases":4190,"sourceIds":4193,"published":4194,"modified":4195,"checkedAt":7,"severity":4196,"references":4199,"versionKeys":4205,"packageCount":32,"repositoryCount":431},"ghsa-g3cq-j2xw-wf74-4475e17b","aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup",[4191,4192],"CVE-2026-54278","PYSEC-2026-2111",[212,4192],"2026-06-15T20:09:51Z","2026-09-10T03:51:08.751749295Z",[4197,4198],{"type":1278,"score":1999},{"type":1317,"score":1401},[4200,4202,4203],{"type":1285,"url":4201},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-g3cq-j2xw-wf74",{"type":1290,"url":1544},{"type":1325,"url":4204},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F4f7480e474cccc6a8cc2c92ad3f17a31dedf8232",[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":213,"slug":4207,"dossier":47,"summary":4208,"aliases":4209,"sourceIds":4213,"published":4214,"modified":4215,"checkedAt":7,"severity":4216,"references":4219,"versionKeys":4230,"packageCount":32,"repositoryCount":1660},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[4210,4211,4212],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[213,4212],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[4217,4218],{"type":1278,"score":1830},{"type":1317,"score":1353},[4220,4222,4224,4226,4228,4229],{"type":1285,"url":4221},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1285,"url":4223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1704,"url":4225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1325,"url":4227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1290,"url":1291},{"type":1285,"url":1293},[1297,1298,1299,1300,1301,1302,1303,1304],{"id":214,"slug":4232,"dossier":47,"summary":4233,"aliases":4234,"sourceIds":4237,"published":4238,"modified":4239,"checkedAt":7,"severity":4240,"references":4243,"versionKeys":4254,"packageCount":32,"repositoryCount":1305},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[4235,4236],"BIT-pillow-2026-96778","CVE-2026-96778",[214],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[4241],{"type":1278,"score":4242},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4244,4246,4248,4250,4252,4253],{"type":1282,"url":4245},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1285,"url":4247},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1282,"url":4249},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1282,"url":4251},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":215,"slug":4256,"dossier":47,"summary":4257,"aliases":4258,"sourceIds":4261,"published":4262,"modified":4263,"checkedAt":7,"severity":4264,"references":4267,"versionKeys":4286,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[4259,4260],"CVE-2024-34062","PYSEC-2026-1976",[215,4260],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[4265],{"type":1317,"score":4266},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4268,4270,4272,4274,4276,4278,4280,4282,4284],{"type":1282,"url":4269},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1285,"url":4271},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1282,"url":4273},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1290,"url":4275},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1282,"url":4277},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1282,"url":4279},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1282,"url":4281},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1290,"url":4283},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1285,"url":4285},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[4287],"pypi:tqdm@4.66.2",{"id":216,"slug":4289,"dossier":47,"summary":4290,"aliases":4291,"sourceIds":4295,"published":4296,"modified":4297,"checkedAt":7,"severity":4298,"references":4301,"versionKeys":4312,"packageCount":32,"repositoryCount":1305},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[4292,4293,4294],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[216,4294],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[4299,4300],{"type":1278,"score":1830},{"type":1317,"score":1353},[4302,4304,4306,4308,4310,4311],{"type":1285,"url":4303},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1285,"url":4305},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1704,"url":4307},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1325,"url":4309},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":217,"slug":4314,"dossier":47,"summary":4315,"aliases":4316,"sourceIds":4319,"published":4320,"modified":4321,"checkedAt":7,"severity":4322,"references":4324,"versionKeys":4337,"packageCount":32,"repositoryCount":451},"ghsa-g84x-mcqj-x9qq-fc677e5d","AIOHTTP vulnerable to DoS through chunked messages",[4317,4318],"CVE-2025-69229","PYSEC-2026-1106",[217,4318],"2026-01-05T23:13:29Z","2026-09-10T03:50:33.073865205Z",[4323],{"type":1278,"score":1999},[4325,4327,4329,4331,4333,4334,4335],{"type":1282,"url":4326},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-g84x-mcqj-x9qq",{"type":1285,"url":4328},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69229",{"type":1282,"url":4330},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F4ed97a4e46eaf61bd0f05063245f613469700229",{"type":1282,"url":4332},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdc3170b56904bdf814228fae70a5501a42a6c712",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":4336},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g84x-mcqj-x9qq",[1548,1549,1550,1551,1552,1553,1554],{"id":218,"slug":4339,"dossier":47,"summary":4340,"aliases":4341,"sourceIds":4344,"published":4345,"modified":4346,"checkedAt":7,"severity":4347,"references":4352,"versionKeys":4362,"packageCount":32,"repositoryCount":1305},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[4342,4343],"CVE-2026-25645","PYSEC-2026-2275",[218,4343],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[4348,4350],{"type":1317,"score":4349},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1317,"score":4351},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4353,4355,4357,4359,4360],{"type":1285,"url":4354},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1285,"url":4356},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1325,"url":4358},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1290,"url":3506},{"type":1285,"url":4361},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3518,3519,4363,4364],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":219,"slug":4366,"dossier":47,"summary":4367,"aliases":4368,"sourceIds":4371,"published":4372,"modified":4373,"checkedAt":7,"severity":4374,"references":4376,"versionKeys":4385,"packageCount":32,"repositoryCount":1305},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[4369,4370],"BIT-pillow-2026-112892","CVE-2026-112892",[219],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[4375],{"type":1278,"score":1567},[4377,4379,4381,4383,4384],{"type":1282,"url":4378},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1285,"url":4380},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1282,"url":4382},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":220,"slug":4387,"dossier":47,"summary":4388,"aliases":4389,"sourceIds":4392,"published":4393,"modified":4394,"checkedAt":7,"severity":4395,"references":4397,"versionKeys":4409,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[4390,4391],"CVE-2026-97688","PYSEC-2026-4176",[220,4391],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[4396],{"type":1278,"score":2763},[4398,4400,4402,4404,4405,4406,4407],{"type":1282,"url":4399},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1285,"url":4401},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1282,"url":4403},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1290,"url":1651},{"type":1282,"url":3340},{"type":1290,"url":1653},{"type":1285,"url":4408},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[3345,3346],{"id":221,"slug":4411,"dossier":47,"summary":4412,"aliases":4413,"sourceIds":4416,"published":4417,"modified":4418,"checkedAt":7,"severity":4419,"references":4421,"versionKeys":4432,"packageCount":32,"repositoryCount":1660},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[4414,4415],"CVE-2025-66418","PYSEC-2026-1998",[221,4415],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[4420],{"type":1278,"score":1636},[4422,4424,4426,4428,4429,4430],{"type":1282,"url":4423},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1285,"url":4425},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1325,"url":4427},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1290,"url":1651},{"type":1290,"url":1653},{"type":1285,"url":4431},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1655,1656,1657,1658,1659],{"id":222,"slug":4434,"dossier":47,"summary":4435,"aliases":4436,"sourceIds":4439,"published":4440,"modified":4441,"checkedAt":7,"severity":4442,"references":4445,"versionKeys":4460,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[4437,4438],"CVE-2024-56201","PYSEC-2026-1472",[222,4438],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[4443,4444],{"type":1317,"score":2437},{"type":1278,"score":3831},[4446,4448,4450,4452,4454,4455,4457,4458],{"type":1282,"url":4447},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1285,"url":4449},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1282,"url":4451},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1325,"url":4453},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1290,"url":3840},{"type":1282,"url":4456},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1290,"url":3846},{"type":1285,"url":4459},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3850],{"id":223,"slug":4462,"dossier":47,"summary":4463,"aliases":4464,"sourceIds":4466,"published":4467,"modified":4468,"checkedAt":7,"severity":4469,"references":4472,"versionKeys":4481,"packageCount":32,"repositoryCount":1599},"ghsa-gx76-c99x-2c96-30159937","AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies",[4465],"CVE-2026-111749",[223],"2026-10-20T19:58:14Z","2026-10-20T20:15:05.188135798Z",[4470],{"type":1278,"score":4471},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4473,4475,4477,4479,4480],{"type":1282,"url":4474},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-gx76-c99x-2c96",{"type":1285,"url":4476},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111749",{"type":1282,"url":4478},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6a07c171ef9f3be583e2907dcd1931372efca8d6",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":224,"slug":4483,"dossier":47,"summary":4484,"aliases":4485,"sourceIds":4489,"published":4490,"modified":4491,"checkedAt":7,"severity":4492,"references":4495,"versionKeys":4507,"packageCount":32,"repositoryCount":1305},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[4486,4487,4488],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[224,4488],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[4493],{"type":1317,"score":4494},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[4496,4498,4500,4502,4504,4505],{"type":1476,"url":4497},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1285,"url":4499},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1325,"url":4501},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1282,"url":4503},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1290,"url":2450},{"type":1285,"url":4506},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2456,2457,2458,2459,4508,4509,4510,4511,4512,4513,4514,4515],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":225,"slug":4517,"dossier":47,"summary":4518,"aliases":4519,"sourceIds":4522,"published":4523,"modified":4524,"checkedAt":7,"severity":4525,"references":4528,"versionKeys":4549,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[4520,4521],"CVE-2024-34064","PYSEC-2026-1474",[225,4521],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[4526],{"type":1317,"score":4527},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4529,4531,4533,4535,4536,4538,4540,4542,4544,4546,4547],{"type":1282,"url":4530},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1285,"url":4532},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1325,"url":4534},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1290,"url":3840},{"type":1282,"url":4537},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1282,"url":4539},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1282,"url":4541},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1282,"url":4543},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1282,"url":4545},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1290,"url":3846},{"type":1285,"url":4548},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3850],{"id":226,"slug":4551,"dossier":47,"summary":4552,"aliases":4553,"sourceIds":4556,"published":4557,"modified":4558,"checkedAt":7,"severity":4559,"references":4562,"versionKeys":4571,"packageCount":32,"repositoryCount":441},"ghsa-hcc4-c3v8-rx92-ddf32b5c","AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector",[4554,4555],"CVE-2026-34513","PYSEC-2026-2095",[226,4555],"2026-04-01T21:16:59.267Z","2026-09-10T03:51:02.067006429Z",[4560,4561],{"type":1278,"score":1855},{"type":1317,"score":1401},[4563,4565,4567,4569,4570],{"type":1325,"url":4564},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hcc4-c3v8-rx92",{"type":1285,"url":4566},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34513",{"type":1325,"url":4568},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc4d77c3533122be353b8afca8e8675e3b4cbda98",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":227,"slug":4573,"dossier":47,"summary":4574,"aliases":4575,"sourceIds":4578,"published":4579,"modified":4580,"checkedAt":7,"severity":4581,"references":4586,"versionKeys":4594,"packageCount":32,"repositoryCount":431},"ghsa-hg6j-4rv6-33pg-d0ac8db0","AIOHTTP is vulnerable to cross-origin redirect with per-request cookies",[4576,4577],"CVE-2026-47265","PYSEC-2026-2105",[227,4577],"2026-06-02T20:16:37.903Z","2026-09-10T03:50:49.888335735Z",[4582,4584],{"type":1278,"score":4583},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1317,"score":4585},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4587,4589,4591,4593],{"type":1325,"url":4588},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hg6j-4rv6-33pg",{"type":1285,"url":4590},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-47265",{"type":1325,"url":4592},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Ff54c40851b0d6c4bbdab97ba518a223adda32478",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":228,"slug":4596,"dossier":47,"summary":4597,"aliases":4598,"sourceIds":4601,"published":4602,"modified":4603,"checkedAt":7,"severity":4604,"references":4608,"versionKeys":4614,"packageCount":32,"repositoryCount":431},"ghsa-hpj7-wq8m-9hgp-fac25647","aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges",[4599,4600],"CVE-2026-54276","PYSEC-2026-2109",[228,4600],"2026-06-15T20:09:06Z","2026-09-10T03:50:49.899674354Z",[4605,4606],{"type":1278,"score":1977},{"type":1317,"score":4607},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[4609,4611,4613],{"type":1285,"url":4610},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hpj7-wq8m-9hgp",{"type":1325,"url":4612},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F38d16060037e1bfcd6d677abababa3c2a4bb58fa",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":229,"slug":4616,"dossier":47,"summary":4617,"aliases":4618,"sourceIds":4621,"published":4622,"modified":4623,"checkedAt":7,"severity":4624,"references":4628,"versionKeys":4645,"packageCount":32,"repositoryCount":470},"ghsa-hx9q-6w63-j58v-8d6e2248","orjson does not limit recursion for deeply nested JSON documents",[4619,4620],"CVE-2025-67221","PYSEC-2026-107",[229,4620],"2026-01-22T17:16:01.433Z","2026-09-10T03:50:33.258377926Z",[4625,4627],{"type":1278,"score":4626},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1317,"score":1401},[4629,4631,4633,4635,4637,4639,4641,4643],{"type":1285,"url":4630},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67221",{"type":1282,"url":4632},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson\u002Fissues\u002F620",{"type":1282,"url":4634},"https:\u002F\u002Fgithub.com\u002Fkpatsakis\u002FCVE-2025-67221\u002Fissues\u002F1",{"type":1282,"url":4636},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson\u002Fcommit\u002F62bb185b70785ded49c79c26f8c9781f1e6fe370",{"type":1290,"url":4638},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson",{"type":1476,"url":4640},"https:\u002F\u002Fgithub.com\u002Fkpatsakis\u002Forjson_vulnerability",{"type":1282,"url":4642},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Forjson\u002FPYSEC-2026-107.yaml",{"type":1285,"url":4644},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hx9q-6w63-j58v",[4646,4647,4648,4649],"pypi:orjson@3.10.14","pypi:orjson@3.10.15","pypi:orjson@3.11.4","pypi:orjson@3.11.5",{"id":230,"slug":4651,"dossier":47,"summary":4652,"aliases":4653,"sourceIds":4656,"published":4657,"modified":4658,"checkedAt":7,"severity":4659,"references":4663,"versionKeys":4679,"packageCount":32,"repositoryCount":32},"ghsa-hxxf-235m-72v3-21da19b0","Deserialization of Untrusted Data in Hugging Face Transformers",[4654,4655],"CVE-2024-11394","PYSEC-2024-229",[230,4655],"2024-11-22T22:15:07Z","2026-09-10T03:50:20.811665084Z",[4660,4662],{"type":1317,"score":4661},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1317,"score":1423},[4664,4666,4668,4670,4671,4673,4675,4677],{"type":1285,"url":4665},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11394",{"type":1282,"url":4667},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fissues\u002F34840",{"type":1282,"url":4669},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F35296",{"type":1290,"url":1474},{"type":1282,"url":4672},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-229.yaml",{"type":1282,"url":4674},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515",{"type":1285,"url":4676},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515\u002F",{"type":1285,"url":4678},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxxf-235m-72v3",[1481],{"id":231,"slug":4681,"dossier":47,"summary":4682,"aliases":4683,"sourceIds":4686,"published":4687,"modified":4688,"checkedAt":7,"severity":4689,"references":4691,"versionKeys":4700,"packageCount":32,"repositoryCount":1305},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4684,4685],"BIT-pillow-2026-112893","CVE-2026-112893",[231],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4690],{"type":1278,"score":1279},[4692,4694,4696,4698,4699],{"type":1282,"url":4693},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1285,"url":4695},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1282,"url":4697},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":232,"slug":4702,"dossier":47,"summary":4703,"aliases":4704,"sourceIds":4706,"published":4707,"modified":4708,"checkedAt":7,"severity":4709,"references":4712,"versionKeys":4722,"packageCount":32,"repositoryCount":2311},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4705],"CVE-2026-112936",[232],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4710],{"type":1317,"score":4711},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4713,4715,4717,4719,4720],{"type":1282,"url":4714},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1285,"url":4716},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1282,"url":4718},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1290,"url":2303},{"type":1282,"url":4721},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[2307,2308,2309,2310],{"id":233,"slug":4724,"dossier":47,"summary":4725,"aliases":4726,"sourceIds":4729,"published":4730,"modified":4731,"checkedAt":7,"severity":4732,"references":4737,"versionKeys":4754,"packageCount":32,"repositoryCount":431},"ghsa-jg22-mg44-37j8-b8064c77","AIOHTTP is Vulnerable to Deserialization of Untrusted Data",[4727,4728],"CVE-2026-34993","PYSEC-2026-2104",[233,4728],"2026-06-02T20:16:34.857Z","2026-09-10T03:51:08.847676311Z",[4733,4735],{"type":1317,"score":4734},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:C\u002FC:L\u002FI:H\u002FA:L",{"type":1317,"score":4736},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[4738,4740,4742,4744,4745,4747,4749,4750,4751,4752],{"type":1325,"url":4739},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-jg22-mg44-37j8",{"type":1285,"url":4741},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34993",{"type":1325,"url":4743},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdcf40f30637e8752c76781cf6703b5a236749a00",{"type":1290,"url":1544},{"type":1282,"url":4746},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34993",{"type":1282,"url":4748},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34993.json",{"type":1285,"url":2650},{"type":1285,"url":4070},{"type":1285,"url":4072},{"type":1704,"url":4753},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484099",[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":234,"slug":4756,"dossier":47,"summary":4757,"aliases":4758,"sourceIds":4761,"published":4762,"modified":4763,"checkedAt":7,"severity":4764,"references":4766,"versionKeys":4775,"packageCount":32,"repositoryCount":1305},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4759,4760],"BIT-pillow-2026-112894","CVE-2026-112894",[234],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4765],{"type":1278,"score":1567},[4767,4769,4771,4773,4774],{"type":1282,"url":4768},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1285,"url":4770},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1282,"url":4772},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":235,"slug":4777,"dossier":47,"summary":4778,"aliases":4779,"sourceIds":4782,"published":4783,"modified":4784,"checkedAt":7,"severity":4785,"references":4787,"versionKeys":4798,"packageCount":32,"repositoryCount":451},"ghsa-jj3x-wxrx-4x23-407bafac","AIOHTTP vulnerable to DoS when bypassing asserts",[4780,4781],"CVE-2025-69227","PYSEC-2026-1107",[235,4781],"2026-01-05T23:10:15Z","2026-09-10T03:50:33.308966616Z",[4786],{"type":1278,"score":1999},[4788,4790,4792,4794,4795,4796],{"type":1282,"url":4789},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-jj3x-wxrx-4x23",{"type":1285,"url":4791},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69227",{"type":1282,"url":4793},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbc1319ec3cbff9438a758951a30907b072561259",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":4797},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jj3x-wxrx-4x23",[1548,1549,1550,1551,1552,1553,1554],{"id":236,"slug":4800,"dossier":47,"summary":4801,"aliases":4802,"sourceIds":4806,"published":4807,"modified":4808,"checkedAt":7,"severity":4809,"references":4811,"versionKeys":4825,"packageCount":32,"repositoryCount":104},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4803,4804,4805],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[236,4805],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4810],{"type":1317,"score":1401},[4812,4814,4816,4818,4820,4821,4822,4823],{"type":1282,"url":4813},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1285,"url":4815},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1282,"url":4817},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1282,"url":4819},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1290,"url":1291},{"type":1282,"url":2623},{"type":1290,"url":2625},{"type":1285,"url":4824},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":237,"slug":4827,"dossier":47,"summary":4828,"aliases":4829,"sourceIds":4832,"published":4833,"modified":4834,"checkedAt":7,"severity":4835,"references":4837,"versionKeys":4850,"packageCount":32,"repositoryCount":32},"ghsa-jjph-296x-mrcr-0f661d67","Transformers vulnerable to ReDoS attack through its get_imports() function",[4830,4831],"CVE-2025-3264","PYSEC-2026-1985",[237,4831],"2025-07-07T12:30:22Z","2026-07-07T17:56:51.899728258Z",[4836],{"type":1317,"score":2121},[4838,4840,4842,4844,4845,4847,4848],{"type":1285,"url":4839},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3264",{"type":1282,"url":4841},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F0720e206c6ba28887e4d60ef60a6a089f6c1cc76",{"type":1282,"url":4843},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F126abe3461762e5fc180e7e614391d1b4ab051ca",{"type":1290,"url":1474},{"type":1282,"url":4846},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c6f7822-9992-476d-8cf0-b0b1623427df",{"type":1290,"url":1788},{"type":1285,"url":4849},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjph-296x-mrcr",[1481],{"id":238,"slug":4852,"dossier":47,"summary":4853,"aliases":4854,"sourceIds":4857,"published":4858,"modified":4859,"checkedAt":7,"severity":4860,"references":4863,"versionKeys":4871,"packageCount":32,"repositoryCount":441},"ghsa-jp82-jpqv-5vv3-4d50530e","Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname",[4855,4856],"CVE-2026-54282","PYSEC-2026-248",[238,4856],"2026-06-15T20:38:08Z","2026-09-10T03:50:50.050800090Z",[4861,4862],{"type":1317,"score":2930},{"type":1317,"score":1613},[4864,4866,4868,4869],{"type":1285,"url":4865},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-jp82-jpqv-5vv3",{"type":1285,"url":4867},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54282",{"type":1290,"url":3148},{"type":1282,"url":4870},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstarlette\u002FPYSEC-2026-248.yaml",[1520,1521,1522,3155,3156,3157,3224,3225,3226],{"id":239,"slug":4873,"dossier":47,"summary":4874,"aliases":4875,"sourceIds":4878,"published":4879,"modified":4880,"checkedAt":7,"severity":4881,"references":4886,"versionKeys":4899,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[4876,4877],"CVE-2024-5206","PYSEC-2024-110",[239,4877],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[4882,4884],{"type":1317,"score":4883},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1317,"score":4885},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4887,4889,4891,4893,4895,4897],{"type":1285,"url":4888},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1325,"url":4890},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1282,"url":4892},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1290,"url":4894},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1282,"url":4896},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1285,"url":4898},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[4900],"pypi:scikit-learn@1.3.2",{"id":240,"slug":4902,"dossier":47,"summary":4903,"aliases":4904,"sourceIds":4907,"published":4908,"modified":4909,"checkedAt":7,"severity":4910,"references":4915,"versionKeys":4924,"packageCount":32,"repositoryCount":441},"ghsa-m5qp-6w8w-w647-495897bd","AIOHTTP has a Multipart Header Size Bypass",[4905,4906],"CVE-2026-34516","PYSEC-2026-2098",[240,4906],"2026-04-01T21:16:59.723Z","2026-09-10T03:51:02.372876858Z",[4911,4912,4913],{"type":1317,"score":1401},{"type":1278,"score":1999},{"type":1278,"score":4914},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4916,4918,4920,4922,4923],{"type":1325,"url":4917},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-m5qp-6w8w-w647",{"type":1285,"url":4919},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34516",{"type":1325,"url":4921},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F8a74257b3804c9aac0bf644af93070f68f6c5a6f",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":241,"slug":4926,"dossier":47,"summary":4927,"aliases":4928,"sourceIds":4931,"published":4932,"modified":4933,"checkedAt":7,"severity":4934,"references":4937,"versionKeys":4943,"packageCount":32,"repositoryCount":431},"ghsa-m6qw-4cw2-hm4m-3f6d3ee7","aiohttp: CRLF injection in multipart headers",[4929,4930],"CVE-2026-50269","PYSEC-2026-2106",[241,4930],"2026-06-15T20:07:26Z","2026-09-10T03:51:09.078868018Z",[4935,4936],{"type":1278,"score":1611},{"type":1317,"score":1401},[4938,4940,4942],{"type":1285,"url":4939},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-m6qw-4cw2-hm4m",{"type":1325,"url":4941},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbf88077ebb14f4c29924b8e8904cba20c55c28b8",{"type":1290,"url":1544},[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":242,"slug":4945,"dossier":47,"summary":4946,"aliases":4947,"sourceIds":4950,"published":4951,"modified":4952,"checkedAt":7,"severity":4953,"references":4956,"versionKeys":4964,"packageCount":32,"repositoryCount":489},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4948,4949],"CVE-2026-44432","PYSEC-2026-142",[242,4949],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4954,4955],{"type":1317,"score":1401},{"type":1278,"score":1636},[4957,4959,4961,4963],{"type":1285,"url":4958},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1285,"url":4960},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1282,"url":4962},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1290,"url":1651},[3345],{"id":243,"slug":4966,"dossier":47,"summary":4967,"aliases":4968,"sourceIds":4971,"published":4972,"modified":4973,"checkedAt":7,"severity":4974,"references":4977,"versionKeys":4990,"packageCount":32,"repositoryCount":1599},"ghsa-mf9w-mj56-hr94-a492e0f4","python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback",[4969,4970],"CVE-2026-28684","PYSEC-2026-2270",[243,4970],"2026-04-20T17:16:33.087Z","2026-09-10T03:51:02.363430883Z",[4975],{"type":1317,"score":4976},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[4978,4980,4982,4984,4986,4988],{"type":1325,"url":4979},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9w-mj56-hr94",{"type":1285,"url":4981},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28684",{"type":1325,"url":4983},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311",{"type":1282,"url":4985},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311.patch",{"type":1290,"url":4987},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv",{"type":1285,"url":4989},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Freleases\u002Ftag\u002Fv1.2.2",[4991,4992,4993,4994],"pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1",{"id":244,"slug":4996,"dossier":47,"summary":4997,"aliases":4998,"sourceIds":5001,"published":5002,"modified":5003,"checkedAt":7,"severity":5004,"references":5007,"versionKeys":5022,"packageCount":32,"repositoryCount":42},"ghsa-mfx4-hv73-q22v-b33d9650","AIOHTTP: HTTP request smuggling via WebSocket upgrade",[4999,5000],"CVE-2026-69243","PYSEC-2026-3546",[244,5000],"2026-08-03T20:46:10Z","2026-09-10T03:51:14.385788837Z",[5005],{"type":1278,"score":5006},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5008,5010,5012,5014,5015,5017,5018,5020],{"type":1282,"url":5009},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mfx4-hv73-q22v",{"type":1282,"url":5011},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F13017",{"type":1282,"url":5013},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",{"type":1290,"url":1544},{"type":1282,"url":5016},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.2",{"type":1290,"url":2251},{"type":1285,"url":5019},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mfx4-hv73-q22v",{"type":1285,"url":5021},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69243",[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597],{"id":245,"slug":5024,"dossier":47,"summary":5025,"aliases":5026,"sourceIds":5029,"published":5030,"modified":5031,"checkedAt":7,"severity":5032,"references":5034,"versionKeys":5045,"packageCount":32,"repositoryCount":34},"ghsa-mj87-hwqh-73pj-92a4d569","python-multipart affected by Denial of Service via large multipart preamble or epilogue data",[5027,5028],"CVE-2026-40347","PYSEC-2026-3038",[245,5028],"2026-04-15T19:45:44Z","2026-09-10T03:51:02.322677211Z",[5033],{"type":1317,"score":1501},[5035,5037,5039,5040,5042,5043],{"type":1282,"url":5036},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-mj87-hwqh-73pj",{"type":1285,"url":5038},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40347",{"type":1290,"url":2355},{"type":1282,"url":5041},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Freleases\u002Ftag\u002F0.0.26",{"type":1290,"url":2357},{"type":1285,"url":5044},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mj87-hwqh-73pj",[2481,2482,2361],{"id":246,"slug":5047,"dossier":47,"summary":5048,"aliases":5049,"sourceIds":5052,"published":5053,"modified":5054,"checkedAt":7,"severity":5055,"references":5057,"versionKeys":5070,"packageCount":32,"repositoryCount":42},"ghsa-mq44-7p77-q5h7-6bd0337a","AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate",[5050,5051],"CVE-2026-59881","PYSEC-2026-3547",[246,5051],"2026-08-03T20:40:55Z","2026-09-10T03:51:14.489650589Z",[5056],{"type":1278,"score":2763},[5058,5060,5062,5064,5066,5067,5068],{"type":1282,"url":5059},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mq44-7p77-q5h7",{"type":1285,"url":5061},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59881",{"type":1282,"url":5063},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F12978",{"type":1282,"url":5065},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":5069},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mq44-7p77-q5h7",[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597],{"id":247,"slug":5072,"dossier":47,"summary":5073,"aliases":5074,"sourceIds":5077,"published":5078,"modified":5079,"checkedAt":7,"severity":5080,"references":5082,"versionKeys":5093,"packageCount":32,"repositoryCount":451},"ghsa-mqqc-3gqh-h2x8-6d702daf","AIOHTTP has unicode match groups in regexes for ASCII protocol elements",[5075,5076],"CVE-2025-69225","PYSEC-2026-1109",[247,5076],"2026-01-05T23:09:30Z","2026-09-10T03:50:33.538693726Z",[5081],{"type":1278,"score":1611},[5083,5085,5087,5089,5090,5091],{"type":1282,"url":5084},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mqqc-3gqh-h2x8",{"type":1285,"url":5086},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69225",{"type":1325,"url":5088},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc7b7a044f88c71cefda95ec75cdcfaa4792b3b96",{"type":1290,"url":1544},{"type":1290,"url":2251},{"type":1285,"url":5092},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mqqc-3gqh-h2x8",[1548,1549,1550,1551,1552,1553,1554],{"id":248,"slug":5095,"dossier":47,"summary":5096,"aliases":5097,"sourceIds":5100,"published":5101,"modified":5102,"checkedAt":7,"severity":5103,"references":5105,"versionKeys":5116,"packageCount":32,"repositoryCount":1305},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[5098,5099],"BIT-pillow-2026-96640","CVE-2026-96640",[248],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[5104],{"type":1278,"score":1279},[5106,5108,5110,5112,5114,5115],{"type":1282,"url":5107},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1285,"url":5109},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1282,"url":5111},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1282,"url":5113},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":249,"slug":5118,"dossier":47,"summary":5119,"aliases":5120,"sourceIds":5123,"published":5124,"modified":5125,"checkedAt":7,"severity":5126,"references":5129,"versionKeys":5138,"packageCount":32,"repositoryCount":441},"ghsa-mwh4-6h8g-pg8w-881420d8","AIOHTTP has HTTP response splitting via \\r in reason phrase",[5121,5122],"CVE-2026-34519","PYSEC-2026-2101",[249,5122],"2026-04-01T21:17:00.170Z","2026-09-10T03:50:44.819886754Z",[5127,5128],{"type":1278,"score":1611},{"type":1317,"score":1613},[5130,5132,5134,5136,5137],{"type":1325,"url":5131},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mwh4-6h8g-pg8w",{"type":1285,"url":5133},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34519",{"type":1325,"url":5135},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F53b35a2f8869c37a133e60bf1a82a1c01642ba2b",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":250,"slug":5140,"dossier":47,"summary":5141,"aliases":5142,"sourceIds":5145,"published":5146,"modified":5147,"checkedAt":7,"severity":5148,"references":5150,"versionKeys":5159,"packageCount":32,"repositoryCount":1305},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[5143,5144],"BIT-pillow-2026-112895","CVE-2026-112895",[250],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[5149],{"type":1278,"score":1567},[5151,5153,5155,5157,5158],{"type":1282,"url":5152},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1285,"url":5154},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1282,"url":5156},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":251,"slug":5161,"dossier":47,"summary":5162,"aliases":5163,"sourceIds":5167,"published":5168,"modified":5169,"checkedAt":7,"severity":5170,"references":5172,"versionKeys":5182,"packageCount":32,"repositoryCount":1305},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[5164,5165,5166],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[251,5166],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[5171],{"type":1317,"score":1353},[5173,5175,5177,5179,5180,5181],{"type":1285,"url":5174},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1285,"url":5176},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1704,"url":5178},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1325,"url":2566},{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":252,"slug":5184,"dossier":47,"summary":5185,"aliases":5186,"sourceIds":5189,"published":5190,"modified":5191,"checkedAt":7,"severity":5192,"references":5195,"versionKeys":5204,"packageCount":32,"repositoryCount":441},"ghsa-p998-jp59-783m-17c88f0d","AIOHTTP affected by UNC SSRF\u002FNTLMv2 Credential Theft\u002FLocal File Read in static resource handler on Windows",[5187,5188],"CVE-2026-34515","PYSEC-2026-2097",[252,5188],"2026-04-01T21:16:59.570Z","2026-09-10T03:51:02.565661873Z",[5193,5194],{"type":1278,"score":4583},{"type":1317,"score":4585},[5196,5198,5200,5202,5203],{"type":1325,"url":5197},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-p998-jp59-783m",{"type":1285,"url":5199},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34515",{"type":1325,"url":5201},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0ae2aa076c84573df83fc1fdc39eec0f5862fe3d",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":253,"slug":5206,"dossier":47,"summary":5207,"aliases":5208,"sourceIds":5212,"published":5213,"modified":5214,"checkedAt":7,"severity":5215,"references":5219,"versionKeys":5228,"packageCount":32,"repositoryCount":1305},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[5209,5210,5211],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[253,5211],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[5216,5217],{"type":1278,"score":3731},{"type":1317,"score":5218},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5220,5222,5224,5226,5227],{"type":1476,"url":5221},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1285,"url":5223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1325,"url":5225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":254,"slug":5230,"dossier":47,"summary":5231,"aliases":5232,"sourceIds":5236,"published":5237,"modified":5238,"checkedAt":7,"severity":5239,"references":5242,"versionKeys":5255,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[5233,5234,5235],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[254,5235],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[5240,5241],{"type":1317,"score":1501},{"type":1317,"score":1401},[5243,5245,5247,5249,5251,5253,5254],{"type":1476,"url":5244},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1285,"url":5246},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1325,"url":5248},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1325,"url":5250},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1282,"url":5252},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1290,"url":1291},{"type":1285,"url":2623},[1300,1301,1302,1303],{"id":255,"slug":5257,"dossier":47,"summary":5258,"aliases":5259,"sourceIds":5262,"published":4833,"modified":5263,"checkedAt":7,"severity":5264,"references":5267,"versionKeys":5280,"packageCount":32,"repositoryCount":489},"ghsa-phhr-52qp-3mj4-6f5d82e3","Transformers's Improper Input Validation vulnerability can be exploited through username injection",[5260,5261],"CVE-2025-3777","PYSEC-2026-1986",[255,5261],"2026-09-10T03:50:26.198077196Z",[5265],{"type":1317,"score":5266},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[5268,5270,5272,5273,5275,5277,5278],{"type":1285,"url":5269},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3777",{"type":1282,"url":5271},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F4dda5f71b35fb70cf602187eef84bb17a50b9082",{"type":1290,"url":1474},{"type":1282,"url":5274},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fblame\u002Fa7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4\u002Fsrc\u002Ftransformers\u002Fimage_utils.py",{"type":1282,"url":5276},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fccba0730-9248-4853-b7ff-5c20e6364f09",{"type":1290,"url":1788},{"type":1285,"url":5279},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-phhr-52qp-3mj4",[1481,1482,1483],{"id":256,"slug":5282,"dossier":47,"summary":5283,"aliases":5284,"sourceIds":5288,"published":5289,"modified":5290,"checkedAt":7,"severity":5291,"references":5293,"versionKeys":5304,"packageCount":32,"repositoryCount":104},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[5285,5286,5287],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[256,5287],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[5292],{"type":1317,"score":1401},[5294,5296,5298,5300,5302,5303],{"type":1476,"url":5295},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1285,"url":5297},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1325,"url":5299},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1282,"url":5301},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1290,"url":1291},{"type":1285,"url":1917},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":257,"slug":5306,"dossier":47,"summary":5307,"aliases":5308,"sourceIds":5311,"published":5312,"modified":5313,"checkedAt":7,"severity":5314,"references":5316,"versionKeys":5325,"packageCount":32,"repositoryCount":34},"ghsa-pp6c-gr5w-3c5g-de40aafe","python-multipart has Denial of Service via unbounded multipart part headers",[5309,5310],"CVE-2026-42561","PYSEC-2026-3039",[257,5310],"2026-05-06T21:56:14Z","2026-09-10T03:50:47.215892833Z",[5315],{"type":1317,"score":1401},[5317,5319,5321,5322,5323],{"type":1282,"url":5318},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-pp6c-gr5w-3c5g",{"type":1285,"url":5320},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42561",{"type":1290,"url":2355},{"type":1290,"url":2357},{"type":1285,"url":5324},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pp6c-gr5w-3c5g",[2481,2482,2361],{"id":258,"slug":5327,"dossier":47,"summary":5328,"aliases":5329,"sourceIds":5332,"published":5333,"modified":5334,"checkedAt":7,"severity":5335,"references":5337,"versionKeys":5349,"packageCount":32,"repositoryCount":451},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[5330,5331],"CVE-2025-50181","PYSEC-2026-1999",[258,5331],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[5336],{"type":1317,"score":1952},[5338,5340,5342,5344,5345,5346,5347],{"type":1282,"url":5339},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1285,"url":5341},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1325,"url":5343},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1290,"url":1651},{"type":1282,"url":1962},{"type":1290,"url":1653},{"type":1285,"url":5348},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1655,1656,1657,1658],{"id":259,"slug":5351,"dossier":47,"summary":5352,"aliases":5353,"sourceIds":5355,"published":5356,"modified":5357,"checkedAt":7,"severity":5358,"references":5361,"versionKeys":5370,"packageCount":32,"repositoryCount":1599},"ghsa-pqxq-w44r-73xw-f260bc82","AIOHTTP: Pure-Python parser request smuggling",[5354],"CVE-2026-111750",[259],"2026-10-20T19:52:21Z","2026-10-20T20:00:04.694820004Z",[5359],{"type":1278,"score":5360},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:L\u002FSA:L",[5362,5364,5366,5368,5369],{"type":1282,"url":5363},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-pqxq-w44r-73xw",{"type":1285,"url":5365},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111750",{"type":1282,"url":5367},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9b27347e61454d9f8ca2055f4c67a37dee336e83",{"type":1290,"url":1544},{"type":1282,"url":1595},[1548,1549,1550,1551,1552,1553,1554,1555,1556,1597,1598],{"id":260,"slug":5372,"dossier":47,"summary":5373,"aliases":5374,"sourceIds":5378,"published":5379,"modified":5380,"checkedAt":7,"severity":5381,"references":5384,"versionKeys":5396,"packageCount":32,"repositoryCount":1660},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[5375,5376,5377],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[260,5377],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[5382,5383],{"type":1278,"score":3754},{"type":1317,"score":2862},[5385,5386,5388,5390,5392,5394,5395],{"type":1282,"url":3758},{"type":1325,"url":5387},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1285,"url":5389},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1325,"url":5391},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1325,"url":5393},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1290,"url":1291},{"type":1285,"url":2597},[1295,1296,1297,1298,1299,1300,1301,1302],{"id":261,"slug":5398,"dossier":47,"summary":5399,"aliases":5400,"sourceIds":5403,"published":4833,"modified":5404,"checkedAt":7,"severity":5405,"references":5407,"versionKeys":5418,"packageCount":32,"repositoryCount":32},"ghsa-q2wp-rjmx-x6x9-43135d3d","Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking",[5401,5402],"CVE-2025-3263","PYSEC-2026-1987",[261,5402],"2026-07-07T17:56:57.889099913Z",[5406],{"type":1317,"score":2121},[5408,5410,5411,5412,5413,5415,5416],{"type":1285,"url":5409},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3263",{"type":1282,"url":4841},{"type":1282,"url":4843},{"type":1290,"url":1474},{"type":1282,"url":5414},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fc7a69150-54f8-4e81-8094-791e7a2a0f29",{"type":1290,"url":1788},{"type":1285,"url":5417},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2wp-rjmx-x6x9",[1481],{"id":262,"slug":5420,"dossier":47,"summary":5421,"aliases":5422,"sourceIds":5425,"published":5426,"modified":5427,"checkedAt":7,"severity":5428,"references":5432,"versionKeys":5445,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[5423,5424],"CVE-2024-56326","PYSEC-2026-1475",[262,5424],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[5429,5431],{"type":1317,"score":5430},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1278,"score":3831},[5433,5435,5437,5439,5440,5441,5442,5443],{"type":1282,"url":5434},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1285,"url":5436},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1325,"url":5438},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1290,"url":3840},{"type":1282,"url":4456},{"type":1282,"url":3842},{"type":1290,"url":3846},{"type":1285,"url":5444},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3850],{"id":263,"slug":5447,"dossier":47,"summary":5448,"aliases":5449,"sourceIds":5452,"published":5453,"modified":5454,"checkedAt":7,"severity":5455,"references":5458,"versionKeys":5466,"packageCount":32,"repositoryCount":1305},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[5450,5451],"BIT-pillow-2026-112897","CVE-2026-112897",[263],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[5456],{"type":1278,"score":5457},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5459,5461,5463,5464,5465],{"type":1282,"url":5460},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1285,"url":5462},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1282,"url":3738},{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":264,"slug":5468,"dossier":47,"summary":5469,"aliases":5470,"sourceIds":5473,"published":5474,"modified":5475,"checkedAt":7,"severity":5476,"references":5480,"versionKeys":5486,"packageCount":32,"repositoryCount":1305},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[5471,5472],"CVE-2026-44431","PYSEC-2026-141",[264,5472],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[5477,5478],{"type":1317,"score":2738},{"type":1278,"score":5479},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5481,5483,5485],{"type":1285,"url":5482},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1285,"url":5484},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1290,"url":1651},[1655,1656,1657,1658,1659,3345],{"id":265,"slug":5488,"dossier":47,"summary":5489,"aliases":5490,"sourceIds":5494,"published":5495,"modified":5496,"checkedAt":7,"severity":5497,"references":5501,"versionKeys":5519,"packageCount":32,"repositoryCount":2678},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[5491,5492,5493],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[265],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[5498,5499],{"type":1317,"score":3379},{"type":1278,"score":5500},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[5502,5504,5506,5508,5510,5512,5513,5515,5517],{"type":1285,"url":5503},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1282,"url":5505},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1282,"url":5507},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1282,"url":5509},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1282,"url":5511},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1290,"url":1711},{"type":1282,"url":5514},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1282,"url":5516},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1282,"url":5518},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1723,1724,1725,2671,2672,2673,2674,2675,2676,2677],{"id":266,"slug":5521,"dossier":47,"summary":5522,"aliases":5523,"sourceIds":5526,"published":5527,"modified":5528,"checkedAt":7,"severity":5529,"references":5532,"versionKeys":5546,"packageCount":32,"repositoryCount":2678},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[5524,5525],"CVE-2026-22701","PYSEC-2026-1374",[266,5525],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[5530],{"type":1317,"score":5531},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5533,5535,5537,5539,5541,5542,5544],{"type":1282,"url":5534},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1285,"url":5536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1282,"url":5538},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1282,"url":5540},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1290,"url":2303},{"type":1290,"url":5543},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1285,"url":5545},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2844,2845,2846,2847],{"id":267,"slug":5548,"dossier":47,"summary":5549,"aliases":5550,"sourceIds":5553,"published":5554,"modified":5555,"checkedAt":7,"severity":5556,"references":5559,"versionKeys":5573,"packageCount":32,"repositoryCount":32},"ghsa-qq3j-4f4f-9583-cd76c72c","Hugging Face Transformers Regular Expression Denial of Service",[5551,5552],"CVE-2025-2099","PYSEC-2025-40",[267,5552],"2025-05-19T12:15:19Z","2026-06-10T17:02:48.111891265Z",[5557,5558],{"type":1317,"score":2121},{"type":1317,"score":1401},[5560,5562,5564,5566,5567,5569,5571],{"type":1285,"url":5561},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2099",{"type":1282,"url":5563},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F36648",{"type":1325,"url":5565},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F8cb522b4190bd556ce51be04942720650b1a3e57",{"type":1290,"url":1474},{"type":1282,"url":5568},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2025-40.yaml",{"type":1282,"url":5570},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F97b780f3-ffca-424f-ad5d-0e1c57a5bde4",{"type":1285,"url":5572},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qq3j-4f4f-9583",[1481],{"id":268,"slug":5575,"dossier":47,"summary":4652,"aliases":5576,"sourceIds":5579,"published":5580,"modified":5581,"checkedAt":7,"severity":5582,"references":5586,"versionKeys":5600,"packageCount":32,"repositoryCount":32},"ghsa-qxrp-vhvm-j765-63c6e9a2",[5577,5578],"CVE-2024-11392","PYSEC-2024-227",[268,5578],"2024-11-22T22:15:06Z","2026-09-10T03:50:21.016710762Z",[5583,5585],{"type":1317,"score":5584},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1317,"score":1423},[5587,5589,5590,5591,5592,5594,5596,5598],{"type":1285,"url":5588},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11392",{"type":1282,"url":4667},{"type":1282,"url":4669},{"type":1290,"url":1474},{"type":1282,"url":5593},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-227.yaml",{"type":1282,"url":5595},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513",{"type":1285,"url":5597},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513\u002F",{"type":1285,"url":5599},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qxrp-vhvm-j765",[1481],{"id":269,"slug":5602,"dossier":47,"summary":5603,"aliases":5604,"sourceIds":5608,"published":5609,"modified":5610,"checkedAt":7,"severity":5611,"references":5614,"versionKeys":5628,"packageCount":32,"repositoryCount":1660},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[5605,5606,5607],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[269,5607],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[5612,5613],{"type":1317,"score":1699},{"type":1278,"score":2583},[5615,5617,5619,5621,5623,5624,5625,5626],{"type":1282,"url":5616},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1285,"url":5618},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1282,"url":5620},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1282,"url":5622},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1290,"url":1291},{"type":1282,"url":2597},{"type":1290,"url":2625},{"type":1285,"url":5627},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1295,1296,1297,1298,1299,1300,1301,1302],{"id":270,"slug":5630,"dossier":47,"summary":5631,"aliases":5632,"sourceIds":5635,"published":5636,"modified":5637,"checkedAt":7,"severity":5638,"references":5640,"versionKeys":5655,"packageCount":32,"repositoryCount":470},"ghsa-rcv9-qm8p-9p6j-edc1db04","Hugging Face Transformers library has Regular Expression Denial of Service",[5633,5634],"CVE-2025-6051","PYSEC-2026-1988",[270,5634],"2025-09-14T18:30:26Z","2026-09-10T03:50:28.694224028Z",[5639],{"type":1317,"score":2121},[5641,5643,5645,5647,5649,5650,5652,5653],{"type":1285,"url":5642},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6051",{"type":1282,"url":5644},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F38844",{"type":1282,"url":5646},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F54a02160eb030da9be18231c77791f2eb3a52216",{"type":1282,"url":5648},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fba8eaba9865618253f997784aa565b96206426f0",{"type":1290,"url":1474},{"type":1282,"url":5651},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Faf929523-7b59-418a-bf55-301830b2ac9d",{"type":1290,"url":1788},{"type":1285,"url":5654},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rcv9-qm8p-9p6j",[1481,1482,1483,1484],{"id":271,"slug":5657,"dossier":47,"summary":5658,"aliases":5659,"sourceIds":5662,"published":5663,"modified":5664,"checkedAt":7,"severity":5665,"references":5668,"versionKeys":5677,"packageCount":32,"repositoryCount":1305},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[5660,5661],"BIT-pillow-2026-112898","CVE-2026-112898",[271],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[5666],{"type":1278,"score":5667},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5669,5671,5673,5675,5676],{"type":1282,"url":5670},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1285,"url":5672},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1282,"url":5674},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":272,"slug":5679,"dossier":47,"summary":5680,"aliases":5681,"sourceIds":5683,"published":5684,"modified":5685,"checkedAt":7,"severity":5686,"references":5688,"versionKeys":5699,"packageCount":32,"repositoryCount":2311},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[5682],"CVE-2026-112939",[272],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[5687],{"type":1317,"score":4174},[5689,5691,5693,5695,5697,5698],{"type":1282,"url":5690},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1285,"url":5692},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1282,"url":5694},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1282,"url":5696},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1290,"url":2303},{"type":1282,"url":2305},[2307,2308,2309,2310],{"id":273,"slug":5701,"dossier":47,"summary":5702,"aliases":5703,"sourceIds":5706,"published":5707,"modified":5708,"checkedAt":7,"severity":5709,"references":5712,"versionKeys":5725,"packageCount":32,"repositoryCount":1599},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[5704,5705],"CVE-2026-25087","PYSEC-2026-113",[273,5705],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[5710],{"type":1317,"score":5711},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[5713,5715,5717,5719,5721,5723],{"type":1285,"url":5714},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1325,"url":5716},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1290,"url":5718},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1282,"url":5720},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1285,"url":5722},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1285,"url":5724},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[5726,5727,5728,5729],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":274,"slug":5731,"dossier":47,"summary":5732,"aliases":5733,"sourceIds":5737,"published":3959,"modified":5738,"checkedAt":7,"severity":5739,"references":5742,"versionKeys":5760,"packageCount":32,"repositoryCount":1660},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[5734,5735,5736],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[274],"2026-09-10T03:49:48.419046410Z",[5740,5741],{"type":1317,"score":3379},{"type":1278,"score":5500},[5743,5745,5747,5749,5751,5753,5754,5756,5758],{"type":1285,"url":5744},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1282,"url":5746},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1282,"url":5748},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1282,"url":5750},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1282,"url":5752},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1290,"url":1711},{"type":1282,"url":5755},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1282,"url":5757},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1282,"url":5759},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[5761,5762,5763,1723,1724,1725,2671,2672,2673,2674,2675,2676,2677],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":275,"slug":5765,"dossier":47,"summary":5766,"aliases":5767,"sourceIds":5769,"published":5770,"modified":5771,"checkedAt":7,"severity":5772,"references":5775,"versionKeys":5784,"packageCount":32,"repositoryCount":2311},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[5768],"CVE-2026-112940",[275],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[5773],{"type":1317,"score":5774},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5776,5778,5780,5781,5782,5783],{"type":1282,"url":5777},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1285,"url":5779},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1282,"url":3587},{"type":1282,"url":3589},{"type":1290,"url":2303},{"type":1282,"url":2305},[2307,2308,2309,2310],{"id":276,"slug":5786,"dossier":47,"summary":5787,"aliases":5788,"sourceIds":5791,"published":5792,"modified":5793,"checkedAt":7,"severity":5794,"references":5797,"versionKeys":5806,"packageCount":32,"repositoryCount":103},"ghsa-v9pg-7xvm-68hf-bd9c7524","python-multipart: Negative Content-Length in parse_form buffers the entire body in memory",[5789,5790],"CVE-2026-53540","PYSEC-2026-3040",[276,5790],"2026-06-15T20:23:45Z","2026-09-10T03:50:50.590441047Z",[5795],{"type":1317,"score":5796},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[5798,5800,5801,5802,5804],{"type":1282,"url":5799},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pg-7xvm-68hf",{"type":1290,"url":2355},{"type":1290,"url":2357},{"type":1285,"url":5803},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-v9pg-7xvm-68hf",{"type":1285,"url":5805},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53540",[2481,2482,2483,2361],{"id":277,"slug":5808,"dossier":47,"summary":5809,"aliases":5810,"sourceIds":5814,"published":5815,"modified":5816,"checkedAt":7,"severity":5817,"references":5819,"versionKeys":5830,"packageCount":32,"repositoryCount":1660},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[5811,5812,5813],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[277,5813],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[5818],{"type":1317,"score":2218},[5820,5822,5824,5826,5828,5829],{"type":1285,"url":5821},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1285,"url":5823},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1704,"url":5825},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1325,"url":5827},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1290,"url":1291},{"type":1285,"url":1293},[1297,1298,1299,1300,1301,1302,1303,1304],{"id":278,"slug":5832,"dossier":47,"summary":5833,"aliases":5834,"sourceIds":5837,"published":5838,"modified":5839,"checkedAt":7,"severity":5840,"references":5842,"versionKeys":5853,"packageCount":32,"repositoryCount":103},"ghsa-vffw-93wf-4j4q-3828c302","python-multipart: Content-Disposition parameter smuggling via RFC 2231\u002F5987 extended parameters",[5835,5836],"CVE-2026-53537","PYSEC-2026-3041",[278,5836],"2026-06-15T20:20:51Z","2026-09-10T03:50:50.585695996Z",[5841],{"type":1317,"score":2930},[5843,5845,5847,5848,5850,5852],{"type":1282,"url":5844},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-vffw-93wf-4j4q",{"type":1285,"url":5846},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53537",{"type":1290,"url":2355},{"type":1285,"url":5849},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vffw-93wf-4j4q",{"type":1282,"url":5851},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Fblob\u002Fmain\u002Fvulns\u002Fpython-multipart\u002FPYSEC-2026-3041.yaml",{"type":1290,"url":2357},[2481,2482,2483,2361],{"id":279,"slug":5855,"dossier":47,"summary":5856,"aliases":5857,"sourceIds":5861,"published":3959,"modified":5862,"checkedAt":7,"severity":5863,"references":5866,"versionKeys":5881,"packageCount":32,"repositoryCount":431},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[5858,5859,5860],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[279],"2026-06-10T17:41:15.774477397Z",[5864,5865],{"type":1317,"score":3379},{"type":1278,"score":3964},[5867,5869,5870,5871,5872,5874,5875,5877,5879],{"type":1285,"url":5868},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1282,"url":3969},{"type":1282,"url":3971},{"type":1282,"url":3973},{"type":1282,"url":5873},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1290,"url":1711},{"type":1282,"url":5876},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1282,"url":5878},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1282,"url":5880},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1723,1724,1725,2671,2672,2673,2674],{"id":280,"slug":5883,"dossier":47,"summary":5884,"aliases":5885,"sourceIds":5889,"published":5890,"modified":5891,"checkedAt":7,"severity":5892,"references":5894,"versionKeys":5908,"packageCount":32,"repositoryCount":104},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5886,5887,5888],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[280,5888],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5893],{"type":1278,"score":1567},[5895,5897,5899,5901,5903,5904,5905,5906],{"type":1282,"url":5896},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1285,"url":5898},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1282,"url":5900},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1282,"url":5902},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1290,"url":1291},{"type":1282,"url":2623},{"type":1290,"url":2625},{"type":1285,"url":5907},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":281,"slug":5910,"dossier":47,"summary":5911,"aliases":5912,"sourceIds":5915,"published":5916,"modified":5917,"checkedAt":7,"severity":5918,"references":5921,"versionKeys":5936,"packageCount":32,"repositoryCount":489},"ghsa-vqfr-h8mv-ghfj-49515033","h11 accepts some malformed Chunked-Encoding bodies",[5913,5914],"CVE-2025-43859","PYSEC-2026-348",[281,5914],"2025-04-24T16:07:56Z","2026-10-27T16:45:03.535584040Z",[5919],{"type":1317,"score":5920},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[5922,5924,5926,5928,5930,5932,5934],{"type":1282,"url":5923},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fsecurity\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",{"type":1285,"url":5925},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-43859",{"type":1282,"url":5927},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fcommit\u002F114803a29ce50116dc47951c690ad4892b1a36ed",{"type":1282,"url":5929},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fh11\u002FPYSEC-2026-348.yaml",{"type":1290,"url":5931},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11",{"type":1290,"url":5933},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fh11",{"type":1285,"url":5935},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",[5937],"pypi:h11@0.14.0",{"id":282,"slug":5939,"dossier":47,"summary":5940,"aliases":5941,"sourceIds":5943,"published":5944,"modified":5945,"checkedAt":7,"severity":5946,"references":5948,"versionKeys":5955,"packageCount":32,"repositoryCount":1305},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[5942],"CVE-2026-112899",[282],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[5947],{"type":1278,"score":2763},[5949,5951,5953,5954],{"type":1282,"url":5950},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1282,"url":5952},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":283,"slug":5957,"dossier":90,"summary":5958,"aliases":5959,"sourceIds":5962,"published":5963,"modified":5964,"checkedAt":7,"severity":5965,"references":5967,"versionKeys":5979,"packageCount":32,"repositoryCount":2778},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[5960,5961],"CVE-2026-97689","PYSEC-2026-4177",[283,5961],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[5966],{"type":1278,"score":1636},[5968,5970,5972,5974,5975,5976,5977],{"type":1282,"url":5969},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1285,"url":5971},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1282,"url":5973},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1290,"url":1651},{"type":1282,"url":3340},{"type":1290,"url":1653},{"type":1285,"url":5978},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1655,1656,1657,1658,1659,3345,3346],{"id":284,"slug":5981,"dossier":47,"summary":5982,"aliases":5983,"sourceIds":5986,"published":5987,"modified":5988,"checkedAt":7,"severity":5989,"references":5993,"versionKeys":6002,"packageCount":32,"repositoryCount":441},"ghsa-w2fm-2cpv-w7v5-c2f7701a","aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage",[5984,5985],"CVE-2026-22815","PYSEC-2026-2094",[284,5985],"2026-04-01T19:45:17Z","2026-09-10T03:51:03.588955358Z",[5990,5991],{"type":1278,"score":2763},{"type":1278,"score":5992},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[5994,5996,5998,6000,6001],{"type":1325,"url":5995},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-w2fm-2cpv-w7v5",{"type":1285,"url":5997},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22815",{"type":1325,"url":5999},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0c2e9da51126238a421568eb7c5b53e5b5d17b36",{"type":1290,"url":1544},{"type":1285,"url":1623},[1548,1549,1550,1551,1552,1553,1554,1555],{"id":285,"slug":6004,"dossier":47,"summary":6005,"aliases":6006,"sourceIds":6009,"published":6010,"modified":6011,"checkedAt":7,"severity":6012,"references":6015,"versionKeys":6032,"packageCount":32,"repositoryCount":2678},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[6007,6008],"CVE-2025-68146","PYSEC-2026-1375",[285,6008],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[6013],{"type":1317,"score":6014},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[6016,6018,6020,6021,6023,6025,6027,6028,6030],{"type":1282,"url":6017},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1282,"url":6019},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1290,"url":2303},{"type":1282,"url":6022},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1282,"url":6024},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1282,"url":6026},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1290,"url":5543},{"type":1285,"url":6029},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1285,"url":6031},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2844,2845,2846,2847],{"id":286,"slug":6034,"dossier":47,"summary":6035,"aliases":6036,"sourceIds":6039,"published":6040,"modified":6041,"checkedAt":7,"severity":6042,"references":6045,"versionKeys":6054,"packageCount":32,"repositoryCount":1305},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[6037,6038],"BIT-pillow-2026-112900","CVE-2026-112900",[286],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[6043],{"type":1278,"score":6044},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6046,6048,6050,6052,6053],{"type":1282,"url":6047},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1285,"url":6049},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1282,"url":6051},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1290,"url":1291},{"type":1282,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":287,"slug":6056,"dossier":47,"summary":6057,"aliases":6058,"sourceIds":6062,"published":6063,"modified":6064,"checkedAt":7,"severity":6065,"references":6068,"versionKeys":6106,"packageCount":32,"repositoryCount":1660},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[6059,6060,6061],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[287,6061],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[6066,6067],{"type":1317,"score":1401},{"type":1278,"score":1567},[6069,6071,6073,6075,6077,6078,6080,6082,6084,6086,6088,6090,6091,6093,6095,6097,6098,6100,6102,6104],{"type":1282,"url":6070},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1285,"url":6072},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1282,"url":6074},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1282,"url":6076},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1290,"url":1291},{"type":1282,"url":6079},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1282,"url":6081},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1282,"url":6083},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1285,"url":6085},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1285,"url":6087},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1285,"url":6089},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1285,"url":3781},{"type":1285,"url":6092},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1285,"url":6094},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1285,"url":6096},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1285,"url":3783},{"type":1285,"url":6099},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1285,"url":6101},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1285,"url":6103},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1285,"url":6105},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1295,1296,1297,1298,1299,1300,1301,1302],{"id":288,"slug":6108,"dossier":47,"summary":6109,"aliases":6110,"sourceIds":6114,"published":6115,"modified":6116,"checkedAt":7,"severity":6117,"references":6120,"versionKeys":6129,"packageCount":32,"repositoryCount":1660},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[6111,6112,6113],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[288,6113],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[6118,6119],{"type":1317,"score":1699},{"type":1278,"score":2583},[6121,6123,6125,6127,6128],{"type":1285,"url":6122},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1285,"url":6124},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1282,"url":6126},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1290,"url":1291},{"type":1285,"url":2597},[1295,1296,1297,1298,1299,1300,1301,1302],{"id":289,"slug":6131,"dossier":47,"summary":6132,"aliases":6133,"sourceIds":6136,"published":6137,"modified":6138,"checkedAt":7,"severity":6139,"references":6142,"versionKeys":6155,"packageCount":32,"repositoryCount":34},"ghsa-wp53-j4wj-2cfg-22cec3c5","Python-Multipart has Arbitrary File Write via Non-Default Configuration",[6134,6135],"CVE-2026-24486","PYSEC-2026-1852",[289,6135],"2026-01-26T23:28:05Z","2026-09-10T03:50:59.359593372Z",[6140],{"type":1317,"score":6141},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:L",[6143,6145,6147,6149,6150,6152,6153],{"type":1282,"url":6144},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-wp53-j4wj-2cfg",{"type":1285,"url":6146},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24486",{"type":1282,"url":6148},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fcommit\u002F9433f4bbc9652bdde82bbe380984e32f8cfc89c4",{"type":1290,"url":2355},{"type":1282,"url":6151},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Freleases\u002Ftag\u002F0.0.22",{"type":1290,"url":2357},{"type":1285,"url":6154},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wp53-j4wj-2cfg",[2481,2482,2361],{"id":290,"slug":6157,"dossier":47,"summary":6158,"aliases":6159,"sourceIds":6162,"published":6163,"modified":6164,"checkedAt":7,"severity":6165,"references":6167,"versionKeys":6189,"packageCount":32,"repositoryCount":441},"ghsa-wqp7-x3pw-xc5r-4caabf81","Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows",[6160,6161],"CVE-2026-48818","PYSEC-2026-2281",[290,6161],"2026-06-15T20:16:30Z","2026-09-10T03:50:51.079936646Z",[6166],{"type":1317,"score":4585},[6168,6170,6171,6173,6175,6177,6179,6181,6183,6185,6187],{"type":1285,"url":6169},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-wqp7-x3pw-xc5r",{"type":1290,"url":3148},{"type":1282,"url":6172},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-48818",{"type":1282,"url":6174},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-48818.json",{"type":1285,"url":6176},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30087",{"type":1285,"url":6178},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30088",{"type":1285,"url":6180},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30089",{"type":1285,"url":6182},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Freleases\u002Ftag\u002F1.1.0",{"type":1704,"url":6184},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2490020",{"type":1325,"url":6186},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002Ffd53168a7767b6b55ba5af787fd88f49e33cabc5",{"type":1325,"url":6188},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fpull\u002F3287",[1520,1521,1522,3155,3156,3157,3224,3225,3226],{"id":291,"slug":6191,"dossier":47,"summary":4652,"aliases":6192,"sourceIds":6195,"published":4657,"modified":6196,"checkedAt":7,"severity":6197,"references":6200,"versionKeys":6214,"packageCount":32,"repositoryCount":32},"ghsa-wrfc-pvp9-mr9g-c6b03ddf",[6193,6194],"CVE-2024-11393","PYSEC-2024-228",[291,6194],"2026-09-10T03:50:55.987633957Z",[6198,6199],{"type":1317,"score":4661},{"type":1317,"score":1423},[6201,6203,6204,6205,6206,6208,6210,6212],{"type":1285,"url":6202},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11393",{"type":1282,"url":4667},{"type":1282,"url":4669},{"type":1290,"url":1474},{"type":1282,"url":6207},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-228.yaml",{"type":1282,"url":6209},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514",{"type":1285,"url":6211},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514\u002F",{"type":1285,"url":6213},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wrfc-pvp9-mr9g",[1481],{"id":292,"slug":6216,"dossier":47,"summary":6217,"aliases":6218,"sourceIds":6222,"published":6223,"modified":6224,"checkedAt":7,"severity":6225,"references":6230,"versionKeys":6246,"packageCount":32,"repositoryCount":499},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[6219,6220,6221],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[292],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[6226,6228],{"type":1317,"score":6227},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":1278,"score":6229},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6231,6233,6235,6237,6239,6240,6242,6244],{"type":1285,"url":6232},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1282,"url":6234},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1282,"url":6236},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1282,"url":6238},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1290,"url":1711},{"type":1282,"url":6241},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1282,"url":6243},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1282,"url":6245},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1723,1724],{"id":293,"slug":6248,"dossier":47,"summary":6249,"aliases":6250,"sourceIds":6253,"published":6254,"modified":6255,"checkedAt":7,"severity":6256,"references":6258,"versionKeys":6265,"packageCount":32,"repositoryCount":441},"ghsa-x746-7m8f-x49c-c0349d3f","Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`",[6251,6252],"CVE-2026-48817","PYSEC-2026-2280",[293,6252],"2026-06-15T20:16:05Z","2026-09-10T03:50:12.272722043Z",[6257],{"type":1317,"score":1613},[6259,6261,6263,6264],{"type":1285,"url":6260},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-x746-7m8f-x49c",{"type":1285,"url":6262},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48817",{"type":1290,"url":3148},{"type":1285,"url":6182},[1520,1521,1522,3155,3156,3157,3224,3225,3226],{"id":294,"slug":6267,"dossier":47,"summary":6268,"aliases":6269,"sourceIds":6272,"published":6273,"modified":6274,"checkedAt":7,"severity":6275,"references":6277,"versionKeys":6292,"packageCount":32,"repositoryCount":431},"ghsa-x9r9-c232-4q39-1586e326","Hugging Face Transformers downloads custom generation code before trust consent",[6270,6271],"CVE-2026-80047","PYSEC-2026-4174",[294,6271],"2026-09-01T15:31:13Z","2026-10-01T17:55:55.397425521Z",[6276],{"type":1317,"score":5430},[6278,6280,6282,6284,6285,6287,6289,6290],{"type":1285,"url":6279},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80047",{"type":1282,"url":6281},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F48620",{"type":1282,"url":6283},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fcbc1651a032b923da7f4b44b3d0e6f68e6ba6b55",{"type":1290,"url":1474},{"type":1282,"url":6286},"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1282,"url":6288},"https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1290,"url":1788},{"type":1285,"url":6291},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-x9r9-c232-4q39",[1482,1483,1484,1485,1486,1487,1488,1489,6293],"pypi:transformers@5.8.0",{"id":295,"slug":6295,"dossier":47,"summary":6296,"aliases":6297,"sourceIds":6300,"published":6301,"modified":6302,"checkedAt":7,"severity":6303,"references":6306,"versionKeys":6312,"packageCount":32,"repositoryCount":431},"ghsa-xcgm-r5h9-7989-77bcbc26","aiohttp: Incomplete websocket frame payloads bypass memory limits",[6298,6299],"CVE-2026-54274","PYSEC-2026-2108",[295,6299],"2026-06-15T20:11:22Z","2026-09-10T03:50:12.346397944Z",[6304,6305],{"type":1278,"score":1999},{"type":1317,"score":1401},[6307,6309,6310],{"type":1285,"url":6308},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-xcgm-r5h9-7989",{"type":1290,"url":1544},{"type":1325,"url":6311},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F14b6ee851fb16ec199acb950de0c82d476799e7d",[1548,1549,1550,1551,1552,1553,1554,1555,1556],{"id":296,"slug":6314,"dossier":47,"summary":6315,"aliases":6316,"sourceIds":6320,"published":6321,"modified":6322,"checkedAt":7,"severity":6323,"references":6325,"versionKeys":6339,"packageCount":32,"repositoryCount":470},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[6317,6318,6319],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[296,6319],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[6324],{"type":1317,"score":5774},[6326,6328,6330,6332,6334,6336,6337],{"type":1285,"url":6327},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1285,"url":6329},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1282,"url":6331},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1325,"url":6333},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1282,"url":6335},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1290,"url":1291},{"type":1282,"url":6338},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1298],{"id":297,"slug":6341,"dossier":47,"summary":6342,"aliases":6343,"sourceIds":6347,"published":6348,"modified":6349,"checkedAt":7,"severity":6350,"references":6353,"versionKeys":6362,"packageCount":32,"repositoryCount":1305},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[6344,6345,6346],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[297,6346],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[6351,6352],{"type":1278,"score":2763},{"type":1317,"score":1401},[6354,6356,6358,6360,6361],{"type":1325,"url":6355},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1285,"url":6357},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1325,"url":6359},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":298,"slug":6364,"dossier":47,"summary":6365,"aliases":6366,"sourceIds":6370,"published":6371,"modified":6372,"checkedAt":7,"severity":6373,"references":6376,"versionKeys":6387,"packageCount":32,"repositoryCount":104},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[6367,6368,6369],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[298,6369],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[6374],{"type":1317,"score":6375},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[6377,6379,6381,6383,6385,6386],{"type":1476,"url":6378},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1285,"url":6380},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1325,"url":6382},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1325,"url":6384},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1290,"url":1291},{"type":1285,"url":2623},[1295,1296,1297,1298,1299,1300,1301,1302,1303],{"id":299,"slug":6389,"dossier":47,"summary":6390,"aliases":6391,"sourceIds":6392,"published":6393,"modified":6394,"checkedAt":7,"severity":6395,"references":6398,"versionKeys":6408,"packageCount":32,"repositoryCount":1305},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[299],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[6396],{"type":1278,"score":6397},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[6399,6401,6403,6405,6406],{"type":1282,"url":6400},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1282,"url":6402},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1282,"url":6404},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1290,"url":2450},{"type":1282,"url":6407},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[2456,2457,2458,2459,4508,4509,4510,4511,4512,4513,4514,4515],{"id":300,"slug":6410,"dossier":47,"summary":6411,"aliases":6412,"sourceIds":6415,"published":6416,"modified":6417,"checkedAt":7,"severity":6418,"references":6421,"versionKeys":6434,"packageCount":32,"repositoryCount":42},"ghsa-xrqw-3rrv-vx5w-3d985837","Transformers save_pretrained path traversal allows arbitrary file writes through chat template names",[6413,6414],"CVE-2026-9856","PYSEC-2026-3929",[300,6414],"2026-08-02T18:30:20Z","2026-09-10T12:25:36.528730268Z",[6419],{"type":1317,"score":6420},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[6422,6424,6426,6428,6429,6431,6432],{"type":1285,"url":6423},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9856",{"type":1282,"url":6425},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F46191",{"type":1282,"url":6427},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Feaaaf8494dd5386634ae37d1d122212fdc315be5",{"type":1290,"url":1474},{"type":1282,"url":6430},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F362824d5-fe18-40e8-a6cf-62277f97a170",{"type":1290,"url":1788},{"type":1285,"url":6433},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xrqw-3rrv-vx5w",[1481,1482,1483,1484,1485,1486,1487,1488,1489,6293],{"id":301,"slug":6436,"dossier":47,"summary":6437,"aliases":6438,"sourceIds":6441,"published":6442,"modified":6443,"checkedAt":7,"severity":6444,"references":6449,"versionKeys":6464,"packageCount":32,"repositoryCount":1305},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[6439,6440],"CVE-2026-112902","PYSEC-2026-4363",[301,6440],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[6445,6447],{"type":1278,"score":6446},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1317,"score":6448},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[6450,6452,6454,6456,6458,6460,6462,6463],{"type":1325,"url":6451},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1285,"url":6453},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1282,"url":6455},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1325,"url":6457},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1325,"url":6459},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1282,"url":6461},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1290,"url":1291},{"type":1285,"url":1293},[1295,1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":302,"slug":6466,"dossier":47,"summary":83,"aliases":6467,"sourceIds":6470,"published":6471,"modified":6472,"checkedAt":7,"severity":6473,"references":6475,"versionKeys":6484,"packageCount":32,"repositoryCount":499},"pysec-2025-198-62b25ed4",[6468,6469],"BIT-pytorch-2025-46148","CVE-2025-46148",[302],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[6474],{"type":1317,"score":2738},[6476,6478,6480,6482],{"type":1285,"url":6477},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1285,"url":6479},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1704,"url":6481},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1325,"url":6483},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1723,1724],{"id":303,"slug":6486,"dossier":47,"summary":83,"aliases":6487,"sourceIds":6490,"published":6491,"modified":6492,"checkedAt":7,"severity":6493,"references":6495,"versionKeys":6501,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[6488,6489],"BIT-pytorch-2025-46149","CVE-2025-46149",[303],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[6494],{"type":1317,"score":2738},[6496,6497,6499],{"type":1285,"url":6477},{"type":1704,"url":6498},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1325,"url":6500},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1724],{"id":304,"slug":6503,"dossier":47,"summary":83,"aliases":6504,"sourceIds":6507,"published":6508,"modified":6509,"checkedAt":7,"severity":6510,"references":6512,"versionKeys":6520,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[6505,6506],"BIT-pytorch-2025-46150","CVE-2025-46150",[304],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[6511],{"type":1317,"score":2738},[6513,6514,6516,6518],{"type":1285,"url":6477},{"type":1704,"url":6515},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1704,"url":6517},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1325,"url":6519},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1724],{"id":305,"slug":6522,"dossier":47,"summary":83,"aliases":6523,"sourceIds":6526,"published":6527,"modified":6528,"checkedAt":7,"severity":6529,"references":6531,"versionKeys":6537,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[6524,6525],"BIT-pytorch-2025-46152","CVE-2025-46152",[305],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[6530],{"type":1317,"score":1501},[6532,6533,6535],{"type":1285,"url":6477},{"type":1704,"url":6534},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1325,"url":6536},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1724],{"id":306,"slug":6539,"dossier":47,"summary":83,"aliases":6540,"sourceIds":6543,"published":6544,"modified":6545,"checkedAt":7,"severity":6546,"references":6548,"versionKeys":6558,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[6541,6542],"BIT-pytorch-2025-46153","CVE-2025-46153",[306],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[6547],{"type":1317,"score":2738},[6549,6551,6552,6554,6556],{"type":1282,"url":6550},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1285,"url":6477},{"type":1285,"url":6553},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1704,"url":6555},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1325,"url":6557},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1724],{"id":307,"slug":6560,"dossier":47,"summary":83,"aliases":6561,"sourceIds":6564,"published":6565,"modified":6566,"checkedAt":7,"severity":6567,"references":6569,"versionKeys":6574,"packageCount":32,"repositoryCount":6575},"pysec-2025-203-2febb201",[6562,6563],"BIT-pytorch-2025-55551","CVE-2025-55551",[307],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[6568],{"type":1317,"score":1401},[6570,6572],{"type":1285,"url":6571},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1704,"url":6573},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1723,1724,1725,2671,2672,2673],9,{"id":308,"slug":6577,"dossier":47,"summary":83,"aliases":6578,"sourceIds":6581,"published":6582,"modified":6583,"checkedAt":7,"severity":6584,"references":6586,"versionKeys":6590,"packageCount":32,"repositoryCount":6575},"pysec-2025-204-cdae47da",[6579,6580],"BIT-pytorch-2025-55552","CVE-2025-55552",[308],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[6585],{"type":1317,"score":1401},[6587,6588],{"type":1285,"url":6571},{"type":1704,"url":6589},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1723,1724,1725,2671,2672,2673],{"id":309,"slug":6592,"dossier":47,"summary":83,"aliases":6593,"sourceIds":6596,"published":6597,"modified":6598,"checkedAt":7,"severity":6599,"references":6601,"versionKeys":6607,"packageCount":32,"repositoryCount":489},"pysec-2025-205-fd5e58fd",[6594,6595],"BIT-pytorch-2025-55553","CVE-2025-55553",[309],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[6600],{"type":1317,"score":1401},[6602,6603,6605],{"type":1285,"url":6571},{"type":1704,"url":6604},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1325,"url":6606},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1723,1724,1725],{"id":310,"slug":6609,"dossier":47,"summary":83,"aliases":6610,"sourceIds":6613,"published":6614,"modified":6615,"checkedAt":7,"severity":6616,"references":6618,"versionKeys":6622,"packageCount":32,"repositoryCount":6575},"pysec-2025-206-58322476",[6611,6612],"BIT-pytorch-2025-55554","CVE-2025-55554",[310],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[6617],{"type":1317,"score":1501},[6619,6620],{"type":1285,"url":6571},{"type":1704,"url":6621},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1723,1724,1725,2671,2672,2673],{"id":311,"slug":6624,"dossier":47,"summary":83,"aliases":6625,"sourceIds":6628,"published":6629,"modified":6630,"checkedAt":7,"severity":6631,"references":6633,"versionKeys":6639,"packageCount":32,"repositoryCount":489},"pysec-2025-207-2abef3fc",[6626,6627],"BIT-pytorch-2025-55557","CVE-2025-55557",[311],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[6632],{"type":1317,"score":1401},[6634,6635,6637],{"type":1285,"url":6571},{"type":1704,"url":6636},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1325,"url":6638},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1723,1724,1725],{"id":312,"slug":6641,"dossier":47,"summary":83,"aliases":6642,"sourceIds":6645,"published":6646,"modified":6647,"checkedAt":7,"severity":6648,"references":6650,"versionKeys":6656,"packageCount":32,"repositoryCount":489},"pysec-2025-208-6e93fe9d",[6643,6644],"BIT-pytorch-2025-55558","CVE-2025-55558",[312],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[6649],{"type":1317,"score":1401},[6651,6652,6654],{"type":1285,"url":6571},{"type":1704,"url":6653},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1325,"url":6655},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1723,1724,1725],{"id":313,"slug":6658,"dossier":47,"summary":83,"aliases":6659,"sourceIds":6662,"published":6663,"modified":6664,"checkedAt":7,"severity":6665,"references":6667,"versionKeys":6673,"packageCount":32,"repositoryCount":489},"pysec-2025-209-e6f352b0",[6660,6661],"BIT-pytorch-2025-55560","CVE-2025-55560",[313],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[6666],{"type":1317,"score":1401},[6668,6669,6671],{"type":1285,"url":6571},{"type":1704,"url":6670},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1325,"url":6672},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1723,1724,1725],{"id":314,"slug":6675,"dossier":47,"summary":83,"aliases":6676,"sourceIds":6678,"published":6679,"modified":6680,"checkedAt":7,"severity":6681,"references":6683,"versionKeys":6686,"packageCount":32,"repositoryCount":2311},"pysec-2025-211-d8bd15de",[6677],"CVE-2025-14920",[314],"2025-12-23T21:15:47.183Z","2026-05-21T15:00:32.080516132Z",[6682],{"type":1317,"score":1467},[6684],{"type":1285,"url":6685},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1150\u002F",[1481,1482,1483,1484,1485],{"id":315,"slug":6688,"dossier":47,"summary":83,"aliases":6689,"sourceIds":6691,"published":6692,"modified":6693,"checkedAt":7,"severity":6694,"references":6696,"versionKeys":6699,"packageCount":32,"repositoryCount":2311},"pysec-2025-212-a011b97d",[6690],"CVE-2025-14921",[315],"2025-12-23T21:15:47.340Z","2026-05-21T15:00:32.052313357Z",[6695],{"type":1317,"score":1467},[6697],{"type":1285,"url":6698},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1149\u002F",[1481,1482,1483,1484,1485],{"id":316,"slug":6701,"dossier":47,"summary":83,"aliases":6702,"sourceIds":6704,"published":6705,"modified":6706,"checkedAt":7,"severity":6707,"references":6709,"versionKeys":6712,"packageCount":32,"repositoryCount":2311},"pysec-2025-213-9043dc9b",[6703],"CVE-2025-14924",[316],"2025-12-23T21:15:47.600Z","2026-05-21T15:00:32.048516839Z",[6708],{"type":1317,"score":1467},[6710],{"type":1285,"url":6711},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1141\u002F",[1481,1482,1483,1484,1485],{"id":317,"slug":6714,"dossier":47,"summary":83,"aliases":6715,"sourceIds":6717,"published":6718,"modified":6719,"checkedAt":7,"severity":6720,"references":6722,"versionKeys":6725,"packageCount":32,"repositoryCount":2311},"pysec-2025-214-eb241255",[6716],"CVE-2025-14926",[317],"2025-12-23T21:15:47.857Z","2026-05-21T15:00:32.929011749Z",[6721],{"type":1317,"score":1467},[6723],{"type":1285,"url":6724},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1147\u002F",[1481,1482,1483,1484,1485],{"id":318,"slug":6727,"dossier":47,"summary":83,"aliases":6728,"sourceIds":6730,"published":6731,"modified":6732,"checkedAt":7,"severity":6733,"references":6735,"versionKeys":6738,"packageCount":32,"repositoryCount":2311},"pysec-2025-215-6064f491",[6729],"CVE-2025-14927",[318],"2025-12-23T21:15:47.987Z","2026-05-21T15:00:32.888290877Z",[6734],{"type":1317,"score":1467},[6736],{"type":1285,"url":6737},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1148\u002F",[1481,1482,1483,1484,1485],{"id":319,"slug":6740,"dossier":47,"summary":83,"aliases":6741,"sourceIds":6743,"published":6744,"modified":6745,"checkedAt":7,"severity":6746,"references":6748,"versionKeys":6751,"packageCount":32,"repositoryCount":2311},"pysec-2025-216-5708ed01",[6742],"CVE-2025-14928",[319],"2025-12-23T21:15:48.110Z","2026-05-21T15:00:32.939311939Z",[6747],{"type":1317,"score":1467},[6749],{"type":1285,"url":6750},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1146\u002F",[1481,1482,1483,1484,1485],{"id":320,"slug":6753,"dossier":47,"summary":83,"aliases":6754,"sourceIds":6756,"published":6757,"modified":6758,"checkedAt":7,"severity":6759,"references":6761,"versionKeys":6764,"packageCount":32,"repositoryCount":431},"pysec-2025-217-2c1ad388",[6755],"CVE-2025-14929",[320],"2025-12-23T21:15:48.240Z","2026-05-21T15:00:24.271970226Z",[6760],{"type":1317,"score":1467},[6762],{"type":1285,"url":6763},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1144\u002F",[1481,1482,1483,1484,1485,1486,1487,1488,1489],{"id":321,"slug":6766,"dossier":47,"summary":83,"aliases":6767,"sourceIds":6769,"published":6770,"modified":6771,"checkedAt":7,"severity":6772,"references":6774,"versionKeys":6777,"packageCount":32,"repositoryCount":451},"pysec-2025-218-39811fc3",[6768],"CVE-2025-14930",[321],"2025-12-23T21:15:48.367Z","2026-05-21T15:00:33.791364554Z",[6773],{"type":1317,"score":1467},[6775],{"type":1285,"url":6776},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1145\u002F",[1481,1482,1483,1484,1485,1486],{"id":322,"slug":6779,"dossier":47,"summary":83,"aliases":6780,"sourceIds":6783,"published":6784,"modified":6785,"checkedAt":7,"severity":6786,"references":6788,"versionKeys":6799,"packageCount":32,"repositoryCount":1455},"pysec-2026-139-96951ff6",[6781,6782],"BIT-pytorch-2026-4538","CVE-2026-4538",[322],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[6787],{"type":1317,"score":5430},[6789,6791,6793,6795,6797],{"type":1282,"url":6790},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1285,"url":6792},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1285,"url":6794},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1704,"url":6796},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1325,"url":6798},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[5761,1723,1724,1725,2671,2672,2673,2674,2675,2676,2677],1794474422544]