Energieautarkes Wohnquartier - Backend

Certifi removes GLOBALTRUST root certificate

Werkzeug safe_join() allows Windows special device names

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

urllib3 streaming API improperly handles highly compressed data

Keras is vulnerable to Deserialization of Untrusted Data

The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

urllib3 does not control redirects in browsers and Node.js

Keras has an untrusted deserialization vulnerability

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Python-Markdown has an Uncaught Exception

Pillow has a heap buffer overflow with nested list coordinates

Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix

Flask session does not add `Vary: Cookie` header when accessed in some ways

fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

protobuf affected by a JSON recursion depth bypass

Flask-CORS improper regex path matching vulnerability

flask-cors vulnerable to log injection when the log level is set to debug

Werkzeug safe_join() allows Windows special device names with compound extensions

protobuf-python has a potential Denial of Service issue

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Flask-CORS allows for inconsistent CORS matching

Requests vulnerable to .netrc credentials leak via malicious URLs

Requests `Session` object does not verify requests after making first request with verify=False

Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality

Pillow affected by out-of-bounds write when loading PSD images

Jinja2 vulnerable to sandbox breakout through attr filter selecting format method

setuptools vulnerable to Command Injection via package URL

Werkzeug safe_join not safe on Windows

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

urllib3 allows an unbounded number of links in the decompression chain

Jinja has a sandbox breakout through malicious filenames

Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter

Werkzeug safe_join() allows Windows special device names

Keras Directory Traversal Vulnerability

Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback

Keras vulnerable to DoS via Malicious .keras Model (HDF5 Shape Bomb Causes Petabyte Allocation in KerasFileEditor)

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)

Jinja has a sandbox breakout through indirect reference to format method

Werkzeug possible resource exhaustion when parsing file data in forms

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects