[{"data":1,"prerenderedAt":6875},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14326":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":76,"entity":77,"evidence":322,"related":325},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-12T08:58:58.139Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-12T08:57:16.613Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5071,5059,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":42,"licenseExpressionCount":66,"knownLicensePackageCount":67,"unknownLicensePackageCount":68,"advisoryCount":69,"matchedAdvisoryRepositoryCount":70,"topPackage":71},2865,51,9911,63,2827,38,1097,43,{"id":72,"slug":73,"label":74,"repositoryCount":33,"repositoryShare":75},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":78,"slug":79,"gitlabProjectId":80,"name":81,"pathWithNamespace":82,"description":83,"webUrl":84,"commitSha":85,"commitUrl":86,"lastActivityAt":87,"headCommittedAt":88,"tree":89,"files":92,"resolvedComponentCount":100,"artifactResolvedComponentCount":100,"exactManifestPinCount":39,"packageCount":100,"ecosystems":101,"aiPackageCount":34,"licenseExpressionCount":103,"unknownLicensePackageCount":32,"advisoryIds":104,"advisoryCount":320,"providers":321},"opencode:14326","opencode-14326",14326,"URBAN.KI Sovia","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia","f6e6627775fc285c9e233cb46571c0caeac39c5d","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia\u002F-\u002Fcommit\u002Ff6e6627775fc285c9e233cb46571c0caeac39c5d","2026-11-11T20:41:25.822Z","2026-11-11T20:41:10.000Z",{"complete":90,"entryCount":91,"truncated":47},true,70,[93],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},"uv-lock","ddc57ad0a634363d7ebefcbde0786b734f6f5f81","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia\u002F-\u002Fblob\u002Ff6e6627775fc285c9e233cb46571c0caeac39c5d\u002Fuv.lock","d444dfad7ad27a1821923a1fc11b3ae40b7e686a1c28dd4b750c45fa1cfa35b8",270188,"parsed",111,[102],"pypi",15,[105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319],"GHSA-22hg-r758-rrw9","GHSA-239g-whfq-7xj9","GHSA-23mf-xhv8-69c2","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-284h-m62q-gf8w","GHSA-29pf-2h5f-8g72","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3hv7-mjh2-fv65","GHSA-3j72-p6qg-6xp7","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59cr-6r3x-644w","GHSA-59p9-h35m-wg4g","GHSA-5rjg-fvgr-3xxf","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-6497-prx7-gpmq","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69hj-f68j-2879","GHSA-69w3-r845-3855","GHSA-6p8h-3wgx-97gf","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-74r2-7ff9-mjj2","GHSA-7545-fcxq-7j24","GHSA-768j-98cg-p3fv","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-78g4-xqwv-q3g8","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-7p48-42j8-8846","GHSA-83vg-56qc-22m7","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mcc-hrx5-hvxc","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cwqr-hh33-gh44","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f9j4-qggq-h239","GHSA-fc9g-5qg7-mf45","GHSA-fgcw-684q-jj6r","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fpwr-67px-3qhx","GHSA-fq56-3cx3-fjxp","GHSA-fx3j-rwgx-fr94","GHSA-g4qv-2jxx-769h","GHSA-g5vv-9gxw-82hx","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gq48-pqfc-9p58","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-hxxf-235m-72v3","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg86-v3jv-hrpm","GHSA-jhmp-mqwm-3gq8","GHSA-jhr6-gm9c-rqjv","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jm78-9fvv-mhgr","GHSA-jw8x-6495-233v","GHSA-m64x-33q8-m5h7","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mrfp-p49p-3hf2","GHSA-mv93-w799-cj2w","GHSA-p4wg-p73j-c528","GHSA-p538-c434-8v24","GHSA-p8hx-v2p6-rp84","GHSA-pcg2-g6cj-q92c","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pw9p-v7r6-gx4p","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r4j5-9xpp-3985","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rcv9-qm8p-9p6j","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v4x8-3wr5-3wq8","GHSA-v87r-6q3f-2j67","GHSA-v9pv-5gc8-w2m6","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqwp-45wm-r9r5","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-w8jc-g24h-crhw","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wrfc-pvp9-mr9g","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-x9r9-c232-4q39","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xrqw-3rrv-vx5w","GHSA-xvh5-g6gv-559v","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139",215,[],{"files":323,"occurrenceCount":100},[324],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},{"packages":326,"vulnerabilities":1348},[327,341,352,362,372,381,390,402,412,422,434,444,454,463,473,484,493,502,511,520,529,538,547,556,566,576,585,594,603,612,621,630,639,648,657,666,675,684,693,702,711,720,729,738,747,756,765,774,783,792,801,810,819,828,837,846,856,865,874,883,891,900,909,918,927,936,945,954,963,971,980,989,999,1008,1017,1026,1036,1045,1054,1063,1072,1081,1090,1099,1108,1117,1126,1135,1145,1154,1163,1172,1181,1190,1199,1208,1216,1225,1234,1243,1252,1261,1270,1279,1288,1297,1306,1313,1321,1330,1339],{"id":328,"slug":329,"identity":330,"label":331,"aiRelevant":90,"provider":332,"advisoryCount":335,"licenseExpressions":336,"versions":338,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":340},"package:pypi:transformers","transformers-65289303","pypi:transformers","Transformers",{"id":333,"label":334},"hugging-face","Hugging Face",27,[337],"Apache-2.0",[339],"4.51.0",[56],{"id":342,"slug":343,"identity":344,"label":345,"aiRelevant":90,"provider":83,"advisoryCount":346,"licenseExpressions":347,"versions":349,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":351},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[348],"BSD-3-Clause",[350],"2.9.1",[56],{"id":353,"slug":354,"identity":355,"label":356,"aiRelevant":90,"provider":357,"advisoryCount":32,"licenseExpressions":358,"versions":359,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":361},"package:pypi:sentence-transformers","sentence-transformers-3f3d7a36","pypi:sentence-transformers","Sentence Transformers",{"id":333,"label":334},[337],[360],"4.0.2",[56],{"id":363,"slug":364,"identity":365,"label":366,"aiRelevant":90,"provider":83,"advisoryCount":32,"licenseExpressions":367,"versions":369,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":371},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",[348,368],"non-standard",[370],"1.6.1",[56],{"id":373,"slug":374,"identity":375,"label":376,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":377,"versions":378,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":380},"package:pypi:tokenizers","tokenizers-7ba00902","pypi:tokenizers","Hugging Face Tokenizers",[368],[379],"0.21.1",[56],{"id":382,"slug":383,"identity":384,"label":385,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":386,"versions":387,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":389},"package:pypi:opencv-python","opencv-python-bfa06e24","pypi:opencv-python","OpenCV",[337],[388],"4.11.0.86",[56],{"id":391,"slug":392,"identity":393,"label":394,"aiRelevant":47,"provider":83,"advisoryCount":395,"licenseExpressions":396,"versions":399,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":401},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",61,[397,398],"HPND","MIT-CMU",[400],"11.1.0",[56],{"id":403,"slug":404,"identity":405,"label":406,"aiRelevant":47,"provider":83,"advisoryCount":407,"licenseExpressions":408,"versions":409,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":411},"package:pypi:gitpython","gitpython-dcd13009","pypi:gitpython","gitpython",37,[348],[410],"3.1.45",[56],{"id":413,"slug":414,"identity":415,"label":416,"aiRelevant":47,"provider":83,"advisoryCount":417,"licenseExpressions":418,"versions":419,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":421},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",19,[337],[420],"6.5.2",[56],{"id":423,"slug":424,"identity":425,"label":426,"aiRelevant":47,"provider":83,"advisoryCount":427,"licenseExpressions":428,"versions":431,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":433},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",11,[429,430],"MIT","Unlicense",[432],"3.18.0",[56],{"id":435,"slug":436,"identity":437,"label":438,"aiRelevant":47,"provider":83,"advisoryCount":439,"licenseExpressions":440,"versions":441,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":443},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[429],[442],"2.3.0",[56],{"id":445,"slug":446,"identity":447,"label":448,"aiRelevant":47,"provider":83,"advisoryCount":449,"licenseExpressions":450,"versions":451,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":453},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[348,368],[452],"3.1.6",[56],{"id":455,"slug":456,"identity":457,"label":458,"aiRelevant":47,"provider":83,"advisoryCount":449,"licenseExpressions":459,"versions":460,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":462},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[429],[461],"78.1.0",[56],{"id":464,"slug":465,"identity":466,"label":467,"aiRelevant":47,"provider":83,"advisoryCount":468,"licenseExpressions":469,"versions":470,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":472},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[337],[471],"2.32.3",[56],{"id":474,"slug":475,"identity":476,"label":477,"aiRelevant":47,"provider":83,"advisoryCount":478,"licenseExpressions":479,"versions":481,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":483},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",2,[480],"MPL-2.0",[482],"2025.1.31",[56],{"id":485,"slug":486,"identity":487,"label":488,"aiRelevant":47,"provider":83,"advisoryCount":478,"licenseExpressions":489,"versions":490,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":492},"package:pypi:protobuf","protobuf-6e30009a","pypi:protobuf","protobuf",[348],[491],"6.32.1",[56],{"id":494,"slug":495,"identity":496,"label":497,"aiRelevant":47,"provider":83,"advisoryCount":478,"licenseExpressions":498,"versions":499,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":501},"package:pypi:streamlit","streamlit-b61aa01e","pypi:streamlit","streamlit",[337],[500],"1.49.1",[56],{"id":503,"slug":504,"identity":505,"label":506,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":507,"versions":508,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":510},"package:pypi:duckdb","duckdb-8c0332c9","pypi:duckdb","duckdb",[429],[509],"1.3.2",[56],{"id":512,"slug":513,"identity":514,"label":515,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":516,"versions":517,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":519},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[429],[518],"4.55.8",[56],{"id":521,"slug":522,"identity":523,"label":524,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":525,"versions":526,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":528},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[348],[527],"2025.3.2",[56],{"id":530,"slug":531,"identity":532,"label":533,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":534,"versions":535,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":537},"package:pypi:geopandas","geopandas-968b51b0","pypi:geopandas","geopandas",[348],[536],"1.0.1",[56],{"id":539,"slug":540,"identity":541,"label":542,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":543,"versions":544,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":546},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[348,368],[545],"3.10",[56],{"id":548,"slug":549,"identity":550,"label":551,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":552,"versions":553,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":555},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[337,368],[554],"21.0.0",[56],{"id":557,"slug":558,"identity":559,"label":560,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":561,"versions":563,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":565},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[562],"BSD-2-Clause",[564],"2.19.1",[56],{"id":567,"slug":568,"identity":569,"label":570,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":571,"versions":573,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":575},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[572],"MIT AND MPL-2.0",[574],"4.67.1",[56],{"id":577,"slug":578,"identity":579,"label":580,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":581,"versions":582,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":584},"package:pypi:altair","altair-01b7f976","pypi:altair","altair",[348],[583],"5.5.0",[56],{"id":586,"slug":587,"identity":588,"label":589,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":590,"versions":591,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":593},"package:pypi:asttokens","asttokens-c349c5f9","pypi:asttokens","asttokens",[337],[592],"3.0.0",[56],{"id":595,"slug":596,"identity":597,"label":598,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":599,"versions":600,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":602},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[429],[601],"25.3.0",[56],{"id":604,"slug":605,"identity":606,"label":607,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":608,"versions":609,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":611},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[429],[610],"1.9.0",[56],{"id":613,"slug":614,"identity":615,"label":616,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":617,"versions":618,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":620},"package:pypi:branca","branca-e1a3550c","pypi:branca","branca",[429],[619],"0.8.1",[56],{"id":622,"slug":623,"identity":624,"label":625,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":626,"versions":627,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":629},"package:pypi:cachetools","cachetools-84fe6563","pypi:cachetools","cachetools",[429],[628],"6.2.0",[56],{"id":631,"slug":632,"identity":633,"label":634,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":635,"versions":636,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":638},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[429],[637],"3.4.1",[56],{"id":640,"slug":641,"identity":642,"label":643,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":644,"versions":645,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":647},"package:pypi:click","click-ef97f731","pypi:click","click",[348,368],[646],"8.2.1",[56],{"id":649,"slug":650,"identity":651,"label":652,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":653,"versions":654,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":656},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[368],[655],"0.4.6",[56],{"id":658,"slug":659,"identity":660,"label":661,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":662,"versions":663,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":665},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[348],[664],"1.3.1",[56],{"id":667,"slug":668,"identity":669,"label":670,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":671,"versions":672,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":674},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[348],[673],"0.12.1",[56],{"id":676,"slug":677,"identity":678,"label":679,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":680,"versions":681,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":683},"package:pypi:decorator","decorator-500c1fb8","pypi:decorator","decorator",[562,368],[682],"5.2.1",[56],{"id":685,"slug":686,"identity":687,"label":688,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":689,"versions":690,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":692},"package:pypi:executing","executing-36845a5b","pypi:executing","executing",[429],[691],"2.2.0",[56],{"id":694,"slug":695,"identity":696,"label":697,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":698,"versions":699,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":701},"package:pypi:folium","folium-6e89a148","pypi:folium","folium",[429],[700],"0.20.0",[56],{"id":703,"slug":704,"identity":705,"label":706,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":707,"versions":708,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":710},"package:pypi:ftfy","ftfy-b3100e16","pypi:ftfy","ftfy",[337],[709],"6.3.1",[56],{"id":712,"slug":713,"identity":714,"label":715,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":716,"versions":717,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":719},"package:pypi:gitdb","gitdb-dac4580b","pypi:gitdb","gitdb",[368],[718],"4.0.12",[56],{"id":721,"slug":722,"identity":723,"label":724,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":725,"versions":726,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":728},"package:pypi:huggingface-hub","huggingface-hub-443ec6ef","pypi:huggingface-hub","huggingface-hub",[337],[727],"0.30.1",[56],{"id":730,"slug":731,"identity":732,"label":733,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":734,"versions":735,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":737},"package:pypi:ipython","ipython-7a140323","pypi:ipython","ipython",[348],[736],"9.2.0",[56],{"id":739,"slug":740,"identity":741,"label":742,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":743,"versions":744,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":746},"package:pypi:ipython-pygments-lexers","ipython-pygments-lexers-6216051e","pypi:ipython-pygments-lexers","ipython-pygments-lexers",[368],[745],"1.1.1",[56],{"id":748,"slug":749,"identity":750,"label":751,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":752,"versions":753,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":755},"package:pypi:jedi","jedi-9eb0c211","pypi:jedi","jedi",[429],[754],"0.19.2",[56],{"id":757,"slug":758,"identity":759,"label":760,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":761,"versions":762,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":764},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[348],[763],"1.4.2",[56],{"id":766,"slug":767,"identity":768,"label":769,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":770,"versions":771,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":773},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[429],[772],"4.25.1",[56],{"id":775,"slug":776,"identity":777,"label":778,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":779,"versions":780,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":782},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[429],[781],"2025.9.1",[56],{"id":784,"slug":785,"identity":786,"label":787,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":788,"versions":789,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":791},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[368],[790],"1.4.8",[56],{"id":793,"slug":794,"identity":795,"label":796,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":797,"versions":798,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":800},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[348],[799],"3.0.2",[56],{"id":802,"slug":803,"identity":804,"label":805,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":806,"versions":807,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":809},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[368],[808],"3.10.0",[56],{"id":811,"slug":812,"identity":813,"label":814,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":815,"versions":816,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":818},"package:pypi:matplotlib-inline","matplotlib-inline-50f95e0d","pypi:matplotlib-inline","matplotlib-inline",[348],[817],"0.1.7",[56],{"id":820,"slug":821,"identity":822,"label":823,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":824,"versions":825,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":827},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[348],[826],"1.3.0",[56],{"id":829,"slug":830,"identity":831,"label":832,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":833,"versions":834,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":836},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[429],[835],"2.4.0",[56],{"id":838,"slug":839,"identity":840,"label":841,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":842,"versions":843,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":845},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[348,368],[844],"3.4.2",[56],{"id":847,"slug":848,"identity":849,"label":850,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":851,"versions":853,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":855},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[852,368],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[854],"2.3.2",[56],{"id":857,"slug":858,"identity":859,"label":860,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":861,"versions":862,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":864},"package:pypi:nvidia-cublas-cu12","nvidia-cublas-cu12-1d052261","pypi:nvidia-cublas-cu12","nvidia-cublas-cu12",[368],[863],"12.8.3.14",[56],{"id":866,"slug":867,"identity":868,"label":869,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":870,"versions":871,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":873},"package:pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12-973480f1","pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12",[368],[872],"12.8.57",[56],{"id":875,"slug":876,"identity":877,"label":878,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":879,"versions":880,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":882},"package:pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12-e32b7f38","pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12",[368],[881],"12.8.61",[56],{"id":884,"slug":885,"identity":886,"label":887,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":888,"versions":889,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":890},"package:pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12-2b875d2a","pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12",[368],[872],[56],{"id":892,"slug":893,"identity":894,"label":895,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":896,"versions":897,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":899},"package:pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12-a21dce6d","pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12",[368],[898],"9.7.1.26",[56],{"id":901,"slug":902,"identity":903,"label":904,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":905,"versions":906,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":908},"package:pypi:nvidia-cufft-cu12","nvidia-cufft-cu12-21ff54dd","pypi:nvidia-cufft-cu12","nvidia-cufft-cu12",[368],[907],"11.3.3.41",[56],{"id":910,"slug":911,"identity":912,"label":913,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":914,"versions":915,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":917},"package:pypi:nvidia-cufile-cu12","nvidia-cufile-cu12-14048140","pypi:nvidia-cufile-cu12","nvidia-cufile-cu12",[368],[916],"1.13.0.11",[56],{"id":919,"slug":920,"identity":921,"label":922,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":923,"versions":924,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":926},"package:pypi:nvidia-curand-cu12","nvidia-curand-cu12-2fed778b","pypi:nvidia-curand-cu12","nvidia-curand-cu12",[368],[925],"10.3.9.55",[56],{"id":928,"slug":929,"identity":930,"label":931,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":932,"versions":933,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":935},"package:pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12-7db0a33a","pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12",[368],[934],"11.7.2.55",[56],{"id":937,"slug":938,"identity":939,"label":940,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":941,"versions":942,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":944},"package:pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12-d7e6a309","pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12",[368],[943],"12.5.7.53",[56],{"id":946,"slug":947,"identity":948,"label":949,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":950,"versions":951,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":953},"package:pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12-97587f50","pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12",[368],[952],"0.6.3",[56],{"id":955,"slug":956,"identity":957,"label":958,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":959,"versions":960,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":962},"package:pypi:nvidia-nccl-cu12","nvidia-nccl-cu12-90361558","pypi:nvidia-nccl-cu12","nvidia-nccl-cu12",[348],[961],"2.26.2",[56],{"id":964,"slug":965,"identity":966,"label":967,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":968,"versions":969,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":970},"package:pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12-6d08af75","pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12",[368],[881],[56],{"id":972,"slug":973,"identity":974,"label":975,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":976,"versions":977,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":979},"package:pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12-9a2d0378","pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12",[337,368],[978],"12.8.55",[56],{"id":981,"slug":982,"identity":983,"label":984,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":985,"versions":986,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":988},"package:pypi:open-clip-torch","open-clip-torch-1f82ec28","pypi:open-clip-torch","open-clip-torch",[429],[987],"2.32.0",[56],{"id":990,"slug":991,"identity":992,"label":993,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":994,"versions":996,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":998},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[995,368],"Apache-2.0 OR BSD-2-Clause",[997],"24.2",[56],{"id":1000,"slug":1001,"identity":1002,"label":1003,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1004,"versions":1005,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1007},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[348,368],[1006],"2.2.3",[56],{"id":1009,"slug":1010,"identity":1011,"label":1012,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1013,"versions":1014,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1016},"package:pypi:pandas-stubs","pandas-stubs-b4eaabf3","pypi:pandas-stubs","pandas-stubs",[348],[1015],"2.3.2.250827",[56],{"id":1018,"slug":1019,"identity":1020,"label":1021,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1022,"versions":1023,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1025},"package:pypi:parso","parso-fa59fdde","pypi:parso","parso",[429],[1024],"0.8.4",[56],{"id":1027,"slug":1028,"identity":1029,"label":1030,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1031,"versions":1033,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1035},"package:pypi:pexpect","pexpect-9ad65a0c","pypi:pexpect","pexpect",[1032],"ISC",[1034],"4.9.0",[56],{"id":1037,"slug":1038,"identity":1039,"label":1040,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1041,"versions":1042,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1044},"package:pypi:prompt-toolkit","prompt-toolkit-e6f4118a","pypi:prompt-toolkit","prompt-toolkit",[348,368],[1043],"3.0.51",[56],{"id":1046,"slug":1047,"identity":1048,"label":1049,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1050,"versions":1051,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1053},"package:pypi:ptyprocess","ptyprocess-ec2650c7","pypi:ptyprocess","ptyprocess",[1032],[1052],"0.7.0",[56],{"id":1055,"slug":1056,"identity":1057,"label":1058,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1059,"versions":1060,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1062},"package:pypi:pure-eval","pure-eval-24d2bc1c","pypi:pure-eval","pure-eval",[429],[1061],"0.2.3",[56],{"id":1064,"slug":1065,"identity":1066,"label":1067,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1068,"versions":1069,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1071},"package:pypi:pydeck","pydeck-75380c92","pypi:pydeck","pydeck",[337],[1070],"0.9.1",[56],{"id":1073,"slug":1074,"identity":1075,"label":1076,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1077,"versions":1078,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1080},"package:pypi:pyogrio","pyogrio-ff34272a","pypi:pyogrio","pyogrio",[429],[1079],"0.10.0",[56],{"id":1082,"slug":1083,"identity":1084,"label":1085,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1086,"versions":1087,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1089},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[429],[1088],"3.2.1",[56],{"id":1091,"slug":1092,"identity":1093,"label":1094,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1095,"versions":1096,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1098},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[429],[1097],"3.7.0",[56],{"id":1100,"slug":1101,"identity":1102,"label":1103,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1104,"versions":1105,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1107},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[368],[1106],"2.9.0.post0",[56],{"id":1109,"slug":1110,"identity":1111,"label":1112,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1113,"versions":1114,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1116},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[429],[1115],"2025.1",[56],{"id":1118,"slug":1119,"identity":1120,"label":1121,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1122,"versions":1123,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1125},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[429],[1124],"6.0.2",[56],{"id":1127,"slug":1128,"identity":1129,"label":1130,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1131,"versions":1132,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1134},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[429],[1133],"0.36.2",[56],{"id":1136,"slug":1137,"identity":1138,"label":1139,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1140,"versions":1142,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1144},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[337,1141],"Apache-2.0 AND CNRI-Python",[1143],"2024.11.6",[56],{"id":1146,"slug":1147,"identity":1148,"label":1149,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1150,"versions":1151,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1153},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[429],[1152],"0.27.1",[56],{"id":1155,"slug":1156,"identity":1157,"label":1158,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1159,"versions":1160,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1162},"package:pypi:safetensors","safetensors-2a32c77a","pypi:safetensors","safetensors",[368],[1161],"0.5.3",[56],{"id":1164,"slug":1165,"identity":1166,"label":1167,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1168,"versions":1169,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1171},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[368],[1170],"1.15.2",[56],{"id":1173,"slug":1174,"identity":1175,"label":1176,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1177,"versions":1178,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1180},"package:pypi:seaborn","seaborn-1018de9a","pypi:seaborn","seaborn",[368],[1179],"0.13.2",[56],{"id":1182,"slug":1183,"identity":1184,"label":1185,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1186,"versions":1187,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1189},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[348],[1188],"2.0.7",[56],{"id":1191,"slug":1192,"identity":1193,"label":1194,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1195,"versions":1196,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1198},"package:pypi:six","six-3c3888bd","pypi:six","six",[429],[1197],"1.17.0",[56],{"id":1200,"slug":1201,"identity":1202,"label":1203,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1204,"versions":1205,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1207},"package:pypi:smmap","smmap-943fc5aa","pypi:smmap","smmap",[348],[1206],"5.0.2",[56],{"id":1209,"slug":1210,"identity":1211,"label":1212,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1213,"versions":1214,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1215},"package:pypi:stack-data","stack-data-d640fe0e","pypi:stack-data","stack-data",[429],[952],[56],{"id":1217,"slug":1218,"identity":1219,"label":1220,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1221,"versions":1222,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1224},"package:pypi:streamlit-folium","streamlit-folium-e76fb4ea","pypi:streamlit-folium","streamlit-folium",[],[1223],"0.25.1",[56],{"id":1226,"slug":1227,"identity":1228,"label":1229,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1230,"versions":1231,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1233},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[348,429,368],[1232],"1.14.0",[56],{"id":1235,"slug":1236,"identity":1237,"label":1238,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1239,"versions":1240,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1242},"package:pypi:tenacity","tenacity-415454f8","pypi:tenacity","tenacity",[337],[1241],"9.1.2",[56],{"id":1244,"slug":1245,"identity":1246,"label":1247,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1248,"versions":1249,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1251},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[348],[1250],"3.6.0",[56],{"id":1253,"slug":1254,"identity":1255,"label":1256,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1257,"versions":1258,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1260},"package:pypi:timm","timm-4594fb75","pypi:timm","timm",[337],[1259],"1.0.15",[56],{"id":1262,"slug":1263,"identity":1264,"label":1265,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1266,"versions":1267,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1269},"package:pypi:toml","toml-490ac3c8","pypi:toml","toml",[429],[1268],"0.10.2",[56],{"id":1271,"slug":1272,"identity":1273,"label":1274,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1275,"versions":1276,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1278},"package:pypi:torchvision","torchvision-7f85cafa","pypi:torchvision","torchvision",[348],[1277],"0.24.1",[56],{"id":1280,"slug":1281,"identity":1282,"label":1283,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1284,"versions":1285,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1287},"package:pypi:traitlets","traitlets-52bd6ddb","pypi:traitlets","traitlets",[348],[1286],"5.14.3",[56],{"id":1289,"slug":1290,"identity":1291,"label":1292,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1293,"versions":1294,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1296},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[429],[1295],"3.3.0",[56],{"id":1298,"slug":1299,"identity":1300,"label":1301,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1302,"versions":1303,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1305},"package:pypi:types-pytz","types-pytz-327ed57f","pypi:types-pytz","types-pytz",[337],[1304],"2025.2.0.20250809",[56],{"id":72,"slug":73,"identity":1307,"label":74,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1308,"versions":1310,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1312},"pypi:typing-extensions",[1309,368],"PSF-2.0",[1311],"4.13.1",[56],{"id":1314,"slug":1315,"identity":1316,"label":1317,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1318,"versions":1319,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1320},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[337],[1115],[56],{"id":1322,"slug":1323,"identity":1324,"label":1325,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1326,"versions":1327,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1329},"package:pypi:watchdog","watchdog-55ddb444","pypi:watchdog","watchdog",[337],[1328],"6.0.0",[56],{"id":1331,"slug":1332,"identity":1333,"label":1334,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1335,"versions":1336,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1338},"package:pypi:wcwidth","wcwidth-038a8957","pypi:wcwidth","wcwidth",[429],[1337],"0.2.13",[56],{"id":1340,"slug":1341,"identity":1342,"label":1343,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1344,"versions":1345,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1347},"package:pypi:xyzservices","xyzservices-a1955a18","pypi:xyzservices","xyzservices",[348],[1346],"2025.4.0",[56],[1349,1387,1424,1446,1481,1505,1527,1551,1593,1620,1653,1684,1720,1742,1785,1812,1838,1865,1895,1921,1950,1980,2003,2030,2056,2078,2105,2134,2158,2182,2208,2237,2276,2300,2324,2352,2376,2398,2421,2457,2481,2504,2525,2555,2578,2608,2658,2695,2722,2750,2771,2797,2824,2850,2886,2912,2935,2956,2979,3011,3043,3073,3097,3122,3162,3185,3214,3238,3261,3298,3330,3352,3384,3403,3434,3457,3482,3509,3537,3575,3601,3628,3655,3675,3705,3727,3759,3781,3806,3860,3885,3909,3941,3961,3985,4016,4037,4070,4090,4110,4149,4177,4200,4223,4246,4267,4292,4317,4341,4374,4399,4426,4447,4471,4494,4522,4541,4575,4608,4635,4667,4697,4718,4740,4761,4783,4826,4853,4878,4902,4931,4951,4972,4993,5018,5041,5062,5083,5110,5133,5156,5180,5207,5232,5256,5280,5305,5321,5348,5374,5396,5422,5442,5461,5494,5520,5547,5574,5601,5623,5651,5674,5701,5723,5745,5775,5795,5829,5859,5879,5899,5923,5951,5978,6020,6038,6062,6092,6114,6134,6186,6209,6234,6261,6285,6307,6339,6367,6394,6417,6442,6463,6489,6519,6541,6561,6578,6597,6614,6635,6651,6666,6683,6698,6715,6732,6749,6762,6775,6788,6801,6814,6827,6840,6853],{"id":105,"slug":1350,"dossier":90,"summary":1351,"aliases":1352,"sourceIds":1355,"published":1356,"modified":1357,"checkedAt":7,"severity":1358,"references":1362,"versionKeys":1376,"packageCount":32,"repositoryCount":417},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[1353,1354],"BIT-pillow-2026-112390","CVE-2026-112390",[105],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[1359],{"type":1360,"score":1361},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1363,1366,1369,1371,1374],{"type":1364,"url":1365},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1367,"url":1368},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1364,"url":1370},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1372,"url":1373},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1364,"url":1375},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",{"id":106,"slug":1388,"dossier":47,"summary":1389,"aliases":1390,"sourceIds":1393,"published":1394,"modified":1395,"checkedAt":7,"severity":1396,"references":1402,"versionKeys":1420,"packageCount":32,"repositoryCount":34},"ghsa-239g-whfq-7xj9-ede3fcd6","GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution",[1391,1392],"CVE-2026-87817","PYSEC-2026-3982",[106,1392],"2026-09-09T12:17:16.830Z","2026-09-30T23:45:04.022111787Z",[1397,1400],{"type":1398,"score":1399},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1360,"score":1401},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1403,1406,1408,1410,1412,1414,1416,1418],{"type":1404,"url":1405},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-239g-whfq-7xj9",{"type":1367,"url":1407},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87817",{"type":1364,"url":1409},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2218",{"type":1364,"url":1411},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fc7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b",{"type":1372,"url":1413},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython",{"type":1364,"url":1415},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.60",{"type":1364,"url":1417},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3982.yaml",{"type":1367,"url":1419},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",[1421,1422,1423],"pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46",{"id":107,"slug":1425,"dossier":47,"summary":1426,"aliases":1427,"sourceIds":1429,"published":1430,"modified":1431,"checkedAt":7,"severity":1432,"references":1435,"versionKeys":1445,"packageCount":32,"repositoryCount":34},"ghsa-23mf-xhv8-69c2-0feffb42","GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)",[1428],"CVE-2026-110859",[107],"2026-10-27T15:28:03Z","2026-10-27T15:47:08.812491596Z",[1433],{"type":1360,"score":1434},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1436,1438,1440,1442,1443],{"type":1364,"url":1437},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-23mf-xhv8-69c2",{"type":1364,"url":1439},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2233",{"type":1364,"url":1441},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8da65080849a56a2fc9f3e7817bbf0524e8397d5",{"type":1372,"url":1413},{"type":1364,"url":1444},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.0",[1421,1422,1423],{"id":108,"slug":1447,"dossier":47,"summary":1448,"aliases":1449,"sourceIds":1452,"published":1453,"modified":1454,"checkedAt":7,"severity":1455,"references":1458,"versionKeys":1479,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1450,1451],"CVE-2024-39689","PYSEC-2024-230",[108,1451],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1456],{"type":1398,"score":1457},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1459,1461,1463,1466,1468,1470,1473,1475,1477],{"type":1367,"url":1460},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1367,"url":1462},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1464,"url":1465},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1372,"url":1467},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1364,"url":1469},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1471,"url":1472},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1364,"url":1474},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1367,"url":1476},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1367,"url":1478},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1480],"pypi:certifi@2024.6.2",{"id":109,"slug":1482,"dossier":90,"summary":1483,"aliases":1484,"sourceIds":1487,"published":1488,"modified":1489,"checkedAt":7,"severity":1490,"references":1493,"versionKeys":1504,"packageCount":32,"repositoryCount":417},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1485,1486],"BIT-pillow-2026-96638","CVE-2026-96638",[109],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1491],{"type":1398,"score":1492},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1494,1496,1498,1500,1502,1503],{"type":1364,"url":1495},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1367,"url":1497},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1364,"url":1499},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1364,"url":1501},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":110,"slug":1506,"dossier":90,"summary":1507,"aliases":1508,"sourceIds":1511,"published":1512,"modified":1513,"checkedAt":7,"severity":1514,"references":1517,"versionKeys":1526,"packageCount":32,"repositoryCount":417},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1509,1510],"BIT-pillow-2026-112391","CVE-2026-112391",[110],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1515],{"type":1360,"score":1516},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1518,1520,1522,1524,1525],{"type":1364,"url":1519},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1367,"url":1521},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1364,"url":1523},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":111,"slug":1528,"dossier":90,"summary":1529,"aliases":1530,"sourceIds":1534,"published":1535,"modified":1536,"checkedAt":7,"severity":1537,"references":1541,"versionKeys":1550,"packageCount":32,"repositoryCount":417},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1531,1532,1533],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[111,1533],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1538,1539],{"type":1360,"score":1361},{"type":1398,"score":1540},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1542,1544,1546,1548,1549],{"type":1464,"url":1543},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1367,"url":1545},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1464,"url":1547},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":112,"slug":1552,"dossier":47,"summary":1553,"aliases":1554,"sourceIds":1557,"published":1558,"modified":1559,"checkedAt":7,"severity":1560,"references":1562,"versionKeys":1583,"packageCount":32,"repositoryCount":103},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1555,1556],"CVE-2026-104851","PYSEC-2026-4217",[112,1556],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1561],{"type":1398,"score":1399},[1563,1565,1567,1569,1571,1573,1575,1577,1579,1581],{"type":1364,"url":1564},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1367,"url":1566},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1364,"url":1568},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1364,"url":1570},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1364,"url":1572},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1364,"url":1574},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1372,"url":1576},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1364,"url":1578},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1372,"url":1580},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1367,"url":1582},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1584,1585,1586,1587,1588,1589,1590,1591,1592],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",{"id":113,"slug":1594,"dossier":47,"summary":1595,"aliases":1596,"sourceIds":1599,"published":1600,"modified":1601,"checkedAt":7,"severity":1602,"references":1609,"versionKeys":1619,"packageCount":32,"repositoryCount":34},"ghsa-284h-m62q-gf8w-da9acb0c","GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE",[1597,1598],"CVE-2026-78676","PYSEC-2026-3786",[113,1598],"2026-08-25T02:16:52.030Z","2026-09-08T19:00:06.885837775Z",[1603,1605,1607],{"type":1398,"score":1604},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1360,"score":1606},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1360,"score":1608},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1610,1612,1614,1615,1617],{"type":1404,"url":1611},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-284h-m62q-gf8w",{"type":1367,"url":1613},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78676",{"type":1372,"url":1413},{"type":1364,"url":1616},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3786.yaml",{"type":1367,"url":1618},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-config-injection",[1421,1422,1423],{"id":114,"slug":1621,"dossier":47,"summary":1622,"aliases":1623,"sourceIds":1626,"published":1627,"modified":1628,"checkedAt":7,"severity":1629,"references":1632,"versionKeys":1643,"packageCount":32,"repositoryCount":427},"ghsa-29pf-2h5f-8g72-1d83ebb4","HuggingFace transformers vulnerable to remote code execution",[1624,1625],"CVE-2026-4372","PYSEC-2026-2289",[114,1625],"2026-05-24T14:16:16.917Z","2026-09-10T03:50:45.254378086Z",[1630],{"type":1398,"score":1631},"CVSS:3.0\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1633,1635,1637,1639,1641],{"type":1367,"url":1634},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4372",{"type":1464,"url":1636},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fa7f8e7ff37d87d1a1a0c8cf607971c607741452f",{"type":1372,"url":1638},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers",{"type":1404,"url":1640},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F1f693a6e-6836-4b8b-a0bd-ca036fba8884",{"type":1367,"url":1642},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-29pf-2h5f-8g72",[1644,1645,1646,1647,1648,1649,1650,1651,1652],"pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6",{"id":115,"slug":1654,"dossier":47,"summary":1655,"aliases":1656,"sourceIds":1659,"published":1660,"modified":1661,"checkedAt":7,"severity":1662,"references":1665,"versionKeys":1683,"packageCount":32,"repositoryCount":34},"ghsa-2f96-g7mh-g2hx-dd7ec02d","GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist",[1657,1658],"CVE-2026-67325","PYSEC-2026-3836",[115,1658],"2026-07-21T19:43:43Z","2026-09-23T05:15:05.950374846Z",[1663],{"type":1398,"score":1664},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1666,1668,1670,1672,1674,1675,1677,1679,1681],{"type":1364,"url":1667},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",{"type":1367,"url":1669},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67325",{"type":1364,"url":1671},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2161",{"type":1364,"url":1673},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F56806080c1348749b07daa4a2024ce47b3cad285",{"type":1372,"url":1413},{"type":1364,"url":1676},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.51",{"type":1364,"url":1678},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-option-prefix-abbreviation",{"type":1372,"url":1680},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fgitpython",{"type":1367,"url":1682},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",[1421,1422,1423],{"id":116,"slug":1685,"dossier":47,"summary":1686,"aliases":1687,"sourceIds":1690,"published":1691,"modified":1692,"checkedAt":7,"severity":1693,"references":1696,"versionKeys":1713,"packageCount":32,"repositoryCount":1719},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1688,1689],"CVE-2025-66471","PYSEC-2026-1994",[116,1689],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1694],{"type":1360,"score":1695},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1697,1699,1701,1703,1705,1707,1709,1711],{"type":1364,"url":1698},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1367,"url":1700},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1464,"url":1702},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1364,"url":1704},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1367,"url":1706},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1364,"url":1708},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1372,"url":1710},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1372,"url":1712},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1714,1715,1716,1717,1718],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":117,"slug":1721,"dossier":90,"summary":1722,"aliases":1723,"sourceIds":1726,"published":1727,"modified":1728,"checkedAt":7,"severity":1729,"references":1732,"versionKeys":1741,"packageCount":32,"repositoryCount":417},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1724,1725],"BIT-pillow-2026-112393","CVE-2026-112393",[117],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1730],{"type":1360,"score":1731},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1733,1735,1737,1739,1740],{"type":1364,"url":1734},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1367,"url":1736},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1364,"url":1738},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":118,"slug":1743,"dossier":47,"summary":1744,"aliases":1745,"sourceIds":1749,"published":1750,"modified":1751,"checkedAt":7,"severity":1752,"references":1759,"versionKeys":1781,"packageCount":32,"repositoryCount":468},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1746,1747,1748],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[118,1748],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1753,1755,1757],{"type":1398,"score":1754},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1360,"score":1756},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1398,"score":1758},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1760,1762,1765,1767,1769,1771,1773,1775,1777,1779],{"type":1367,"url":1761},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1763,"url":1764},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1763,"url":1766},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1364,"url":1768},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1372,"url":1770},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1364,"url":1772},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1763,"url":1774},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1367,"url":1776},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1367,"url":1778},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1367,"url":1780},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1782,1783,1784],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":119,"slug":1786,"dossier":47,"summary":1787,"aliases":1788,"sourceIds":1791,"published":1792,"modified":1793,"checkedAt":7,"severity":1794,"references":1797,"versionKeys":1811,"packageCount":32,"repositoryCount":468},"ghsa-37mw-44qp-f5jm-fb05555e","Transformers is vulnerable to ReDoS attack through its DonutProcessor class",[1789,1790],"CVE-2025-3933","PYSEC-2026-1977",[119,1790],"2025-07-11T12:30:32Z","2026-09-10T03:50:57.888142744Z",[1795],{"type":1398,"score":1796},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1798,1800,1802,1804,1805,1807,1809],{"type":1367,"url":1799},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3933",{"type":1364,"url":1801},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F37788",{"type":1364,"url":1803},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Febbe9b12dd75b69f92100d684c47f923ee262a93",{"type":1372,"url":1638},{"type":1364,"url":1806},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25282953-5827-4384-bb6f-5790d275721b",{"type":1372,"url":1808},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftransformers",{"type":1367,"url":1810},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-37mw-44qp-f5jm",[1644,1645,1646],{"id":120,"slug":1813,"dossier":47,"summary":1814,"aliases":1815,"sourceIds":1818,"published":1819,"modified":1820,"checkedAt":7,"severity":1821,"references":1824,"versionKeys":1837,"packageCount":32,"repositoryCount":1719},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1816,1817],"CVE-2026-21441","PYSEC-2026-1996",[120,1817],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1822,1823],{"type":1398,"score":1540},{"type":1360,"score":1695},[1825,1827,1829,1831,1832,1834,1835],{"type":1364,"url":1826},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1367,"url":1828},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1464,"url":1830},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1372,"url":1710},{"type":1364,"url":1833},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1372,"url":1712},{"type":1367,"url":1836},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1714,1715,1716,1717,1718],{"id":121,"slug":1839,"dossier":47,"summary":1840,"aliases":1841,"sourceIds":1844,"published":1845,"modified":1846,"checkedAt":7,"severity":1847,"references":1852,"versionKeys":1864,"packageCount":32,"repositoryCount":34},"ghsa-3f7w-8rr8-f37f-9cab61a6","GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read",[1842,1843],"CVE-2026-73620","PYSEC-2026-3949",[121,1843],"2026-08-03T20:09:56Z","2026-09-10T13:10:44.075529324Z",[1848,1850],{"type":1398,"score":1849},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1360,"score":1851},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1853,1855,1857,1859,1860,1862],{"type":1404,"url":1854},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3f7w-8rr8-f37f",{"type":1364,"url":1856},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2193",{"type":1364,"url":1858},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F3af0c2516c5e18c829da30338614688f6b69b49c",{"type":1372,"url":1413},{"type":1364,"url":1861},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.57",{"type":1367,"url":1863},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-and-read",[1421,1422,1423],{"id":122,"slug":1866,"dossier":47,"summary":1867,"aliases":1868,"sourceIds":1870,"published":1871,"modified":1872,"checkedAt":7,"severity":1873,"references":1875,"versionKeys":1888,"packageCount":32,"repositoryCount":427},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[1869],"CVE-2026-103261",[122],"2026-09-30T23:49:25Z","2026-10-02T03:56:09.601689224Z",[1874],{"type":1398,"score":1796},[1876,1878,1880,1882,1884,1886],{"type":1364,"url":1877},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1364,"url":1879},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1364,"url":1881},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1364,"url":1883},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1372,"url":1885},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1364,"url":1887},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1889,1890,1891,1892,1893,1894],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7",{"id":123,"slug":1896,"dossier":90,"summary":1897,"aliases":1898,"sourceIds":1902,"published":1903,"modified":1904,"checkedAt":7,"severity":1905,"references":1909,"versionKeys":1920,"packageCount":32,"repositoryCount":417},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1899,1900,1901],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[123,1901],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1906,1908],{"type":1360,"score":1907},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":1492},[1910,1912,1914,1916,1918,1919],{"type":1367,"url":1911},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1367,"url":1913},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1763,"url":1915},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1464,"url":1917},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":124,"slug":1922,"dossier":47,"summary":1923,"aliases":1924,"sourceIds":1927,"published":1928,"modified":1929,"checkedAt":7,"severity":1930,"references":1935,"versionKeys":1949,"packageCount":32,"repositoryCount":34},"ghsa-3rp5-jjmw-4wv2-6d7352e6","GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)",[1925,1926],"CVE-2026-69097","PYSEC-2026-3981",[124,1926],"2026-07-24T16:22:02Z","2026-10-23T21:47:05Z",[1931,1933],{"type":1398,"score":1932},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1398,"score":1934},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1936,1938,1940,1942,1943,1945,1947],{"type":1404,"url":1937},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3rp5-jjmw-4wv2",{"type":1364,"url":1939},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2176",{"type":1364,"url":1941},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed1b924f4e2d2ee7bab296df77b978af21853f1",{"type":1372,"url":1413},{"type":1364,"url":1944},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.53",{"type":1364,"url":1946},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3981.yaml",{"type":1367,"url":1948},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-submodule-names",[1421,1422,1423],{"id":125,"slug":1951,"dossier":47,"summary":1952,"aliases":1953,"sourceIds":1956,"published":1957,"modified":1958,"checkedAt":7,"severity":1959,"references":1962,"versionKeys":1979,"packageCount":32,"repositoryCount":34},"ghsa-3wxw-xv34-2frg-c013ae2d","GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)",[1954,1955],"CVE-2026-78679","PYSEC-2026-3837",[125,1955],"2026-09-08T19:42:22Z","2026-09-23T05:15:05.925079070Z",[1960],{"type":1398,"score":1961},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1963,1965,1967,1969,1971,1972,1974,1976,1977],{"type":1364,"url":1964},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",{"type":1367,"url":1966},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78679",{"type":1364,"url":1968},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2208",{"type":1364,"url":1970},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6",{"type":1372,"url":1413},{"type":1364,"url":1973},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.59",{"type":1364,"url":1975},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-tagreference-create",{"type":1372,"url":1680},{"type":1367,"url":1978},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",[1421,1422,1423],{"id":126,"slug":1981,"dossier":47,"summary":1982,"aliases":1983,"sourceIds":1986,"published":1987,"modified":1988,"checkedAt":7,"severity":1989,"references":1992,"versionKeys":2002,"packageCount":32,"repositoryCount":439},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1984,1985],"CVE-2026-49853","PYSEC-2026-3387",[126,1985],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1990],{"type":1398,"score":1991},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1993,1995,1996,1998,2000],{"type":1364,"url":1994},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1372,"url":1885},{"type":1372,"url":1997},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1367,"url":1999},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1367,"url":2001},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1889,1890,1891,1892,1893],{"id":127,"slug":2004,"dossier":90,"summary":2005,"aliases":2006,"sourceIds":2010,"published":2011,"modified":2012,"checkedAt":7,"severity":2013,"references":2018,"versionKeys":2029,"packageCount":32,"repositoryCount":417},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[2007,2008,2009],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[127,2009],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[2014,2016],{"type":1360,"score":2015},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":2017},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[2019,2021,2023,2025,2027,2028],{"type":1404,"url":2020},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1367,"url":2022},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1364,"url":2024},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1464,"url":2026},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":128,"slug":2031,"dossier":47,"summary":2032,"aliases":2033,"sourceIds":2037,"published":2038,"modified":2039,"checkedAt":7,"severity":2040,"references":2042,"versionKeys":2054,"packageCount":32,"repositoryCount":2055},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[2034,2035,2036],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[128,2036],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[2041],{"type":1398,"score":1540},[2043,2045,2047,2049,2051,2052],{"type":1404,"url":2044},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1367,"url":2046},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1464,"url":2048},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1364,"url":2050},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1372,"url":1373},{"type":1367,"url":2053},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1377,1378,1379,1380,1381,1382,1383,1384,1385],18,{"id":129,"slug":2057,"dossier":90,"summary":2058,"aliases":2059,"sourceIds":2062,"published":2063,"modified":2064,"checkedAt":7,"severity":2065,"references":2068,"versionKeys":2077,"packageCount":32,"repositoryCount":417},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[2060,2061],"BIT-pillow-2026-112395","CVE-2026-112395",[129],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[2066],{"type":1398,"score":2067},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[2069,2071,2073,2075,2076],{"type":1364,"url":2070},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1367,"url":2072},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1364,"url":2074},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":130,"slug":2079,"dossier":47,"summary":2080,"aliases":2081,"sourceIds":2084,"published":2085,"modified":2086,"checkedAt":7,"severity":2087,"references":2090,"versionKeys":2103,"packageCount":32,"repositoryCount":2104},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[2082,2083],"CVE-2025-50182","PYSEC-2026-1997",[130,2083],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[2088],{"type":1398,"score":2089},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2091,2093,2095,2097,2098,2100,2101],{"type":1364,"url":2092},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1367,"url":2094},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1464,"url":2096},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1372,"url":1710},{"type":1364,"url":2099},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1372,"url":1712},{"type":1367,"url":2102},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1714,1715,1716,1717],8,{"id":131,"slug":2106,"dossier":47,"summary":2107,"aliases":2108,"sourceIds":2111,"published":2112,"modified":2113,"checkedAt":7,"severity":2114,"references":2116,"versionKeys":2133,"packageCount":32,"repositoryCount":34},"ghsa-4gmw-gg2m-w46p-58f27cb8","GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\u002Freset\u002Fmerge_tree enables arbitrary file overwrite",[2109,2110],"CVE-2026-76219","PYSEC-2026-3838",[131,2110],"2026-08-07T15:33:57Z","2026-09-10T12:25:42.767166279Z",[2115],{"type":1398,"score":1849},[2117,2119,2121,2123,2125,2126,2128,2130,2131],{"type":1364,"url":2118},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",{"type":1367,"url":2120},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76219",{"type":1364,"url":2122},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2204",{"type":1364,"url":2124},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9b5dcaf85da5946dbf69dcd53f9edba08f760b32",{"type":1372,"url":1413},{"type":1364,"url":2127},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.58",{"type":1364,"url":2129},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-read-tree",{"type":1372,"url":1680},{"type":1367,"url":2132},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",[1421,1422,1423],{"id":132,"slug":2135,"dossier":90,"summary":2136,"aliases":2137,"sourceIds":2141,"published":2142,"modified":2143,"checkedAt":7,"severity":2144,"references":2146,"versionKeys":2157,"packageCount":32,"repositoryCount":417},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[2138,2139,2140],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[132,2140],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[2145],{"type":1398,"score":1492},[2147,2149,2151,2153,2155,2156],{"type":1367,"url":2148},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1367,"url":2150},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1763,"url":2152},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1464,"url":2154},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":133,"slug":2159,"dossier":47,"summary":2160,"aliases":2161,"sourceIds":2165,"published":2166,"modified":2167,"checkedAt":7,"severity":2168,"references":2172,"versionKeys":2181,"packageCount":32,"repositoryCount":427},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[2162,2163,2164],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[133,2164],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[2169,2171],{"type":1398,"score":2170},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1398,"score":1540},[2173,2175,2177,2179,2180],{"type":1404,"url":2174},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1367,"url":2176},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1464,"url":2178},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1372,"url":1373},{"type":1367,"url":1375},[1381,1382,1383,1384,1385,1386],{"id":134,"slug":2183,"dossier":47,"summary":2184,"aliases":2185,"sourceIds":2188,"published":2189,"modified":2190,"checkedAt":7,"severity":2191,"references":2194,"versionKeys":2207,"packageCount":32,"repositoryCount":449},"ghsa-4w7r-h757-3r74-ca8973bc","Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer",[2186,2187],"CVE-2025-6921","PYSEC-2026-1980",[134,2187],"2025-09-23T15:31:09Z","2026-09-10T03:50:27.867584538Z",[2192],{"type":1398,"score":2193},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2195,2197,2199,2201,2202,2204,2205],{"type":1367,"url":2196},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6921",{"type":1364,"url":2198},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F47c34fba5c303576560cb29767efb452ff12b8be",{"type":1364,"url":2200},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fd37f7517972f67e3f2194c000ed0f87f064e5099",{"type":1372,"url":1638},{"type":1364,"url":2203},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F287d15a7-6e7c-45d2-8c05-11e305776f1f",{"type":1372,"url":1808},{"type":1367,"url":2206},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4w7r-h757-3r74",[1644,1645,1646,1647],{"id":135,"slug":2209,"dossier":47,"summary":2210,"aliases":2211,"sourceIds":2215,"published":2216,"modified":2217,"checkedAt":7,"severity":2218,"references":2221,"versionKeys":2236,"packageCount":32,"repositoryCount":2055},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[2212,2213,2214],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[135,2214],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[2219],{"type":1398,"score":2220},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2222,2224,2226,2228,2230,2232,2234,2235],{"type":1404,"url":2223},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1367,"url":2225},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1464,"url":2227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1464,"url":2229},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1464,"url":2231},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1364,"url":2233},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1372,"url":1373},{"type":1367,"url":2053},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":136,"slug":2238,"dossier":47,"summary":2239,"aliases":2240,"sourceIds":2243,"published":2244,"modified":2245,"checkedAt":7,"severity":2246,"references":2249,"versionKeys":2272,"packageCount":32,"repositoryCount":2275},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[2241,2242],"CVE-2026-4539","PYSEC-2026-2987",[136,2242],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[2247,2248],{"type":1398,"score":1754},{"type":1360,"score":1756},[2250,2252,2254,2256,2258,2260,2262,2264,2266,2268,2270],{"type":1367,"url":2251},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1364,"url":2253},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1364,"url":2255},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1364,"url":2257},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1372,"url":2259},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1364,"url":2261},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1364,"url":2263},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1364,"url":2265},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1364,"url":2267},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1372,"url":2269},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1367,"url":2271},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[2273,2274],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",16,{"id":137,"slug":2277,"dossier":47,"summary":2278,"aliases":2279,"sourceIds":2282,"published":2283,"modified":2284,"checkedAt":7,"severity":2285,"references":2289,"versionKeys":2299,"packageCount":32,"repositoryCount":34},"ghsa-539m-9xh6-q6rr-c4575e3c","GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file \u002F --add-virtual-file, enabling arbitrary file read via Repo.archive()",[2280,2281],"CVE-2026-73619","PYSEC-2026-3948",[137,2281],"2026-08-03T20:14:28Z","2026-09-10T13:11:01.695990206Z",[2286,2287],{"type":1398,"score":1961},{"type":1360,"score":2288},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2290,2292,2293,2295,2296,2297],{"type":1404,"url":2291},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-539m-9xh6-q6rr",{"type":1364,"url":1856},{"type":1364,"url":2294},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca",{"type":1372,"url":1413},{"type":1364,"url":1861},{"type":1367,"url":2298},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-archive",[1421,1422,1423],{"id":138,"slug":2301,"dossier":47,"summary":2302,"aliases":2303,"sourceIds":2307,"published":2308,"modified":2309,"checkedAt":7,"severity":2310,"references":2313,"versionKeys":2323,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[2304,2305,2306],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[138,2306],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[2311,2312],{"type":1360,"score":1606},{"type":1398,"score":1604},[2314,2316,2318,2320,2322],{"type":1367,"url":2315},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1367,"url":2317},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1364,"url":2319},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1364,"url":2321},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1372,"url":1770},[1782],{"id":139,"slug":2325,"dossier":47,"summary":2326,"aliases":2327,"sourceIds":2329,"published":2330,"modified":2331,"checkedAt":7,"severity":2332,"references":2335,"versionKeys":2346,"packageCount":32,"repositoryCount":2351},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[2328],"CVE-2026-112907",[139],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[2333],{"type":1398,"score":2334},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2336,2338,2340,2342,2344],{"type":1364,"url":2337},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1364,"url":2339},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1364,"url":2341},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1372,"url":2343},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1364,"url":2345},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[2347,2348,2349,2350],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":140,"slug":2353,"dossier":90,"summary":2354,"aliases":2355,"sourceIds":2359,"published":2360,"modified":2361,"checkedAt":7,"severity":2362,"references":2366,"versionKeys":2375,"packageCount":32,"repositoryCount":417},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[2356,2357,2358],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[140,2358],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[2363,2365],{"type":1360,"score":2364},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":1540},[2367,2369,2371,2373,2374],{"type":1404,"url":2368},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1367,"url":2370},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1464,"url":2372},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":141,"slug":2377,"dossier":47,"summary":2378,"aliases":2379,"sourceIds":2381,"published":2382,"modified":2383,"checkedAt":7,"severity":2384,"references":2387,"versionKeys":2397,"packageCount":32,"repositoryCount":34},"ghsa-59cr-6r3x-644w-a8ec12fb","GitPython submodule update path traversal can write outside the repository",[2380],"CVE-2026-100689",[141],"2026-09-30T23:47:12Z","2026-10-01T00:00:05.754996881Z",[2385],{"type":1360,"score":2386},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2388,2390,2392,2394,2395],{"type":1364,"url":2389},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-59cr-6r3x-644w",{"type":1364,"url":2391},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2225",{"type":1364,"url":2393},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed0ebc2f2e74d979cdc367a4864a7731fdcc093",{"type":1372,"url":1413},{"type":1364,"url":2396},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.62",[1421,1422,1423],{"id":142,"slug":2399,"dossier":47,"summary":2400,"aliases":2401,"sourceIds":2404,"published":2405,"modified":2406,"checkedAt":7,"severity":2407,"references":2409,"versionKeys":2420,"packageCount":32,"repositoryCount":449},"ghsa-59p9-h35m-wg4g-68657c65","Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer",[2402,2403],"CVE-2025-6638","PYSEC-2026-1981",[142,2403],"2025-09-12T12:30:23Z","2026-09-10T03:50:58.113501288Z",[2408],{"type":1398,"score":2193},[2410,2412,2413,2414,2415,2417,2418],{"type":1367,"url":2411},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6638",{"type":1364,"url":2198},{"type":1364,"url":2200},{"type":1372,"url":1638},{"type":1364,"url":2416},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F6a6c933f-9ce8-4ded-8b3b-2c1444c61f36",{"type":1372,"url":1808},{"type":1367,"url":2419},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59p9-h35m-wg4g",[1644,1645,1646,1647],{"id":143,"slug":2422,"dossier":47,"summary":2423,"aliases":2424,"sourceIds":2428,"published":2429,"modified":2430,"checkedAt":7,"severity":2431,"references":2435,"versionKeys":2452,"packageCount":32,"repositoryCount":449},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[2425,2426,2427],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[143,2427],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[2432,2434],{"type":1360,"score":2433},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1398,"score":1664},[2436,2438,2440,2442,2444,2446,2448,2450],{"type":1404,"url":2437},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1367,"url":2439},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1763,"url":2441},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1464,"url":2443},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1364,"url":2445},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1372,"url":2447},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1364,"url":2449},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1471,"url":2451},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2453,2454,2455,2456],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":144,"slug":2458,"dossier":90,"summary":2459,"aliases":2460,"sourceIds":2464,"published":2465,"modified":2466,"checkedAt":7,"severity":2467,"references":2471,"versionKeys":2480,"packageCount":32,"repositoryCount":417},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2461,2462,2463],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[144,2463],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2468,2470],{"type":1360,"score":2469},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":1604},[2472,2474,2476,2478,2479],{"type":1404,"url":2473},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1367,"url":2475},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1464,"url":2477},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":145,"slug":2482,"dossier":47,"summary":2483,"aliases":2484,"sourceIds":2488,"published":2489,"modified":2490,"checkedAt":7,"severity":2491,"references":2493,"versionKeys":2503,"packageCount":32,"repositoryCount":2055},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2485,2486,2487],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[145,2487],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2492],{"type":1398,"score":1540},[2494,2496,2498,2499,2501,2502],{"type":1404,"url":2495},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1367,"url":2497},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1464,"url":2048},{"type":1364,"url":2500},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1372,"url":1373},{"type":1367,"url":2053},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":146,"slug":2505,"dossier":90,"summary":2506,"aliases":2507,"sourceIds":2510,"published":2511,"modified":2512,"checkedAt":7,"severity":2513,"references":2515,"versionKeys":2524,"packageCount":32,"repositoryCount":417},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2508,2509],"BIT-pillow-2026-112399","CVE-2026-112399",[146],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2514],{"type":1360,"score":2364},[2516,2518,2520,2522,2523],{"type":1364,"url":2517},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1367,"url":2519},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1364,"url":2521},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":147,"slug":2526,"dossier":47,"summary":2527,"aliases":2528,"sourceIds":2532,"published":2533,"modified":2534,"checkedAt":7,"severity":2535,"references":2539,"versionKeys":2553,"packageCount":32,"repositoryCount":2554},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2529,2530,2531],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[147,2531],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2536,2537],{"type":1398,"score":1758},{"type":1360,"score":2538},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2540,2542,2544,2546,2548,2550,2551],{"type":1367,"url":2541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1367,"url":2543},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1364,"url":2545},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1364,"url":2547},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1364,"url":2549},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1372,"url":1373},{"type":1367,"url":2552},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1380,1381,1382,1383,1384],13,{"id":148,"slug":2556,"dossier":47,"summary":2557,"aliases":2558,"sourceIds":2561,"published":2562,"modified":2563,"checkedAt":7,"severity":2564,"references":2567,"versionKeys":2577,"packageCount":32,"repositoryCount":34},"ghsa-5xxx-qhh7-9287-87d91b3e","GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\u002F-S, enabling arbitrary file read via Repo.blame()",[2559,2560],"CVE-2026-78678","PYSEC-2026-3788",[148,2560],"2026-08-25T02:16:52.313Z","2026-09-08T19:00:06.904435463Z",[2565,2566],{"type":1398,"score":1961},{"type":1360,"score":2288},[2568,2570,2572,2573,2575],{"type":1404,"url":2569},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-5xxx-qhh7-9287",{"type":1367,"url":2571},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78678",{"type":1372,"url":1413},{"type":1364,"url":2574},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3788.yaml",{"type":1367,"url":2576},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-blame",[1421,1422,1423],{"id":149,"slug":2579,"dossier":47,"summary":2580,"aliases":2581,"sourceIds":2585,"published":2586,"modified":2587,"checkedAt":7,"severity":2588,"references":2591,"versionKeys":2607,"packageCount":32,"repositoryCount":2055},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2582,2583,2584],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[149,2584],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2589],{"type":1360,"score":2590},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2592,2594,2596,2598,2600,2601,2603,2605],{"type":1364,"url":2593},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1367,"url":2595},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1364,"url":2597},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1364,"url":2599},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1372,"url":1373},{"type":1364,"url":2602},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1372,"url":2604},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1367,"url":2606},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":150,"slug":2609,"dossier":47,"summary":2610,"aliases":2611,"sourceIds":2616,"published":2617,"modified":2618,"checkedAt":7,"severity":2619,"references":2621,"versionKeys":2649,"packageCount":32,"repositoryCount":2657},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2612,2613,2614,2615],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[150,2615],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2620],{"type":1398,"score":1399},[2622,2624,2626,2628,2630,2632,2634,2636,2638,2640,2641,2643,2645,2647],{"type":1367,"url":2623},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1367,"url":2625},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1763,"url":2627},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1367,"url":2629},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1364,"url":2631},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1763,"url":2633},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1367,"url":2635},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1364,"url":2637},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1364,"url":2639},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1372,"url":1770},{"type":1464,"url":2642},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1367,"url":2644},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1364,"url":2646},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1364,"url":2648},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1782,1783,1784,2650,2651,2652,2653,2654,2655,2656],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":151,"slug":2659,"dossier":47,"summary":2660,"aliases":2661,"sourceIds":2664,"published":2665,"modified":2666,"checkedAt":7,"severity":2667,"references":2670,"versionKeys":2693,"packageCount":32,"repositoryCount":478},"ghsa-6497-prx7-gpmq-2b8ee85d","geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure",[2662,2663],"CVE-2025-69662","PYSEC-2026-62",[151,2663],"2026-01-30T19:16:11.967Z","2026-06-10T17:01:18.172032507Z",[2668],{"type":1398,"score":2669},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[2671,2673,2675,2677,2679,2681,2683,2685,2687,2689,2691],{"type":1367,"url":2672},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69662",{"type":1364,"url":2674},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fissues\u002F3679",{"type":1464,"url":2676},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fpull\u002F3681",{"type":1364,"url":2678},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fcommit\u002F6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419",{"type":1364,"url":2680},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas",{"type":1372,"url":2682},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas",{"type":1364,"url":2684},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Freleases\u002Ftag\u002Fv1.1.2",{"type":1364,"url":2686},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgeopandas\u002FPYSEC-2026-62.yaml",{"type":1364,"url":2688},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00025.html",{"type":1404,"url":2690},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas\u002F",{"type":1367,"url":2692},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6497-prx7-gpmq",[2694],"pypi:geopandas@1.0.1",{"id":152,"slug":2696,"dossier":47,"summary":2697,"aliases":2698,"sourceIds":2702,"published":2703,"modified":2704,"checkedAt":7,"severity":2705,"references":2710,"versionKeys":2721,"packageCount":32,"repositoryCount":103},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2699,2700,2701],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[152,2701],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2706,2708],{"type":1360,"score":2707},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":2709},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2711,2713,2715,2717,2719,2720],{"type":1367,"url":2712},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1367,"url":2714},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1763,"url":2716},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1464,"url":2718},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1372,"url":1373},{"type":1367,"url":1375},[1380,1381,1382,1383,1384,1385,1386],{"id":153,"slug":2723,"dossier":90,"summary":2724,"aliases":2725,"sourceIds":2728,"published":2729,"modified":2730,"checkedAt":7,"severity":2731,"references":2735,"versionKeys":2744,"packageCount":32,"repositoryCount":2749},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2726,2727],"CVE-2026-45409","PYSEC-2026-215",[153,2727],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2732,2733],{"type":1398,"score":1796},{"type":1360,"score":2734},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2736,2738,2740,2742],{"type":1367,"url":2737},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1367,"url":2739},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1372,"url":2741},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1364,"url":2743},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2745,2746,2747,2748],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":154,"slug":2751,"dossier":90,"summary":2752,"aliases":2753,"sourceIds":2756,"published":2757,"modified":2758,"checkedAt":7,"severity":2759,"references":2761,"versionKeys":2770,"packageCount":32,"repositoryCount":417},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2754,2755],"BIT-pillow-2026-112400","CVE-2026-112400",[154],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2760],{"type":1360,"score":2364},[2762,2764,2766,2768,2769],{"type":1364,"url":2763},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1367,"url":2765},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1364,"url":2767},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":155,"slug":2772,"dossier":90,"summary":2773,"aliases":2774,"sourceIds":2776,"published":2777,"modified":2778,"checkedAt":7,"severity":2779,"references":2782,"versionKeys":2791,"packageCount":32,"repositoryCount":417},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2775],"CVE-2026-112909",[155],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2780],{"type":1398,"score":2781},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2783,2785,2787,2788,2789,2790],{"type":1364,"url":2784},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1367,"url":2786},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1364,"url":2339},{"type":1364,"url":2341},{"type":1372,"url":2343},{"type":1364,"url":2345},[2792,2793,2794,2795,2796,2347,2348,2349,2350],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":156,"slug":2798,"dossier":47,"summary":2799,"aliases":2800,"sourceIds":2803,"published":2804,"modified":2805,"checkedAt":7,"severity":2806,"references":2811,"versionKeys":2823,"packageCount":32,"repositoryCount":427},"ghsa-69w3-r845-3855-1b4edc28","HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class",[2801,2802],"CVE-2026-1839","PYSEC-2026-2288",[156,2802],"2026-04-07T06:16:41.490Z","2026-09-10T03:50:43.300048881Z",[2807,2809],{"type":1398,"score":2808},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:H",{"type":1398,"score":2810},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2812,2814,2816,2817,2819,2821],{"type":1367,"url":2813},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1839",{"type":1464,"url":2815},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396",{"type":1372,"url":1638},{"type":1364,"url":2818},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Freleases\u002Ftag\u002Fv5.0.0rc3",{"type":1404,"url":2820},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c77bb97-e493-493d-9a88-c57f5c536485",{"type":1367,"url":2822},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69w3-r845-3855",[1644,1645,1646,1647,1648,1649,1650,1651,1652],{"id":157,"slug":2825,"dossier":47,"summary":2826,"aliases":2827,"sourceIds":2830,"published":2831,"modified":2832,"checkedAt":7,"severity":2833,"references":2837,"versionKeys":2849,"packageCount":32,"repositoryCount":34},"ghsa-6p8h-3wgx-97gf-635a010c","GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks",[2828,2829],"CVE-2026-73623","PYSEC-2026-3952",[157,2829],"2026-07-24T16:42:09Z","2026-09-10T13:11:03.995690741Z",[2834,2836],{"type":1398,"score":2835},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1398,"score":1664},[2838,2840,2842,2844,2845,2847],{"type":1404,"url":2839},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-6p8h-3wgx-97gf",{"type":1364,"url":2841},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2180",{"type":1364,"url":2843},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fffcb5359e87619f4fe4a70a4aff5f08c5580ba97",{"type":1372,"url":1413},{"type":1364,"url":2846},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.54",{"type":1367,"url":2848},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-template",[1421,1422,1423],{"id":158,"slug":2851,"dossier":90,"summary":2852,"aliases":2853,"sourceIds":2855,"published":2856,"modified":2857,"checkedAt":7,"severity":2858,"references":2861,"versionKeys":2873,"packageCount":32,"repositoryCount":2885},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2854],"PYSEC-2026-4320",[158,2854],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2859],{"type":1360,"score":2860},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2862,2864,2866,2868,2869,2871],{"type":1364,"url":2863},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1364,"url":2865},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1364,"url":2867},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1372,"url":1467},{"type":1372,"url":2870},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1367,"url":2872},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2874,1480,2875,2876,2877,2878,2879,2880,2881,2882,2883,2884],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":159,"slug":2887,"dossier":47,"summary":2888,"aliases":2889,"sourceIds":2893,"published":2894,"modified":2895,"checkedAt":7,"severity":2896,"references":2898,"versionKeys":2911,"packageCount":32,"repositoryCount":2055},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2890,2891,2892],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[159,2892],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2897],{"type":1398,"score":1540},[2899,2901,2903,2905,2907,2909,2910],{"type":1404,"url":2900},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1367,"url":2902},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1464,"url":2904},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1464,"url":2906},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1364,"url":2908},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1372,"url":1373},{"type":1367,"url":2602},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":160,"slug":2913,"dossier":47,"summary":2914,"aliases":2915,"sourceIds":2918,"published":2919,"modified":2920,"checkedAt":7,"severity":2921,"references":2923,"versionKeys":2934,"packageCount":32,"repositoryCount":32},"ghsa-6rvg-6v2m-4j46-e04ee614","Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[2916,2917],"CVE-2024-12720","PYSEC-2026-1982",[160,2917],"2025-03-20T12:32:43Z","2026-08-13T20:11:58.209202163Z",[2922],{"type":1398,"score":2193},[2924,2926,2928,2929,2931,2932],{"type":1367,"url":2925},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-12720",{"type":1364,"url":2927},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fdeac971c469bcbb182c2e52da0b82fb3bf54cccf",{"type":1372,"url":1638},{"type":1364,"url":2930},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F4bed1214-7835-4252-a853-22bbad891f98",{"type":1372,"url":1808},{"type":1367,"url":2933},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6rvg-6v2m-4j46",[1644],{"id":161,"slug":2936,"dossier":90,"summary":2937,"aliases":2938,"sourceIds":2941,"published":2942,"modified":2943,"checkedAt":7,"severity":2944,"references":2946,"versionKeys":2955,"packageCount":32,"repositoryCount":417},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[2939,2940],"BIT-pillow-2026-112401","CVE-2026-112401",[161],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[2945],{"type":1360,"score":2734},[2947,2949,2951,2953,2954],{"type":1364,"url":2948},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1367,"url":2950},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1364,"url":2952},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":162,"slug":2957,"dossier":47,"summary":2958,"aliases":2959,"sourceIds":2962,"published":2963,"modified":2964,"checkedAt":7,"severity":2965,"references":2970,"versionKeys":2978,"packageCount":32,"repositoryCount":34},"ghsa-7545-fcxq-7j24-84dd19fd","GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository",[2960,2961],"CVE-2026-44243","PYSEC-2026-2162",[162,2961],"2026-05-06T19:38:48Z","2026-09-10T03:50:45.903378498Z",[2966,2968],{"type":1398,"score":2967},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1360,"score":2969},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2971,2973,2975,2976],{"type":1404,"url":2972},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7545-fcxq-7j24",{"type":1367,"url":2974},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44243",{"type":1372,"url":1413},{"type":1464,"url":2977},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.48",[1421,1422,1423],{"id":163,"slug":2980,"dossier":47,"summary":2981,"aliases":2982,"sourceIds":2985,"published":2986,"modified":2987,"checkedAt":7,"severity":2988,"references":2991,"versionKeys":3004,"packageCount":32,"repositoryCount":2104},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[2983,2984],"CVE-2025-66034","PYSEC-2026-1389",[163,2984],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[2989],{"type":1398,"score":2990},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[2992,2994,2996,2998,3000,3002],{"type":1364,"url":2993},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1367,"url":2995},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1364,"url":2997},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1372,"url":2999},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1372,"url":3001},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1367,"url":3003},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[3005,3006,3007,3008,3009,3010],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",{"id":164,"slug":3012,"dossier":47,"summary":3013,"aliases":3014,"sourceIds":3017,"published":3018,"modified":3019,"checkedAt":7,"severity":3020,"references":3027,"versionKeys":3042,"packageCount":32,"repositoryCount":34},"ghsa-7833-fr7j-v32q-fd003872","GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)",[3015,3016],"CVE-2026-78675","PYSEC-2026-3785",[164,3016],"2026-08-25T02:16:51.887Z","2026-09-23T05:15:05.931147061Z",[3021,3023,3025],{"type":1398,"score":3022},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1360,"score":3024},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":3026},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3028,3030,3032,3034,3036,3037,3038,3040],{"type":1404,"url":3029},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7833-fr7j-v32q",{"type":1367,"url":3031},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78675",{"type":1364,"url":3033},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2211",{"type":1364,"url":3035},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fef7568e3b317ce617eacda39b8b54dcdff8c3b5c",{"type":1372,"url":1413},{"type":1364,"url":1973},{"type":1364,"url":3039},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3785.yaml",{"type":1367,"url":3041},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-local-file-content-disclosure-via-gitmodules",[1421,1422,1423],{"id":165,"slug":3044,"dossier":47,"summary":3045,"aliases":3046,"sourceIds":3050,"published":3051,"modified":3052,"checkedAt":7,"severity":3053,"references":3060,"versionKeys":3072,"packageCount":32,"repositoryCount":439},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[3047,3048,3049],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[165,3048,3049],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[3054,3056,3058],{"type":1398,"score":3055},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1398,"score":3057},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1398,"score":3059},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[3061,3063,3065,3066,3068,3070],{"type":1367,"url":3062},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1364,"url":3064},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1372,"url":1885},{"type":1364,"url":3067},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1367,"url":3069},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1367,"url":3071},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1889,1890,1891,1892],{"id":166,"slug":3074,"dossier":47,"summary":3075,"aliases":3076,"sourceIds":3077,"published":3078,"modified":3079,"checkedAt":7,"severity":3080,"references":3083,"versionKeys":3096,"packageCount":32,"repositoryCount":1719},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[166],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[3081],{"type":1398,"score":3082},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3084,3086,3088,3090,3092,3093,3094],{"type":1364,"url":3085},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1364,"url":3087},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1364,"url":3089},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1364,"url":3091},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1372,"url":1373},{"type":1364,"url":1375},{"type":1364,"url":3095},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1379,1380,1381,1382,1383,1384,1385,1386],{"id":167,"slug":3098,"dossier":47,"summary":3099,"aliases":3100,"sourceIds":3103,"published":3104,"modified":3105,"checkedAt":7,"severity":3106,"references":3108,"versionKeys":3121,"packageCount":32,"repositoryCount":478},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[3101,3102],"CVE-2025-47287","PYSEC-2026-1974",[167,3102],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[3107],{"type":1398,"score":1540},[3109,3111,3113,3115,3116,3118,3119],{"type":1364,"url":3110},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1367,"url":3112},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1364,"url":3114},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1372,"url":1885},{"type":1364,"url":3117},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1372,"url":1997},{"type":1367,"url":3120},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1889],{"id":168,"slug":3123,"dossier":47,"summary":3124,"aliases":3125,"sourceIds":3128,"published":3129,"modified":3130,"checkedAt":7,"severity":3131,"references":3134,"versionKeys":3151,"packageCount":32,"repositoryCount":2554},"ghsa-7gcm-g887-7qv7-55bb9ff1","protobuf affected by a JSON recursion depth bypass",[3126,3127],"CVE-2026-0994","PYSEC-2026-1805",[168,3127],"2026-01-23T15:31:35Z","2026-09-10T03:50:32.795512159Z",[3132],{"type":1360,"score":3133},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:L",[3135,3137,3139,3141,3143,3145,3147,3149],{"type":1367,"url":3136},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0994",{"type":1364,"url":3138},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fissues\u002F25070",{"type":1364,"url":3140},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fpull\u002F25239",{"type":1364,"url":3142},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",{"type":1364,"url":3144},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002Fd2b001626d137c62dfee6c88c87324102531868b",{"type":1372,"url":3146},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf",{"type":1372,"url":3148},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fprotobuf",{"type":1367,"url":3150},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7gcm-g887-7qv7",[3152,3153,3154,3155,3156,3157,3158,3159,3160,3161],"pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4",{"id":169,"slug":3163,"dossier":90,"summary":3164,"aliases":3165,"sourceIds":3169,"published":3170,"modified":3171,"checkedAt":7,"severity":3172,"references":3175,"versionKeys":3184,"packageCount":32,"repositoryCount":417},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[3166,3167,3168],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[169,3168],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[3173,3174],{"type":1360,"score":2364},{"type":1398,"score":1540},[3176,3178,3180,3182,3183],{"type":1464,"url":3177},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1367,"url":3179},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1464,"url":3181},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":170,"slug":3186,"dossier":47,"summary":3187,"aliases":3188,"sourceIds":3191,"published":3192,"modified":3193,"checkedAt":7,"severity":3194,"references":3199,"versionKeys":3210,"packageCount":32,"repositoryCount":468},"ghsa-7p48-42j8-8846-584b0522","Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)",[3189,3190],"CVE-2026-33682","PYSEC-2026-2285",[170,3190],"2026-03-25T21:20:52Z","2026-07-13T07:26:25.253864212Z",[3195,3197],{"type":1398,"score":3196},"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1398,"score":3198},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[3200,3202,3204,3206,3208],{"type":1367,"url":3201},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fsecurity\u002Fadvisories\u002FGHSA-7p48-42j8-8846",{"type":1367,"url":3203},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33682",{"type":1464,"url":3205},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002F23692ca70b2f2ac720c72d1feb4f190c9d6eed76",{"type":1372,"url":3207},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit",{"type":1367,"url":3209},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Freleases\u002Ftag\u002F1.54.0",[3211,3212,3213],"pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0",{"id":171,"slug":3215,"dossier":47,"summary":3216,"aliases":3217,"sourceIds":3219,"published":3220,"modified":3221,"checkedAt":7,"severity":3222,"references":3225,"versionKeys":3237,"packageCount":32,"repositoryCount":34},"ghsa-83vg-56qc-22m7-6ad99a7a","GitPython validates a submodule's \".git\" path only after cloning into it (RCE)",[3218],"CVE-2026-114145",[171],"2026-10-22T16:41:14Z","2026-10-22T16:45:04.297463159Z",[3223],{"type":1398,"score":3224},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3226,3228,3230,3232,3234,3235],{"type":1364,"url":3227},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-83vg-56qc-22m7",{"type":1367,"url":3229},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114145",{"type":1364,"url":3231},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2264",{"type":1364,"url":3233},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F97eadb888d2f99567e3113f4e455be4ca128f697",{"type":1372,"url":1413},{"type":1364,"url":3236},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.1",[1421,1422,1423],{"id":172,"slug":3239,"dossier":47,"summary":3240,"aliases":3241,"sourceIds":3243,"published":3244,"modified":3245,"checkedAt":7,"severity":3246,"references":3248,"versionKeys":3260,"packageCount":32,"repositoryCount":427},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[3242],"CVE-2026-91990",[172],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[3247],{"type":1360,"score":2734},[3249,3251,3253,3255,3257,3258],{"type":1364,"url":3250},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1364,"url":3252},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1364,"url":3254},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1364,"url":3256},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1372,"url":1885},{"type":1364,"url":3259},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1889,1890,1891,1892,1893,1894],{"id":173,"slug":3262,"dossier":47,"summary":3263,"aliases":3264,"sourceIds":3268,"published":3269,"modified":3270,"checkedAt":7,"severity":3271,"references":3275,"versionKeys":3297,"packageCount":32,"repositoryCount":2104},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[3265,3266,3267],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[173,3267],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[3272,3273],{"type":1398,"score":1754},{"type":1360,"score":3274},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3276,3278,3280,3282,3284,3286,3287,3289,3291,3293,3295],{"type":1367,"url":3277},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1364,"url":3279},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1364,"url":3281},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1364,"url":3283},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1364,"url":3285},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1372,"url":1770},{"type":1364,"url":3288},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1364,"url":3290},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1364,"url":3292},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1372,"url":3294},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1367,"url":3296},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1782,1783,1784,2650,2651],{"id":174,"slug":3299,"dossier":90,"summary":3300,"aliases":3301,"sourceIds":3304,"published":3305,"modified":3306,"checkedAt":7,"severity":3307,"references":3310,"versionKeys":3327,"packageCount":32,"repositoryCount":2749},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[3302,3303],"CVE-2026-97687","PYSEC-2026-4175",[174,3303],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[3308],{"type":1360,"score":3309},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3311,3313,3315,3317,3319,3321,3322,3324,3325],{"type":1364,"url":3312},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1367,"url":3314},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1364,"url":3316},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1364,"url":3318},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1364,"url":3320},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1372,"url":1710},{"type":1364,"url":3323},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1372,"url":1712},{"type":1367,"url":3326},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1714,1715,1716,1717,1718,3328,3329],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":175,"slug":3331,"dossier":47,"summary":3332,"aliases":3333,"sourceIds":3337,"published":3338,"modified":3339,"checkedAt":7,"severity":3340,"references":3343,"versionKeys":3351,"packageCount":32,"repositoryCount":417},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[3334,3335,3336],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[175,3336],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[3341,3342],{"type":1360,"score":2469},{"type":1398,"score":1604},[3344,3346,3348,3349,3350],{"type":1404,"url":3345},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1367,"url":3347},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1464,"url":2477},{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":176,"slug":3353,"dossier":47,"summary":3354,"aliases":3355,"sourceIds":3358,"published":3359,"modified":3360,"checkedAt":7,"severity":3361,"references":3368,"versionKeys":3383,"packageCount":32,"repositoryCount":34},"ghsa-8mcc-hrx5-hvxc-9da62a9f","GitPython: clone_from()\u002Fclone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination",[3356,3357],"CVE-2026-78677","PYSEC-2026-3787",[176,3357],"2026-08-25T02:16:52.173Z","2026-09-08T19:00:06.914140693Z",[3362,3364,3366],{"type":1398,"score":3363},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1360,"score":3365},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1360,"score":3367},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3369,3371,3373,3375,3377,3378,3379,3381],{"type":1404,"url":3370},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-8mcc-hrx5-hvxc",{"type":1367,"url":3372},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78677",{"type":1364,"url":3374},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2210",{"type":1364,"url":3376},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fb68afff45af0f49e79a3e2d2162018986b37ad5d",{"type":1372,"url":1413},{"type":1364,"url":1973},{"type":1364,"url":3380},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3787.yaml",{"type":1367,"url":3382},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-separate-git-dir",[1421,1422,1423],{"id":177,"slug":3385,"dossier":47,"summary":3386,"aliases":3387,"sourceIds":3389,"published":3390,"modified":3391,"checkedAt":7,"severity":3392,"references":3395,"versionKeys":3402,"packageCount":32,"repositoryCount":417},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[3388],"CVE-2026-112910",[177],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[3393],{"type":1398,"score":3394},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[3396,3398,3399,3400,3401],{"type":1364,"url":3397},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1364,"url":2339},{"type":1364,"url":2341},{"type":1372,"url":2343},{"type":1364,"url":2345},[2792,2793,2794,2795,2796,2347,2348,2349,2350],{"id":178,"slug":3404,"dossier":47,"summary":3405,"aliases":3406,"sourceIds":3409,"published":3410,"modified":3411,"checkedAt":7,"severity":3412,"references":3414,"versionKeys":3433,"packageCount":32,"repositoryCount":468},"ghsa-8qvm-5x2c-j2w7-8a075519","protobuf-python has a potential Denial of Service issue",[3407,3408],"CVE-2025-4565","PYSEC-2026-1806",[178,3408],"2025-06-16T16:02:58Z","2026-09-10T03:50:25.255076549Z",[3413],{"type":1360,"score":1361},[3415,3417,3419,3421,3423,3424,3426,3428,3430,3431],{"type":1364,"url":3416},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-735f-pc8j-v9w8",{"type":1364,"url":3418},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",{"type":1367,"url":3420},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-4565",{"type":1364,"url":3422},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F17838beda2943d08b8a9d4df5b68f5f04f26d901",{"type":1372,"url":3146},{"type":1364,"url":3425},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fdecoder_test.py#L87-L98",{"type":1364,"url":3427},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fmessage_test.py#L1436-L1478",{"type":1364,"url":3429},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Ftree\u002Fmain\u002Fpython#implementation-backends",{"type":1372,"url":3148},{"type":1367,"url":3432},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",[3152,3154,3155],{"id":179,"slug":3435,"dossier":47,"summary":3436,"aliases":3437,"sourceIds":3441,"published":3442,"modified":3443,"checkedAt":7,"severity":3444,"references":3446,"versionKeys":3456,"packageCount":32,"repositoryCount":2055},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[3438,3439,3440],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[179,3440],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[3445],{"type":1398,"score":1540},[3447,3449,3451,3452,3454,3455],{"type":1404,"url":3448},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1367,"url":3450},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1464,"url":2048},{"type":1364,"url":3453},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1372,"url":1373},{"type":1367,"url":2053},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":180,"slug":3458,"dossier":47,"summary":3459,"aliases":3460,"sourceIds":3463,"published":3464,"modified":3465,"checkedAt":7,"severity":3466,"references":3468,"versionKeys":3481,"packageCount":32,"repositoryCount":449},"ghsa-9356-575x-2w9m-908a1f8c","Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3461,3462],"CVE-2025-5197","PYSEC-2026-1983",[180,3462],"2025-08-06T12:31:20Z","2026-09-10T03:50:26.988216861Z",[3467],{"type":1398,"score":2193},[3469,3471,3473,3475,3476,3478,3479],{"type":1367,"url":3470},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-5197",{"type":1364,"url":3472},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F701caef704e356dc2f9331cc3fd5df0eccb4720a",{"type":1364,"url":3474},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F944b56000be5e9b61af8301aa340838770ad8a0b",{"type":1372,"url":1638},{"type":1364,"url":3477},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3f8b3fd0-166b-46e7-b60f-60dd9d2678bf",{"type":1372,"url":1808},{"type":1367,"url":3480},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9356-575x-2w9m",[1644,1645,1646,1647],{"id":181,"slug":3483,"dossier":47,"summary":3484,"aliases":3485,"sourceIds":3488,"published":3489,"modified":3490,"checkedAt":7,"severity":3491,"references":3494,"versionKeys":3508,"packageCount":32,"repositoryCount":34},"ghsa-94p4-4cq8-9g67-9a288a09","GitPython: Environment-variable exfiltration via Repo.create_remote() \u002F Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)",[3486,3487],"CVE-2026-73622","PYSEC-2026-3951",[181,3487],"2026-07-24T21:45:16Z","2026-09-24T14:45:07.411775302Z",[3492,3493],{"type":1398,"score":3363},{"type":1360,"score":3367},[3495,3497,3499,3501,3502,3504,3506],{"type":1404,"url":3496},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-94p4-4cq8-9g67",{"type":1364,"url":3498},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F863417457a0633db7ea5aed4fd01e0b291a41162",{"type":1464,"url":3500},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8ac5a30519b6f4af85398b9b9d7064ff4d452da2",{"type":1372,"url":1413},{"type":1364,"url":3503},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.55",{"type":1364,"url":3505},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3951.yaml",{"type":1367,"url":3507},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-remote-add",[1421,1422,1423],{"id":182,"slug":3510,"dossier":47,"summary":3511,"aliases":3512,"sourceIds":3515,"published":3516,"modified":3517,"checkedAt":7,"severity":3518,"references":3520,"versionKeys":3536,"packageCount":32,"repositoryCount":34},"ghsa-956x-8gvw-wg5v-f5d32b2d","GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \u002F `Repo.blame()`",[3513,3514],"CVE-2026-67323","PYSEC-2026-3839",[182,3514],"2026-07-21T20:10:06Z","2026-09-10T12:25:39.217544351Z",[3519],{"type":1398,"score":3022},[3521,3523,3525,3527,3529,3530,3531,3533,3534],{"type":1364,"url":3522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",{"type":1367,"url":3524},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67323",{"type":1364,"url":3526},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2163",{"type":1364,"url":3528},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F701ce32fe5ba8cb622c0e0342a376a6beb47d738",{"type":1372,"url":1413},{"type":1364,"url":1676},{"type":1364,"url":3532},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-unguarded-git-options",{"type":1372,"url":1680},{"type":1367,"url":3535},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",[1421,1422,1423],{"id":183,"slug":3538,"dossier":47,"summary":3539,"aliases":3540,"sourceIds":3543,"published":3544,"modified":3545,"checkedAt":7,"severity":3546,"references":3549,"versionKeys":3572,"packageCount":32,"repositoryCount":2104},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[3541,3542],"CVE-2024-47081","PYSEC-2026-1872",[183,3542],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[3547],{"type":1398,"score":3548},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3550,3552,3554,3556,3558,3560,3562,3564,3566,3568,3570],{"type":1364,"url":3551},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1367,"url":3553},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1364,"url":3555},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1464,"url":3557},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1367,"url":3559},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1372,"url":3561},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1364,"url":3563},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1364,"url":3565},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1372,"url":3567},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1364,"url":3569},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1364,"url":3571},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3573,3574],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":184,"slug":3576,"dossier":47,"summary":3577,"aliases":3578,"sourceIds":3582,"published":3583,"modified":3584,"checkedAt":7,"severity":3585,"references":3587,"versionKeys":3600,"packageCount":32,"repositoryCount":2055},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3579,3580,3581],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[184,3581],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3586],{"type":1398,"score":1540},[3588,3590,3592,3594,3596,3598,3599],{"type":1404,"url":3589},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1367,"url":3591},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1464,"url":3593},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1464,"url":3595},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1364,"url":3597},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1372,"url":1373},{"type":1367,"url":2602},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":185,"slug":3602,"dossier":47,"summary":3603,"aliases":3604,"sourceIds":3607,"published":3608,"modified":3609,"checkedAt":7,"severity":3610,"references":3612,"versionKeys":3627,"packageCount":32,"repositoryCount":34},"ghsa-9rj7-rf2p-w77r-996a0359","GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks",[3605,3606],"CVE-2026-76218","PYSEC-2026-3840",[185,3606],"2026-08-07T15:36:43Z","2026-09-10T12:25:55.324487522Z",[3611],{"type":1398,"score":2835},[3613,3615,3617,3618,3620,3621,3622,3624,3625],{"type":1364,"url":3614},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",{"type":1367,"url":3616},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76218",{"type":1364,"url":2122},{"type":1364,"url":3619},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fd9ddb55bdc66",{"type":1372,"url":1413},{"type":1364,"url":2127},{"type":1364,"url":3623},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-repo-init",{"type":1372,"url":1680},{"type":1367,"url":3626},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",[1421,1422,1423],{"id":186,"slug":3629,"dossier":47,"summary":3630,"aliases":3631,"sourceIds":3635,"published":3636,"modified":3637,"checkedAt":7,"severity":3638,"references":3643,"versionKeys":3654,"packageCount":32,"repositoryCount":417},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3632,3633,3634],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[186,3634],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3639,3641],{"type":1360,"score":3640},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":3642},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3644,3646,3648,3650,3652,3653],{"type":1367,"url":3645},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1367,"url":3647},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1763,"url":3649},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1464,"url":3651},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":187,"slug":3656,"dossier":47,"summary":3657,"aliases":3658,"sourceIds":3660,"published":3661,"modified":3662,"checkedAt":7,"severity":3663,"references":3665,"versionKeys":3674,"packageCount":32,"repositoryCount":2351},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3659],"CVE-2026-112913",[187],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3664],{"type":1398,"score":1754},[3666,3668,3670,3672,3673],{"type":1364,"url":3667},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1364,"url":3669},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1364,"url":3671},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1372,"url":2343},{"type":1364,"url":2345},[2347,2348,2349,2350],{"id":188,"slug":3676,"dossier":47,"summary":3677,"aliases":3678,"sourceIds":3681,"published":3682,"modified":3683,"checkedAt":7,"severity":3684,"references":3687,"versionKeys":3704,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3679,3680],"CVE-2024-35195","PYSEC-2026-1873",[188,3680],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3685],{"type":1398,"score":3686},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3688,3690,3692,3694,3696,3697,3699,3701,3702],{"type":1364,"url":3689},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1367,"url":3691},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1364,"url":3693},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1464,"url":3695},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1372,"url":3561},{"type":1364,"url":3698},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1364,"url":3700},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1372,"url":3567},{"type":1367,"url":3703},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3573],{"id":189,"slug":3706,"dossier":47,"summary":3707,"aliases":3708,"sourceIds":3710,"published":3711,"modified":3712,"checkedAt":7,"severity":3713,"references":3716,"versionKeys":3726,"packageCount":32,"repositoryCount":427},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[3709],"CVE-2026-103263",[189],"2026-09-30T23:48:55Z","2026-10-02T03:56:10.964622908Z",[3714],{"type":1360,"score":3715},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3717,3719,3720,3722,3724,3725],{"type":1364,"url":3718},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1364,"url":1879},{"type":1364,"url":3721},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1364,"url":3723},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1372,"url":1885},{"type":1364,"url":1887},[1889,1890,1891,1892,1893,1894],{"id":190,"slug":3728,"dossier":47,"summary":3729,"aliases":3730,"sourceIds":3734,"published":3735,"modified":3736,"checkedAt":7,"severity":3737,"references":3742,"versionKeys":3758,"packageCount":32,"repositoryCount":478},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3731,3732,3733],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[190],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3738,3740],{"type":1398,"score":3739},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1360,"score":3741},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3743,3745,3747,3749,3750,3752,3754,3756],{"type":1367,"url":3744},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1364,"url":3746},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1364,"url":3748},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1372,"url":1770},{"type":1364,"url":3751},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1364,"url":3753},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1364,"url":3755},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1364,"url":3757},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1782,1783],{"id":191,"slug":3760,"dossier":47,"summary":3761,"aliases":3762,"sourceIds":3765,"published":3766,"modified":3767,"checkedAt":7,"severity":3768,"references":3771,"versionKeys":3780,"packageCount":32,"repositoryCount":417},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3763,3764],"BIT-pillow-2026-112404","CVE-2026-112404",[191],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3769],{"type":1360,"score":3770},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3772,3774,3776,3778,3779],{"type":1364,"url":3773},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1367,"url":3775},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1364,"url":3777},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":192,"slug":3782,"dossier":47,"summary":3783,"aliases":3784,"sourceIds":3787,"published":3788,"modified":3789,"checkedAt":7,"severity":3790,"references":3792,"versionKeys":3804,"packageCount":32,"repositoryCount":3805},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[3785,3786],"CVE-2025-67725","PYSEC-2025-266",[192,3786],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[3791],{"type":1398,"score":1540},[3793,3795,3797,3799,3801,3802],{"type":1367,"url":3794},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1367,"url":3796},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1464,"url":3798},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1364,"url":3800},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1372,"url":1885},{"type":1367,"url":3803},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1889,1890,1891],9,{"id":193,"slug":3807,"dossier":47,"summary":3808,"aliases":3809,"sourceIds":3813,"published":3814,"modified":3815,"checkedAt":7,"severity":3816,"references":3819,"versionKeys":3859,"packageCount":32,"repositoryCount":2275},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3810,3811,3812],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[193,3812],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3817,3818],{"type":1360,"score":3024},{"type":1398,"score":1540},[3820,3822,3824,3826,3828,3830,3831,3833,3835,3837,3839,3841,3843,3845,3847,3849,3851,3853,3855,3857],{"type":1364,"url":3821},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1367,"url":3823},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1364,"url":3825},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1364,"url":3827},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1364,"url":3829},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1372,"url":1373},{"type":1364,"url":3832},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1364,"url":3834},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1364,"url":3836},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1367,"url":3838},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1367,"url":3840},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1367,"url":3842},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1367,"url":3844},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1367,"url":3846},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1367,"url":3848},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1367,"url":3850},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1367,"url":3852},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1367,"url":3854},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1367,"url":3856},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1367,"url":3858},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1377,1378,1379,1380,1381,1382,1383],{"id":194,"slug":3861,"dossier":47,"summary":3862,"aliases":3863,"sourceIds":3865,"published":3866,"modified":3867,"checkedAt":7,"severity":3868,"references":3870,"versionKeys":3884,"packageCount":32,"repositoryCount":427},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[3864],"CVE-2026-103262",[194],"2026-09-30T23:49:13Z","2026-10-02T03:56:11.819291984Z",[3869],{"type":1398,"score":1540},[3871,3873,3874,3876,3878,3880,3882,3883],{"type":1364,"url":3872},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1364,"url":1879},{"type":1364,"url":3875},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1364,"url":3877},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1364,"url":3879},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1364,"url":3881},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1372,"url":1885},{"type":1364,"url":1887},[1889,1890,1891,1892,1893,1894],{"id":195,"slug":3886,"dossier":47,"summary":3887,"aliases":3888,"sourceIds":3892,"published":3893,"modified":3894,"checkedAt":7,"severity":3895,"references":3898,"versionKeys":3907,"packageCount":32,"repositoryCount":3908},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3889,3890,3891],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[195,3891],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3896,3897],{"type":1360,"score":2364},{"type":1398,"score":1540},[3899,3901,3903,3905,3906],{"type":1404,"url":3900},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1367,"url":3902},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1464,"url":3904},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1372,"url":1373},{"type":1367,"url":1375},[1382,1383,1384,1385,1386],7,{"id":196,"slug":3910,"dossier":47,"summary":3911,"aliases":3912,"sourceIds":3915,"published":3916,"modified":3917,"checkedAt":7,"severity":3918,"references":3921,"versionKeys":3938,"packageCount":32,"repositoryCount":478},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3913,3914],"CVE-2025-27516","PYSEC-2026-1471",[196,3914],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3919],{"type":1360,"score":3920},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3922,3924,3926,3928,3930,3932,3934,3936],{"type":1364,"url":3923},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1367,"url":3925},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1464,"url":3927},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1372,"url":3929},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1364,"url":3931},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1364,"url":3933},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1372,"url":3935},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1367,"url":3937},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3939,3940],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":197,"slug":3942,"dossier":47,"summary":3943,"aliases":3944,"sourceIds":3946,"published":3947,"modified":3948,"checkedAt":7,"severity":3949,"references":3951,"versionKeys":3960,"packageCount":32,"repositoryCount":2351},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3945],"CVE-2026-112915",[197],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3950],{"type":1398,"score":1758},[3952,3954,3956,3957,3958,3959],{"type":1364,"url":3953},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1367,"url":3955},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1364,"url":3669},{"type":1364,"url":3671},{"type":1372,"url":2343},{"type":1364,"url":2345},[2347,2348,2349,2350],{"id":198,"slug":3962,"dossier":47,"summary":3963,"aliases":3964,"sourceIds":3967,"published":3968,"modified":3969,"checkedAt":7,"severity":3970,"references":3973,"versionKeys":3984,"packageCount":32,"repositoryCount":439},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[3965,3966],"CVE-2026-49854","PYSEC-2026-3388",[198,3966],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[3971],{"type":1398,"score":3972},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[3974,3976,3977,3979,3980,3982],{"type":1364,"url":3975},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1372,"url":1885},{"type":1364,"url":3978},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1372,"url":1997},{"type":1367,"url":3981},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1367,"url":3983},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1889,1890,1891,1892,1893],{"id":199,"slug":3986,"dossier":47,"summary":3987,"aliases":3988,"sourceIds":3992,"published":3993,"modified":3994,"checkedAt":7,"severity":3995,"references":3999,"versionKeys":4015,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3989,3990,3991],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[199,3991],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3996,3997],{"type":1398,"score":1399},{"type":1360,"score":3998},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4000,4002,4004,4006,4007,4009,4011,4013],{"type":1367,"url":4001},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1364,"url":4003},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1364,"url":4005},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1372,"url":2447},{"type":1364,"url":4008},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1364,"url":4010},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1372,"url":4012},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1367,"url":4014},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2453],{"id":200,"slug":4017,"dossier":47,"summary":4018,"aliases":4019,"sourceIds":4022,"published":4023,"modified":4024,"checkedAt":7,"severity":4025,"references":4027,"versionKeys":4036,"packageCount":32,"repositoryCount":417},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[4020,4021],"BIT-pillow-2026-112406","CVE-2026-112406",[200],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[4026],{"type":1360,"score":2364},[4028,4030,4032,4034,4035],{"type":1364,"url":4029},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1367,"url":4031},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1364,"url":4033},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":201,"slug":4038,"dossier":47,"summary":4039,"aliases":4040,"sourceIds":4044,"published":4045,"modified":4046,"checkedAt":7,"severity":4047,"references":4051,"versionKeys":4069,"packageCount":32,"repositoryCount":478},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[4041,4042,4043],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[201],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[4048,4049],{"type":1398,"score":3394},{"type":1360,"score":4050},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[4052,4054,4056,4058,4060,4062,4063,4065,4067],{"type":1367,"url":4053},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1364,"url":4055},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1364,"url":4057},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1364,"url":4059},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1364,"url":4061},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1372,"url":1770},{"type":1364,"url":4064},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1364,"url":4066},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1364,"url":4068},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1782,1783],{"id":202,"slug":4071,"dossier":47,"summary":4072,"aliases":4073,"sourceIds":4075,"published":4076,"modified":4077,"checkedAt":7,"severity":4078,"references":4080,"versionKeys":4089,"packageCount":32,"repositoryCount":34},"ghsa-f9j4-qggq-h239-968ed9a4","GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution",[4074],"CVE-2026-110858",[202],"2026-10-27T15:26:50Z","2026-10-27T15:47:24.258288646Z",[4079],{"type":1398,"score":3082},[4081,4083,4085,4087,4088],{"type":1364,"url":4082},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-f9j4-qggq-h239",{"type":1364,"url":4084},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2247",{"type":1364,"url":4086},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F790bb3164948625ffb043d2a162425d55923fe9a",{"type":1372,"url":1413},{"type":1364,"url":1444},[1421,1422,1423],{"id":203,"slug":4091,"dossier":47,"summary":4092,"aliases":4093,"sourceIds":4096,"published":4097,"modified":4098,"checkedAt":7,"severity":4099,"references":4101,"versionKeys":4109,"packageCount":32,"repositoryCount":417},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[4094,4095],"BIT-pillow-2026-112891","CVE-2026-112891",[203],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[4100],{"type":1360,"score":2734},[4102,4104,4106,4107,4108],{"type":1364,"url":4103},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1367,"url":4105},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1364,"url":2952},{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":204,"slug":4111,"dossier":47,"summary":4112,"aliases":4113,"sourceIds":4116,"published":4117,"modified":4118,"checkedAt":7,"severity":4119,"references":4124,"versionKeys":4148,"packageCount":32,"repositoryCount":427},"ghsa-fgcw-684q-jj6r-9fe55ba1","huggingface\u002Ftransformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path",[4114,4115],"CVE-2026-5241","PYSEC-2026-2290",[204,4115],"2026-06-03T14:16:46.337Z","2026-09-10T03:50:49.345942449Z",[4120,4122],{"type":1398,"score":4121},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",{"type":1398,"score":4123},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[4125,4127,4129,4131,4133,4135,4137,4139,4140,4142,4144,4146],{"type":1367,"url":4126},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-5241",{"type":1464,"url":4128},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F676559d5022b74aaa0cee1cee0842b7f27c5320e",{"type":1367,"url":4130},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34456",{"type":1367,"url":4132},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1364,"url":4134},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",{"type":1364,"url":4136},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-5241",{"type":1763,"url":4138},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484384",{"type":1372,"url":1638},{"type":1364,"url":4141},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2026-2290.yaml",{"type":1404,"url":4143},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fceb3ce1a-4c45-497a-b25e-cb9a7685e619",{"type":1364,"url":4145},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-5241.json",{"type":1367,"url":4147},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fgcw-684q-jj6r",[1644,1645,1646,1647,1648,1649,1650,1651,1652],{"id":205,"slug":4150,"dossier":47,"summary":4151,"aliases":4152,"sourceIds":4156,"published":4157,"modified":4158,"checkedAt":7,"severity":4159,"references":4162,"versionKeys":4176,"packageCount":32,"repositoryCount":2055},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[4153,4154,4155],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[205,4155],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[4160],{"type":1398,"score":4161},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[4163,4165,4167,4169,4171,4172,4173,4174],{"type":1364,"url":4164},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1367,"url":4166},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1364,"url":4168},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1364,"url":4170},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1372,"url":1373},{"type":1364,"url":2602},{"type":1372,"url":2604},{"type":1367,"url":4175},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":206,"slug":4178,"dossier":47,"summary":4179,"aliases":4180,"sourceIds":4183,"published":4184,"modified":4185,"checkedAt":7,"severity":4186,"references":4189,"versionKeys":4199,"packageCount":32,"repositoryCount":34},"ghsa-fjr4-x663-mwxc-324b7aa5","GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)",[4181,4182],"CVE-2026-73624","PYSEC-2026-3995",[206,4182],"2026-07-24T16:41:20Z","2026-09-29T09:10:55.738617943Z",[4187,4188],{"type":1398,"score":1849},{"type":1360,"score":1851},[4190,4192,4193,4195,4196,4197],{"type":1404,"url":4191},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fjr4-x663-mwxc",{"type":1364,"url":2841},{"type":1364,"url":4194},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1d51b891d7f236044a6aa17498ec682b63dad6e6",{"type":1372,"url":1413},{"type":1364,"url":2846},{"type":1367,"url":4198},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-diff",[1421,1422,1423],{"id":207,"slug":4201,"dossier":47,"summary":2914,"aliases":4202,"sourceIds":4205,"published":4206,"modified":4207,"checkedAt":7,"severity":4208,"references":4211,"versionKeys":4222,"packageCount":32,"repositoryCount":32},"ghsa-fpwr-67px-3qhx-94f30126",[4203,4204],"CVE-2025-1194","PYSEC-2026-1984",[207,4204],"2025-04-29T12:30:21Z","2026-08-13T20:11:58.399313771Z",[4209],{"type":1398,"score":4210},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[4212,4214,4216,4217,4219,4220],{"type":1367,"url":4213},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1194",{"type":1364,"url":4215},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F92c5ca9dd70de3ade2af2eb835c96215cc50e815",{"type":1372,"url":1638},{"type":1364,"url":4218},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F86f58dcd-683f-4adc-a735-849f51e9abb2",{"type":1372,"url":1808},{"type":1367,"url":4221},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fpwr-67px-3qhx",[1644],{"id":208,"slug":4224,"dossier":47,"summary":4225,"aliases":4226,"sourceIds":4228,"published":4229,"modified":4230,"checkedAt":7,"severity":4231,"references":4234,"versionKeys":4245,"packageCount":32,"repositoryCount":2351},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[4227],"CVE-2026-112935",[208],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[4232],{"type":1398,"score":4233},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4235,4237,4239,4241,4243,4244],{"type":1364,"url":4236},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1367,"url":4238},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1364,"url":4240},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1364,"url":4242},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1372,"url":2343},{"type":1364,"url":2345},[2347,2348,2349,2350],{"id":209,"slug":4247,"dossier":47,"summary":4248,"aliases":4249,"sourceIds":4251,"published":4252,"modified":4253,"checkedAt":7,"severity":4254,"references":4257,"versionKeys":4266,"packageCount":32,"repositoryCount":34},"ghsa-fx3j-rwgx-fr94-14d75c26","GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name",[4250],"CVE-2026-110855",[209],"2026-10-27T15:26:32Z","2026-10-27T15:47:24.291028301Z",[4255],{"type":1398,"score":4256},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4258,4260,4262,4264,4265],{"type":1364,"url":4259},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fx3j-rwgx-fr94",{"type":1364,"url":4261},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2255",{"type":1364,"url":4263},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9349ff58ee00c9fb14d515c8e693f33b2144b238",{"type":1372,"url":1413},{"type":1364,"url":1444},[1421,1422,1423],{"id":210,"slug":4268,"dossier":47,"summary":4269,"aliases":4270,"sourceIds":4274,"published":4275,"modified":4276,"checkedAt":7,"severity":4277,"references":4280,"versionKeys":4291,"packageCount":32,"repositoryCount":1719},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[4271,4272,4273],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[210,4273],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[4278,4279],{"type":1360,"score":1907},{"type":1398,"score":1492},[4281,4283,4285,4287,4289,4290],{"type":1367,"url":4282},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1367,"url":4284},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1763,"url":4286},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1464,"url":4288},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1372,"url":1373},{"type":1367,"url":1375},[1379,1380,1381,1382,1383,1384,1385,1386],{"id":211,"slug":4293,"dossier":47,"summary":4294,"aliases":4295,"sourceIds":4298,"published":4299,"modified":4300,"checkedAt":7,"severity":4301,"references":4303,"versionKeys":4316,"packageCount":32,"repositoryCount":34},"ghsa-g5vv-9gxw-82hx-203070a6","GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author\u002Fcommitter field parsing",[4296,4297],"CVE-2026-87819","PYSEC-2026-3984",[211,4297],"2026-09-09T12:17:17.120Z","2026-09-30T23:45:04.037560336Z",[4302],{"type":1398,"score":1540},[4304,4306,4308,4310,4311,4312,4314],{"type":1404,"url":4305},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-g5vv-9gxw-82hx",{"type":1364,"url":4307},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2215",{"type":1364,"url":4309},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F751473a5f3221d6f989291cbebcc404353fd3ba8",{"type":1372,"url":1413},{"type":1364,"url":1415},{"type":1364,"url":4313},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3984.yaml",{"type":1367,"url":4315},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-denial-of-service-via-redos",[1421,1422,1423],{"id":212,"slug":4318,"dossier":47,"summary":4319,"aliases":4320,"sourceIds":4323,"published":4324,"modified":4325,"checkedAt":7,"severity":4326,"references":4329,"versionKeys":4340,"packageCount":32,"repositoryCount":417},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[4321,4322],"BIT-pillow-2026-96778","CVE-2026-96778",[212],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[4327],{"type":1360,"score":4328},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4330,4332,4334,4336,4338,4339],{"type":1364,"url":4331},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1367,"url":4333},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1364,"url":4335},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1364,"url":4337},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":213,"slug":4342,"dossier":47,"summary":4343,"aliases":4344,"sourceIds":4347,"published":4348,"modified":4349,"checkedAt":7,"severity":4350,"references":4353,"versionKeys":4372,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[4345,4346],"CVE-2024-34062","PYSEC-2026-1976",[213,4346],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[4351],{"type":1398,"score":4352},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4354,4356,4358,4360,4362,4364,4366,4368,4370],{"type":1364,"url":4355},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1367,"url":4357},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1364,"url":4359},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1372,"url":4361},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1364,"url":4363},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1364,"url":4365},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1364,"url":4367},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1372,"url":4369},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1367,"url":4371},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[4373],"pypi:tqdm@4.66.2",{"id":214,"slug":4375,"dossier":47,"summary":4376,"aliases":4377,"sourceIds":4381,"published":4382,"modified":4383,"checkedAt":7,"severity":4384,"references":4387,"versionKeys":4398,"packageCount":32,"repositoryCount":417},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[4378,4379,4380],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[214,4380],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[4385,4386],{"type":1360,"score":1907},{"type":1398,"score":1492},[4388,4390,4392,4394,4396,4397],{"type":1367,"url":4389},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1367,"url":4391},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1763,"url":4393},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1464,"url":4395},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":215,"slug":4400,"dossier":47,"summary":4401,"aliases":4402,"sourceIds":4405,"published":4406,"modified":4407,"checkedAt":7,"severity":4408,"references":4413,"versionKeys":4423,"packageCount":32,"repositoryCount":417},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[4403,4404],"CVE-2026-25645","PYSEC-2026-2275",[215,4404],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[4409,4411],{"type":1398,"score":4410},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1398,"score":4412},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4414,4416,4418,4420,4421],{"type":1367,"url":4415},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1367,"url":4417},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1464,"url":4419},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1372,"url":3561},{"type":1367,"url":4422},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3573,3574,4424,4425],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":216,"slug":4427,"dossier":47,"summary":4428,"aliases":4429,"sourceIds":4432,"published":4433,"modified":4434,"checkedAt":7,"severity":4435,"references":4437,"versionKeys":4446,"packageCount":32,"repositoryCount":417},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[4430,4431],"BIT-pillow-2026-112892","CVE-2026-112892",[216],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[4436],{"type":1360,"score":2364},[4438,4440,4442,4444,4445],{"type":1364,"url":4439},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1367,"url":4441},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1364,"url":4443},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":217,"slug":4448,"dossier":47,"summary":4449,"aliases":4450,"sourceIds":4453,"published":4454,"modified":4455,"checkedAt":7,"severity":4456,"references":4458,"versionKeys":4470,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[4451,4452],"CVE-2026-97688","PYSEC-2026-4176",[217,4452],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[4457],{"type":1360,"score":2734},[4459,4461,4463,4465,4466,4467,4468],{"type":1364,"url":4460},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1367,"url":4462},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1364,"url":4464},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1372,"url":1710},{"type":1364,"url":3323},{"type":1372,"url":1712},{"type":1367,"url":4469},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[3328,3329],{"id":218,"slug":4472,"dossier":47,"summary":4473,"aliases":4474,"sourceIds":4477,"published":4478,"modified":4479,"checkedAt":7,"severity":4480,"references":4482,"versionKeys":4493,"packageCount":32,"repositoryCount":1719},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[4475,4476],"CVE-2025-66418","PYSEC-2026-1998",[218,4476],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[4481],{"type":1360,"score":1695},[4483,4485,4487,4489,4490,4491],{"type":1364,"url":4484},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1367,"url":4486},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1464,"url":4488},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1372,"url":1710},{"type":1372,"url":1712},{"type":1367,"url":4492},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1714,1715,1716,1717,1718],{"id":219,"slug":4495,"dossier":47,"summary":4496,"aliases":4497,"sourceIds":4500,"published":4501,"modified":4502,"checkedAt":7,"severity":4503,"references":4506,"versionKeys":4521,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[4498,4499],"CVE-2024-56201","PYSEC-2026-1472",[219,4499],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[4504,4505],{"type":1398,"score":1664},{"type":1360,"score":3920},[4507,4509,4511,4513,4515,4516,4518,4519],{"type":1364,"url":4508},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1367,"url":4510},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1364,"url":4512},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1464,"url":4514},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1372,"url":3929},{"type":1364,"url":4517},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1372,"url":3935},{"type":1367,"url":4520},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3939],{"id":220,"slug":4523,"dossier":47,"summary":4524,"aliases":4525,"sourceIds":4527,"published":4528,"modified":4529,"checkedAt":7,"severity":4530,"references":4531,"versionKeys":4540,"packageCount":32,"repositoryCount":34},"ghsa-gq48-pqfc-9p58-0aa8d93f","GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree",[4526],"CVE-2026-110860",[220],"2026-10-27T15:26:57Z","2026-10-27T15:47:24.379897252Z",[],[4532,4534,4536,4538,4539],{"type":1364,"url":4533},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-gq48-pqfc-9p58",{"type":1364,"url":4535},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2232",{"type":1364,"url":4537},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F24b6f95d4b90ab1483fb601c736ac6e7c059cd61",{"type":1372,"url":1413},{"type":1364,"url":1444},[1421,1422,1423],{"id":221,"slug":4542,"dossier":47,"summary":4543,"aliases":4544,"sourceIds":4548,"published":4549,"modified":4550,"checkedAt":7,"severity":4551,"references":4554,"versionKeys":4566,"packageCount":32,"repositoryCount":417},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[4545,4546,4547],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[221,4547],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[4552],{"type":1398,"score":4553},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[4555,4557,4559,4561,4563,4564],{"type":1404,"url":4556},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1367,"url":4558},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1464,"url":4560},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1364,"url":4562},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1372,"url":2447},{"type":1367,"url":4565},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2453,2454,2455,2456,4567,4568,4569,4570,4571,4572,4573,4574],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":222,"slug":4576,"dossier":47,"summary":4577,"aliases":4578,"sourceIds":4581,"published":4582,"modified":4583,"checkedAt":7,"severity":4584,"references":4586,"versionKeys":4607,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[4579,4580],"CVE-2024-34064","PYSEC-2026-1474",[222,4580],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[4585],{"type":1398,"score":3055},[4587,4589,4591,4593,4594,4596,4598,4600,4602,4604,4605],{"type":1364,"url":4588},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1367,"url":4590},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1464,"url":4592},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1372,"url":3929},{"type":1364,"url":4595},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1364,"url":4597},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1364,"url":4599},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1364,"url":4601},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1364,"url":4603},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1372,"url":3935},{"type":1367,"url":4606},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3939],{"id":223,"slug":4609,"dossier":47,"summary":4610,"aliases":4611,"sourceIds":4614,"published":4615,"modified":4616,"checkedAt":7,"severity":4617,"references":4619,"versionKeys":4634,"packageCount":32,"repositoryCount":34},"ghsa-hh9p-6wh2-4mfc-8e33cff1","GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",[4612,4613],"CVE-2026-76217","PYSEC-2026-3841",[223,4613],"2026-08-07T15:43:56Z","2026-09-10T12:26:07.095223621Z",[4618],{"type":1398,"score":1961},[4620,4622,4624,4625,4627,4628,4629,4631,4632],{"type":1364,"url":4621},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",{"type":1367,"url":4623},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76217",{"type":1364,"url":2122},{"type":1364,"url":4626},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Ff2550b65bf60ca087190981e2c7b6865e201f40c",{"type":1372,"url":1413},{"type":1364,"url":2127},{"type":1364,"url":4630},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-pathspec-from-file",{"type":1372,"url":1680},{"type":1367,"url":4633},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",[1421,1422,1423],{"id":224,"slug":4636,"dossier":47,"summary":4637,"aliases":4638,"sourceIds":4641,"published":4642,"modified":4643,"checkedAt":7,"severity":4644,"references":4649,"versionKeys":4666,"packageCount":32,"repositoryCount":34},"ghsa-hmq2-w58f-27jc-f0b0fe70","GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython",[4639,4640],"CVE-2026-76222","PYSEC-2026-3784",[224,4640],"2026-08-07T15:45:39Z","2026-09-08T21:00:05.149418166Z",[4645,4647],{"type":1398,"score":4646},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",{"type":1360,"score":4648},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4650,4652,4654,4656,4658,4660,4661,4662,4664],{"type":1404,"url":4651},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hmq2-w58f-27jc",{"type":1367,"url":4653},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76222",{"type":1364,"url":4655},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2202",{"type":1364,"url":4657},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F4299c990e1ca21896f9485277caf7bb0ae5b404c",{"type":1364,"url":4659},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe4b8e7d026ca6abb4cf604f8e77093432ce23c06",{"type":1372,"url":1413},{"type":1364,"url":2127},{"type":1364,"url":4663},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3784.yaml",{"type":1367,"url":4665},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-gitmodules-submodule-name",[1421,1422,1423],{"id":225,"slug":4668,"dossier":47,"summary":4669,"aliases":4670,"sourceIds":4673,"published":4674,"modified":4675,"checkedAt":7,"severity":4676,"references":4680,"versionKeys":4696,"packageCount":32,"repositoryCount":32},"ghsa-hxxf-235m-72v3-21da19b0","Deserialization of Untrusted Data in Hugging Face Transformers",[4671,4672],"CVE-2024-11394","PYSEC-2024-229",[225,4672],"2024-11-22T22:15:07Z","2026-09-10T03:50:20.811665084Z",[4677,4679],{"type":1398,"score":4678},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1398,"score":1399},[4681,4683,4685,4687,4688,4690,4692,4694],{"type":1367,"url":4682},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11394",{"type":1364,"url":4684},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fissues\u002F34840",{"type":1364,"url":4686},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F35296",{"type":1372,"url":1638},{"type":1364,"url":4689},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-229.yaml",{"type":1364,"url":4691},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515",{"type":1367,"url":4693},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515\u002F",{"type":1367,"url":4695},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxxf-235m-72v3",[1644],{"id":226,"slug":4698,"dossier":47,"summary":4699,"aliases":4700,"sourceIds":4703,"published":4704,"modified":4705,"checkedAt":7,"severity":4706,"references":4708,"versionKeys":4717,"packageCount":32,"repositoryCount":417},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4701,4702],"BIT-pillow-2026-112893","CVE-2026-112893",[226],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4707],{"type":1360,"score":1361},[4709,4711,4713,4715,4716],{"type":1364,"url":4710},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1367,"url":4712},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1364,"url":4714},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":227,"slug":4719,"dossier":47,"summary":4720,"aliases":4721,"sourceIds":4723,"published":4724,"modified":4725,"checkedAt":7,"severity":4726,"references":4729,"versionKeys":4739,"packageCount":32,"repositoryCount":2351},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4722],"CVE-2026-112936",[227],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4727],{"type":1398,"score":4728},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4730,4732,4734,4736,4737],{"type":1364,"url":4731},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1367,"url":4733},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1364,"url":4735},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1372,"url":2343},{"type":1364,"url":4738},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[2347,2348,2349,2350],{"id":228,"slug":4741,"dossier":47,"summary":4742,"aliases":4743,"sourceIds":4746,"published":4747,"modified":4748,"checkedAt":7,"severity":4749,"references":4751,"versionKeys":4760,"packageCount":32,"repositoryCount":417},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4744,4745],"BIT-pillow-2026-112894","CVE-2026-112894",[228],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4750],{"type":1360,"score":2364},[4752,4754,4756,4758,4759],{"type":1364,"url":4753},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1367,"url":4755},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1364,"url":4757},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":229,"slug":4762,"dossier":47,"summary":4763,"aliases":4764,"sourceIds":4767,"published":4768,"modified":4769,"checkedAt":7,"severity":4770,"references":4772,"versionKeys":4782,"packageCount":32,"repositoryCount":3805},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[4765,4766],"CVE-2025-67726","PYSEC-2025-267",[229,4766],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[4771],{"type":1398,"score":1540},[4773,4775,4777,4778,4780,4781],{"type":1367,"url":4774},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1367,"url":4776},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1464,"url":3798},{"type":1364,"url":4779},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1372,"url":1885},{"type":1367,"url":3803},[1889,1890,1891],{"id":230,"slug":4784,"dossier":47,"summary":4785,"aliases":4786,"sourceIds":4789,"published":4790,"modified":4791,"checkedAt":7,"severity":4792,"references":4795,"versionKeys":4820,"packageCount":32,"repositoryCount":34},"ghsa-jhr6-gm9c-rqjv-a6fbec2f","sentence-transformers local model loading bypasses trust_remote_code and executes custom Python",[4787,4788],"CVE-2026-68770","PYSEC-2026-4164",[230,4788],"2026-07-31T21:31:59Z","2026-10-01T17:55:41.036478465Z",[4793,4794],{"type":1398,"score":1604},{"type":1360,"score":1606},[4796,4798,4800,4802,4804,4806,4808,4810,4812,4814,4816,4818],{"type":1367,"url":4797},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-68770",{"type":1364,"url":4799},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fissues\u002F3801",{"type":1364,"url":4801},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3807",{"type":1364,"url":4803},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3935",{"type":1364,"url":4805},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002F626eb602b088878a8173bcab69225f68411b99e1",{"type":1364,"url":4807},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002Fae1acc3fb2aa2004577b297eb4a915ce7a03316a",{"type":1372,"url":4809},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers",{"type":1364,"url":4811},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv5.6.0",{"type":1364,"url":4813},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv6.0.0",{"type":1364,"url":4815},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fsentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false",{"type":1372,"url":4817},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsentence-transformers",{"type":1367,"url":4819},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jhr6-gm9c-rqjv",[4821,4822,4823,4824,4825],"pypi:sentence-transformers@3.3.1","pypi:sentence-transformers@4.0.2","pypi:sentence-transformers@4.1.0","pypi:sentence-transformers@5.0.0","pypi:sentence-transformers@5.2.0",{"id":231,"slug":4827,"dossier":47,"summary":4828,"aliases":4829,"sourceIds":4833,"published":4834,"modified":4835,"checkedAt":7,"severity":4836,"references":4838,"versionKeys":4852,"packageCount":32,"repositoryCount":2055},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4830,4831,4832],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[231,4832],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4837],{"type":1398,"score":1540},[4839,4841,4843,4845,4847,4848,4849,4850],{"type":1364,"url":4840},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1367,"url":4842},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1364,"url":4844},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1364,"url":4846},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1372,"url":1373},{"type":1364,"url":2602},{"type":1372,"url":2604},{"type":1367,"url":4851},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":232,"slug":4854,"dossier":47,"summary":4855,"aliases":4856,"sourceIds":4859,"published":4860,"modified":4861,"checkedAt":7,"severity":4862,"references":4864,"versionKeys":4877,"packageCount":32,"repositoryCount":32},"ghsa-jjph-296x-mrcr-0f661d67","Transformers vulnerable to ReDoS attack through its get_imports() function",[4857,4858],"CVE-2025-3264","PYSEC-2026-1985",[232,4858],"2025-07-07T12:30:22Z","2026-07-07T17:56:51.899728258Z",[4863],{"type":1398,"score":2193},[4865,4867,4869,4871,4872,4874,4875],{"type":1367,"url":4866},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3264",{"type":1364,"url":4868},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F0720e206c6ba28887e4d60ef60a6a089f6c1cc76",{"type":1364,"url":4870},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F126abe3461762e5fc180e7e614391d1b4ab051ca",{"type":1372,"url":1638},{"type":1364,"url":4873},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c6f7822-9992-476d-8cf0-b0b1623427df",{"type":1372,"url":1808},{"type":1367,"url":4876},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjph-296x-mrcr",[1644],{"id":233,"slug":4879,"dossier":47,"summary":4880,"aliases":4881,"sourceIds":4884,"published":4885,"modified":4886,"checkedAt":7,"severity":4887,"references":4891,"versionKeys":4901,"packageCount":32,"repositoryCount":34},"ghsa-jm78-9fvv-mhgr-2c167ddc","GitPython: git-config OPTION-name injection via =\u002F#\u002Fwhitespace bypasses name validator, enabling forged core.sshCommand\u002FhooksPath (RCE)",[4882,4883],"CVE-2026-76221","PYSEC-2026-3783",[233,4883],"2026-08-07T15:46:35Z","2026-09-10T03:51:14.296736368Z",[4888,4889],{"type":1398,"score":1664},{"type":1360,"score":4890},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4892,4894,4895,4897,4898,4899],{"type":1404,"url":4893},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-jm78-9fvv-mhgr",{"type":1364,"url":2122},{"type":1364,"url":4896},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fa495ccd3b547ccd60b2187215823b72a9c0188bf",{"type":1372,"url":1413},{"type":1364,"url":2127},{"type":1367,"url":4900},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-option-name",[1421,1422,1423],{"id":234,"slug":4903,"dossier":47,"summary":4904,"aliases":4905,"sourceIds":4908,"published":4909,"modified":4910,"checkedAt":7,"severity":4911,"references":4916,"versionKeys":4929,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[4906,4907],"CVE-2024-5206","PYSEC-2024-110",[234,4907],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[4912,4914],{"type":1398,"score":4913},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1398,"score":4915},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4917,4919,4921,4923,4925,4927],{"type":1367,"url":4918},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1464,"url":4920},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1364,"url":4922},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1372,"url":4924},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1364,"url":4926},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1367,"url":4928},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[4930],"pypi:scikit-learn@1.3.2",{"id":235,"slug":4932,"dossier":47,"summary":4933,"aliases":4934,"sourceIds":4936,"published":4937,"modified":4938,"checkedAt":7,"severity":4939,"references":4941,"versionKeys":4950,"packageCount":32,"repositoryCount":34},"ghsa-m64x-33q8-m5h7-491ad59c","GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines",[4935],"CVE-2026-110856",[235],"2026-10-27T15:26:24Z","2026-10-27T15:47:24.576766638Z",[4940],{"type":1360,"score":2364},[4942,4944,4946,4948,4949],{"type":1364,"url":4943},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-m64x-33q8-m5h7",{"type":1364,"url":4945},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2253",{"type":1364,"url":4947},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8290c98d35465a38090cdcc1b17be69967092a15",{"type":1372,"url":1413},{"type":1364,"url":1444},[1421,1422,1423],{"id":236,"slug":4952,"dossier":47,"summary":4953,"aliases":4954,"sourceIds":4957,"published":4958,"modified":4959,"checkedAt":7,"severity":4960,"references":4963,"versionKeys":4971,"packageCount":32,"repositoryCount":468},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4955,4956],"CVE-2026-44432","PYSEC-2026-142",[236,4956],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4961,4962],{"type":1398,"score":1540},{"type":1360,"score":1695},[4964,4966,4968,4970],{"type":1367,"url":4965},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1367,"url":4967},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1364,"url":4969},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1372,"url":1710},[3328],{"id":237,"slug":4973,"dossier":47,"summary":4974,"aliases":4975,"sourceIds":4978,"published":4979,"modified":4980,"checkedAt":7,"severity":4981,"references":4983,"versionKeys":4992,"packageCount":32,"repositoryCount":439},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[4976,4977],"CVE-2026-49855","PYSEC-2026-3389",[237,4977],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[4982],{"type":1398,"score":1540},[4984,4986,4987,4988,4990],{"type":1364,"url":4985},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1372,"url":1885},{"type":1372,"url":1997},{"type":1367,"url":4989},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1367,"url":4991},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1889,1890,1891,1892,1893],{"id":238,"slug":4994,"dossier":47,"summary":4995,"aliases":4996,"sourceIds":4999,"published":5000,"modified":5001,"checkedAt":7,"severity":5002,"references":5004,"versionKeys":5017,"packageCount":32,"repositoryCount":427},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[4997,4998],"CVE-2026-82397","PYSEC-2026-3928",[238,4998],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[5003],{"type":1398,"score":1540},[5005,5007,5009,5010,5012,5013,5014,5015],{"type":1364,"url":5006},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1367,"url":5008},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1364,"url":3252},{"type":1364,"url":5011},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1372,"url":1885},{"type":1364,"url":3259},{"type":1372,"url":1997},{"type":1367,"url":5016},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1889,1890,1891,1892,1893,1894],{"id":239,"slug":5019,"dossier":47,"summary":5020,"aliases":5021,"sourceIds":5024,"published":5025,"modified":5026,"checkedAt":7,"severity":5027,"references":5029,"versionKeys":5040,"packageCount":32,"repositoryCount":417},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[5022,5023],"BIT-pillow-2026-96640","CVE-2026-96640",[239],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[5028],{"type":1360,"score":1361},[5030,5032,5034,5036,5038,5039],{"type":1364,"url":5031},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1367,"url":5033},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1364,"url":5035},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1364,"url":5037},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":240,"slug":5042,"dossier":47,"summary":5043,"aliases":5044,"sourceIds":5047,"published":5048,"modified":5049,"checkedAt":7,"severity":5050,"references":5053,"versionKeys":5061,"packageCount":32,"repositoryCount":34},"ghsa-mv93-w799-cj2w-4413137a","GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath",[5045,5046],"CVE-2026-67326","PYSEC-2026-3980",[240,5046],"2026-05-08T23:19:02Z","2026-09-17T09:10:55.928803360Z",[5051,5052],{"type":1398,"score":1932},{"type":1398,"score":3026},[5054,5056,5058,5059],{"type":1404,"url":5055},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-mv93-w799-cj2w",{"type":1367,"url":5057},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1372,"url":1413},{"type":1367,"url":5060},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-newline-injection-via-config-writer-section",[1421,1422,1423],{"id":241,"slug":5063,"dossier":47,"summary":5064,"aliases":5065,"sourceIds":5068,"published":5069,"modified":5070,"checkedAt":7,"severity":5071,"references":5073,"versionKeys":5082,"packageCount":32,"repositoryCount":417},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[5066,5067],"BIT-pillow-2026-112895","CVE-2026-112895",[241],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[5072],{"type":1360,"score":2364},[5074,5076,5078,5080,5081],{"type":1364,"url":5075},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1367,"url":5077},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1364,"url":5079},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":242,"slug":5084,"dossier":47,"summary":5085,"aliases":5086,"sourceIds":5089,"published":5090,"modified":5091,"checkedAt":7,"severity":5092,"references":5097,"versionKeys":5109,"packageCount":32,"repositoryCount":34},"ghsa-p538-c434-8v24-c303e516","GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count",[5087,5088],"CVE-2026-73621","PYSEC-2026-3950",[242,5088],"2026-08-03T20:23:17Z","2026-09-10T13:10:55.177009469Z",[5093,5095],{"type":1398,"score":5094},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1360,"score":5096},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[5098,5100,5102,5104,5105,5107],{"type":1404,"url":5099},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-p538-c434-8v24",{"type":1364,"url":5101},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2184",{"type":1364,"url":5103},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F38553b6fddc7f6a667cdb45a6762343a08fc72b2",{"type":1372,"url":1413},{"type":1364,"url":5106},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.56",{"type":1367,"url":5108},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-truncation-via-commit-count",[1421,1422,1423],{"id":243,"slug":5111,"dossier":47,"summary":5112,"aliases":5113,"sourceIds":5117,"published":5118,"modified":5119,"checkedAt":7,"severity":5120,"references":5122,"versionKeys":5132,"packageCount":32,"repositoryCount":417},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[5114,5115,5116],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[243,5116],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[5121],{"type":1398,"score":1492},[5123,5125,5127,5129,5130,5131],{"type":1367,"url":5124},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1367,"url":5126},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1763,"url":5128},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1464,"url":2521},{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":244,"slug":5134,"dossier":47,"summary":5135,"aliases":5136,"sourceIds":5138,"published":5139,"modified":5140,"checkedAt":7,"severity":5141,"references":5143,"versionKeys":5155,"packageCount":32,"repositoryCount":427},"ghsa-pcg2-g6cj-q92c-613600e5","Tornado: Quadratic CPU usage when parsing HTTP headers with line folding",[5137],"CVE-2026-116577",[244],"2026-10-28T22:43:41Z","2026-10-28T23:00:04.070057045Z",[5142],{"type":1398,"score":1796},[5144,5146,5148,5150,5152,5153],{"type":1364,"url":5145},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pcg2-g6cj-q92c",{"type":1367,"url":5147},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116577",{"type":1364,"url":5149},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3765",{"type":1364,"url":5151},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F1b7a1dc9f340f52de929852e8125aa12f25297c9",{"type":1372,"url":1885},{"type":1364,"url":5154},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.0",[1889,1890,1891,1892,1893,1894],{"id":245,"slug":5157,"dossier":47,"summary":5158,"aliases":5159,"sourceIds":5163,"published":5164,"modified":5165,"checkedAt":7,"severity":5166,"references":5170,"versionKeys":5179,"packageCount":32,"repositoryCount":417},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[5160,5161,5162],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[245,5162],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[5167,5168],{"type":1360,"score":3770},{"type":1398,"score":5169},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5171,5173,5175,5177,5178],{"type":1404,"url":5172},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1367,"url":5174},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1464,"url":5176},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":246,"slug":5181,"dossier":47,"summary":5182,"aliases":5183,"sourceIds":5187,"published":5188,"modified":5189,"checkedAt":7,"severity":5190,"references":5193,"versionKeys":5206,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[5184,5185,5186],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[246,5186],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[5191,5192],{"type":1398,"score":1796},{"type":1398,"score":1540},[5194,5196,5198,5200,5202,5204,5205],{"type":1404,"url":5195},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1367,"url":5197},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1464,"url":5199},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1464,"url":5201},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1364,"url":5203},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1372,"url":1373},{"type":1367,"url":2602},[1382,1383,1384,1385],{"id":247,"slug":5208,"dossier":47,"summary":5209,"aliases":5210,"sourceIds":5213,"published":4860,"modified":5214,"checkedAt":7,"severity":5215,"references":5218,"versionKeys":5231,"packageCount":32,"repositoryCount":468},"ghsa-phhr-52qp-3mj4-6f5d82e3","Transformers's Improper Input Validation vulnerability can be exploited through username injection",[5211,5212],"CVE-2025-3777","PYSEC-2026-1986",[247,5212],"2026-09-10T03:50:26.198077196Z",[5216],{"type":1398,"score":5217},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[5219,5221,5223,5224,5226,5228,5229],{"type":1367,"url":5220},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3777",{"type":1364,"url":5222},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F4dda5f71b35fb70cf602187eef84bb17a50b9082",{"type":1372,"url":1638},{"type":1364,"url":5225},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fblame\u002Fa7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4\u002Fsrc\u002Ftransformers\u002Fimage_utils.py",{"type":1364,"url":5227},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fccba0730-9248-4853-b7ff-5c20e6364f09",{"type":1372,"url":1808},{"type":1367,"url":5230},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-phhr-52qp-3mj4",[1644,1645,1646],{"id":248,"slug":5233,"dossier":47,"summary":5234,"aliases":5235,"sourceIds":5239,"published":5240,"modified":5241,"checkedAt":7,"severity":5242,"references":5244,"versionKeys":5255,"packageCount":32,"repositoryCount":2055},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[5236,5237,5238],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[248,5238],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[5243],{"type":1398,"score":1540},[5245,5247,5249,5251,5253,5254],{"type":1404,"url":5246},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1367,"url":5248},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1464,"url":5250},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1364,"url":5252},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1372,"url":1373},{"type":1367,"url":2053},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":249,"slug":5257,"dossier":47,"summary":5258,"aliases":5259,"sourceIds":5262,"published":5263,"modified":5264,"checkedAt":7,"severity":5265,"references":5267,"versionKeys":5279,"packageCount":32,"repositoryCount":2104},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[5260,5261],"CVE-2025-50181","PYSEC-2026-1999",[249,5261],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[5266],{"type":1398,"score":2089},[5268,5270,5272,5274,5275,5276,5277],{"type":1364,"url":5269},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1367,"url":5271},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1464,"url":5273},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1372,"url":1710},{"type":1364,"url":2099},{"type":1372,"url":1712},{"type":1367,"url":5278},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1714,1715,1716,1717],{"id":250,"slug":5281,"dossier":47,"summary":5282,"aliases":5283,"sourceIds":5286,"published":5287,"modified":5288,"checkedAt":7,"severity":5289,"references":5293,"versionKeys":5304,"packageCount":32,"repositoryCount":3805},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[5284,5285],"CVE-2025-67724","PYSEC-2025-265",[250,5285],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[5290,5291],{"type":1398,"score":3055},{"type":1398,"score":5292},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[5294,5296,5298,5300,5302,5303],{"type":1367,"url":5295},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1367,"url":5297},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1464,"url":5299},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1364,"url":5301},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1372,"url":1885},{"type":1367,"url":3803},[1889,1890,1891],{"id":251,"slug":5306,"dossier":47,"summary":5307,"aliases":5308,"sourceIds":5310,"published":5311,"modified":5312,"checkedAt":7,"severity":5313,"references":5316,"versionKeys":5320,"packageCount":32,"repositoryCount":439},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[5309],"CVE-2026-91992",[251],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[5314],{"type":1398,"score":5315},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[5317,5319],{"type":1364,"url":5318},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1372,"url":1885},[1889,1890,1891,1892,1893],{"id":252,"slug":5322,"dossier":47,"summary":5323,"aliases":5324,"sourceIds":5326,"published":5327,"modified":5328,"checkedAt":7,"severity":5329,"references":5332,"versionKeys":5347,"packageCount":32,"repositoryCount":427},"ghsa-pw9p-v7r6-gx4p-86e36276","Tornado: Open redirect in RedirectHandler via protocol-relative URLs",[5325],"CVE-2026-116578",[252],"2026-10-28T22:43:45Z","2026-10-28T23:00:04.066537287Z",[5330],{"type":1360,"score":5331},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:L\u002FSA:N",[5333,5335,5337,5339,5341,5343,5345,5346],{"type":1364,"url":5334},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw9p-v7r6-gx4p",{"type":1367,"url":5336},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116578",{"type":1364,"url":5338},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3786",{"type":1364,"url":5340},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F940ea725bdd9bc68231d68a105eef17ea6e11233",{"type":1364,"url":5342},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fcc75ab0eb3af459c714895a49f682ad354f50117",{"type":1364,"url":5344},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fccb6a2e5482f17997efd4a74b8200d5b4babc035",{"type":1372,"url":1885},{"type":1364,"url":5154},[1889,1890,1891,1892,1893,1894],{"id":253,"slug":5349,"dossier":47,"summary":5350,"aliases":5351,"sourceIds":5355,"published":5356,"modified":5357,"checkedAt":7,"severity":5358,"references":5361,"versionKeys":5373,"packageCount":32,"repositoryCount":1719},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[5352,5353,5354],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[253,5354],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[5359,5360],{"type":1360,"score":3024},{"type":1398,"score":2810},[5362,5363,5365,5367,5369,5371,5372],{"type":1364,"url":3821},{"type":1464,"url":5364},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1367,"url":5366},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1464,"url":5368},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1464,"url":5370},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1372,"url":1373},{"type":1367,"url":2552},[1377,1378,1379,1380,1381,1382,1383,1384],{"id":254,"slug":5375,"dossier":47,"summary":5376,"aliases":5377,"sourceIds":5380,"published":4860,"modified":5381,"checkedAt":7,"severity":5382,"references":5384,"versionKeys":5395,"packageCount":32,"repositoryCount":32},"ghsa-q2wp-rjmx-x6x9-43135d3d","Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking",[5378,5379],"CVE-2025-3263","PYSEC-2026-1987",[254,5379],"2026-07-07T17:56:57.889099913Z",[5383],{"type":1398,"score":2193},[5385,5387,5388,5389,5390,5392,5393],{"type":1367,"url":5386},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3263",{"type":1364,"url":4868},{"type":1364,"url":4870},{"type":1372,"url":1638},{"type":1364,"url":5391},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fc7a69150-54f8-4e81-8094-791e7a2a0f29",{"type":1372,"url":1808},{"type":1367,"url":5394},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2wp-rjmx-x6x9",[1644],{"id":255,"slug":5397,"dossier":47,"summary":5398,"aliases":5399,"sourceIds":5402,"published":5403,"modified":5404,"checkedAt":7,"severity":5405,"references":5408,"versionKeys":5421,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[5400,5401],"CVE-2024-56326","PYSEC-2026-1475",[255,5401],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[5406,5407],{"type":1398,"score":3026},{"type":1360,"score":3920},[5409,5411,5413,5415,5416,5417,5418,5419],{"type":1364,"url":5410},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1367,"url":5412},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1464,"url":5414},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1372,"url":3929},{"type":1364,"url":4517},{"type":1364,"url":3931},{"type":1372,"url":3935},{"type":1367,"url":5420},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3939],{"id":256,"slug":5423,"dossier":47,"summary":5424,"aliases":5425,"sourceIds":5428,"published":5429,"modified":5430,"checkedAt":7,"severity":5431,"references":5433,"versionKeys":5441,"packageCount":32,"repositoryCount":417},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[5426,5427],"BIT-pillow-2026-112897","CVE-2026-112897",[256],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[5432],{"type":1360,"score":3365},[5434,5436,5438,5439,5440],{"type":1364,"url":5435},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1367,"url":5437},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1364,"url":3777},{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":257,"slug":5443,"dossier":47,"summary":5444,"aliases":5445,"sourceIds":5448,"published":5449,"modified":5450,"checkedAt":7,"severity":5451,"references":5454,"versionKeys":5460,"packageCount":32,"repositoryCount":417},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[5446,5447],"CVE-2026-44431","PYSEC-2026-141",[257,5447],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[5452,5453],{"type":1398,"score":2709},{"type":1360,"score":3715},[5455,5457,5459],{"type":1367,"url":5456},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1367,"url":5458},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1372,"url":1710},[1714,1715,1716,1717,1718,3328],{"id":258,"slug":5462,"dossier":47,"summary":5463,"aliases":5464,"sourceIds":5468,"published":5469,"modified":5470,"checkedAt":7,"severity":5471,"references":5475,"versionKeys":5493,"packageCount":32,"repositoryCount":2657},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[5465,5466,5467],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[258],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[5472,5473],{"type":1398,"score":3394},{"type":1360,"score":5474},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[5476,5478,5480,5482,5484,5486,5487,5489,5491],{"type":1367,"url":5477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1364,"url":5479},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1364,"url":5481},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1364,"url":5483},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1364,"url":5485},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1372,"url":1770},{"type":1364,"url":5488},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1364,"url":5490},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1364,"url":5492},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1782,1783,1784,2650,2651,2652,2653,2654,2655,2656],{"id":259,"slug":5495,"dossier":47,"summary":5496,"aliases":5497,"sourceIds":5500,"published":5501,"modified":5502,"checkedAt":7,"severity":5503,"references":5506,"versionKeys":5519,"packageCount":32,"repositoryCount":439},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[5498,5499],"CVE-2026-31958","PYSEC-2026-140",[259,5499],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[5504,5505],{"type":1398,"score":1540},{"type":1360,"score":2364},[5507,5509,5511,5513,5515,5516,5517],{"type":1367,"url":5508},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1367,"url":5510},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1364,"url":5512},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1364,"url":5514},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1372,"url":1885},{"type":1364,"url":3067},{"type":1364,"url":5518},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1889,1890,1891,1892],{"id":260,"slug":5521,"dossier":47,"summary":5522,"aliases":5523,"sourceIds":5526,"published":5527,"modified":5528,"checkedAt":7,"severity":5529,"references":5532,"versionKeys":5546,"packageCount":32,"repositoryCount":2657},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[5524,5525],"CVE-2026-22701","PYSEC-2026-1374",[260,5525],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[5530],{"type":1398,"score":5531},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5533,5535,5537,5539,5541,5542,5544],{"type":1364,"url":5534},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1367,"url":5536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1364,"url":5538},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1364,"url":5540},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1372,"url":2343},{"type":1372,"url":5543},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1367,"url":5545},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2792,2793,2794,2795],{"id":261,"slug":5548,"dossier":47,"summary":5549,"aliases":5550,"sourceIds":5553,"published":5554,"modified":5555,"checkedAt":7,"severity":5556,"references":5559,"versionKeys":5573,"packageCount":32,"repositoryCount":32},"ghsa-qq3j-4f4f-9583-cd76c72c","Hugging Face Transformers Regular Expression Denial of Service",[5551,5552],"CVE-2025-2099","PYSEC-2025-40",[261,5552],"2025-05-19T12:15:19Z","2026-06-10T17:02:48.111891265Z",[5557,5558],{"type":1398,"score":2193},{"type":1398,"score":1540},[5560,5562,5564,5566,5567,5569,5571],{"type":1367,"url":5561},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2099",{"type":1364,"url":5563},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F36648",{"type":1464,"url":5565},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F8cb522b4190bd556ce51be04942720650b1a3e57",{"type":1372,"url":1638},{"type":1364,"url":5568},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2025-40.yaml",{"type":1364,"url":5570},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F97b780f3-ffca-424f-ad5d-0e1c57a5bde4",{"type":1367,"url":5572},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qq3j-4f4f-9583",[1644],{"id":262,"slug":5575,"dossier":47,"summary":4669,"aliases":5576,"sourceIds":5579,"published":5580,"modified":5581,"checkedAt":7,"severity":5582,"references":5586,"versionKeys":5600,"packageCount":32,"repositoryCount":32},"ghsa-qxrp-vhvm-j765-63c6e9a2",[5577,5578],"CVE-2024-11392","PYSEC-2024-227",[262,5578],"2024-11-22T22:15:06Z","2026-09-10T03:50:21.016710762Z",[5583,5585],{"type":1398,"score":5584},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1398,"score":1399},[5587,5589,5590,5591,5592,5594,5596,5598],{"type":1367,"url":5588},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11392",{"type":1364,"url":4684},{"type":1364,"url":4686},{"type":1372,"url":1638},{"type":1364,"url":5593},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-227.yaml",{"type":1364,"url":5595},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513",{"type":1367,"url":5597},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513\u002F",{"type":1367,"url":5599},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qxrp-vhvm-j765",[1644],{"id":263,"slug":5602,"dossier":47,"summary":5603,"aliases":5604,"sourceIds":5606,"published":5607,"modified":5608,"checkedAt":7,"severity":5609,"references":5611,"versionKeys":5622,"packageCount":32,"repositoryCount":427},"ghsa-r4j5-9xpp-3985-880dec7e","Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks",[5605],"CVE-2026-115927",[263],"2026-10-28T22:43:50Z","2026-10-28T23:00:04.082411607Z",[5610],{"type":1398,"score":1796},[5612,5614,5616,5618,5620,5621],{"type":1364,"url":5613},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-r4j5-9xpp-3985",{"type":1367,"url":5615},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115927",{"type":1364,"url":5617},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3773",{"type":1364,"url":5619},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fceab33581489751a66fba8566ad6d5960d4b01c8",{"type":1372,"url":1885},{"type":1364,"url":5154},[1889,1890,1891,1892,1893,1894],{"id":264,"slug":5624,"dossier":47,"summary":5625,"aliases":5626,"sourceIds":5630,"published":5631,"modified":5632,"checkedAt":7,"severity":5633,"references":5636,"versionKeys":5650,"packageCount":32,"repositoryCount":1719},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[5627,5628,5629],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[264,5629],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[5634,5635],{"type":1398,"score":1758},{"type":1360,"score":2538},[5637,5639,5641,5643,5645,5646,5647,5648],{"type":1364,"url":5638},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1367,"url":5640},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1364,"url":5642},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1364,"url":5644},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1372,"url":1373},{"type":1364,"url":2552},{"type":1372,"url":2604},{"type":1367,"url":5649},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1377,1378,1379,1380,1381,1382,1383,1384],{"id":265,"slug":5652,"dossier":47,"summary":5653,"aliases":5654,"sourceIds":5657,"published":5658,"modified":5659,"checkedAt":7,"severity":5660,"references":5663,"versionKeys":5673,"packageCount":32,"repositoryCount":34},"ghsa-r9mr-m37c-5fr3-d43000fc","GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution",[5655,5656],"CVE-2026-73625","PYSEC-2026-3953",[265,5656],"2026-07-24T16:42:57Z","2026-09-10T13:10:47.448946391Z",[5661,5662],{"type":1398,"score":1664},{"type":1360,"score":4890},[5664,5666,5667,5669,5670,5671],{"type":1404,"url":5665},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-r9mr-m37c-5fr3",{"type":1364,"url":2841},{"type":1364,"url":5668},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe8d0fbf774d1f6baa3b481adfe48bd262e43b453",{"type":1372,"url":1413},{"type":1364,"url":2846},{"type":1367,"url":5672},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-kwarg-value-smuggling",[1421,1422,1423],{"id":266,"slug":5675,"dossier":47,"summary":5676,"aliases":5677,"sourceIds":5680,"published":5681,"modified":5682,"checkedAt":7,"severity":5683,"references":5685,"versionKeys":5700,"packageCount":32,"repositoryCount":449},"ghsa-rcv9-qm8p-9p6j-edc1db04","Hugging Face Transformers library has Regular Expression Denial of Service",[5678,5679],"CVE-2025-6051","PYSEC-2026-1988",[266,5679],"2025-09-14T18:30:26Z","2026-09-10T03:50:28.694224028Z",[5684],{"type":1398,"score":2193},[5686,5688,5690,5692,5694,5695,5697,5698],{"type":1367,"url":5687},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6051",{"type":1364,"url":5689},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F38844",{"type":1364,"url":5691},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F54a02160eb030da9be18231c77791f2eb3a52216",{"type":1364,"url":5693},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fba8eaba9865618253f997784aa565b96206426f0",{"type":1372,"url":1638},{"type":1364,"url":5696},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Faf929523-7b59-418a-bf55-301830b2ac9d",{"type":1372,"url":1808},{"type":1367,"url":5699},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rcv9-qm8p-9p6j",[1644,1645,1646,1647],{"id":267,"slug":5702,"dossier":47,"summary":5703,"aliases":5704,"sourceIds":5707,"published":5708,"modified":5709,"checkedAt":7,"severity":5710,"references":5713,"versionKeys":5722,"packageCount":32,"repositoryCount":417},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[5705,5706],"BIT-pillow-2026-112898","CVE-2026-112898",[267],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[5711],{"type":1360,"score":5712},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5714,5716,5718,5720,5721],{"type":1364,"url":5715},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1367,"url":5717},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1364,"url":5719},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":268,"slug":5724,"dossier":47,"summary":5725,"aliases":5726,"sourceIds":5728,"published":5729,"modified":5730,"checkedAt":7,"severity":5731,"references":5733,"versionKeys":5744,"packageCount":32,"repositoryCount":2351},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[5727],"CVE-2026-112939",[268],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[5732],{"type":1398,"score":4233},[5734,5736,5738,5740,5742,5743],{"type":1364,"url":5735},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1367,"url":5737},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1364,"url":5739},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1364,"url":5741},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1372,"url":2343},{"type":1364,"url":2345},[2347,2348,2349,2350],{"id":269,"slug":5746,"dossier":47,"summary":5747,"aliases":5748,"sourceIds":5751,"published":5752,"modified":5753,"checkedAt":7,"severity":5754,"references":5757,"versionKeys":5770,"packageCount":32,"repositoryCount":2554},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[5749,5750],"CVE-2026-25087","PYSEC-2026-113",[269,5750],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[5755],{"type":1398,"score":5756},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[5758,5760,5762,5764,5766,5768],{"type":1367,"url":5759},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1464,"url":5761},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1372,"url":5763},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1364,"url":5765},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1367,"url":5767},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1367,"url":5769},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[5771,5772,5773,5774],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":270,"slug":5776,"dossier":47,"summary":5777,"aliases":5778,"sourceIds":5781,"published":5782,"modified":5783,"checkedAt":7,"severity":5784,"references":5786,"versionKeys":5794,"packageCount":32,"repositoryCount":34},"ghsa-rpm5-65cw-6hj4-6c97dd77","GitPython has Command Injection via Git options bypass",[5779,5780],"CVE-2026-42215","PYSEC-2026-2160",[270,5780],"2026-04-25T23:42:16Z","2026-09-10T03:51:03.167884784Z",[5785],{"type":1398,"score":1664},[5787,5789,5791,5792],{"type":1404,"url":5788},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1367,"url":5790},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42215",{"type":1372,"url":1413},{"type":1464,"url":5793},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.47",[1421,1422,1423],{"id":271,"slug":5796,"dossier":47,"summary":5797,"aliases":5798,"sourceIds":5802,"published":4045,"modified":5803,"checkedAt":7,"severity":5804,"references":5807,"versionKeys":5825,"packageCount":32,"repositoryCount":1719},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[5799,5800,5801],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[271],"2026-09-10T03:49:48.419046410Z",[5805,5806],{"type":1398,"score":3394},{"type":1360,"score":5474},[5808,5810,5812,5814,5816,5818,5819,5821,5823],{"type":1367,"url":5809},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1364,"url":5811},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1364,"url":5813},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1364,"url":5815},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1364,"url":5817},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1372,"url":1770},{"type":1364,"url":5820},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1364,"url":5822},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1364,"url":5824},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[5826,5827,5828,1782,1783,1784,2650,2651,2652,2653,2654,2655,2656],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":272,"slug":5830,"dossier":47,"summary":5831,"aliases":5832,"sourceIds":5835,"published":5836,"modified":5837,"checkedAt":7,"severity":5838,"references":5840,"versionKeys":5858,"packageCount":32,"repositoryCount":34},"ghsa-rwj8-pgh3-r573-0bf779f8","GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL",[5833,5834],"CVE-2026-67322","PYSEC-2026-3842",[272,5834],"2026-07-21T22:06:09Z","2026-09-24T18:28:17.149390188Z",[5839],{"type":1398,"score":3363},[5841,5843,5845,5847,5848,5850,5851,5853,5855,5856],{"type":1364,"url":5842},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1367,"url":5844},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67322",{"type":1364,"url":5846},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2172",{"type":1364,"url":3500},{"type":1367,"url":5849},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1372,"url":1413},{"type":1364,"url":5852},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.52",{"type":1364,"url":5854},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3842.yaml",{"type":1372,"url":1680},{"type":1364,"url":5857},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-clone-from",[1421,1422,1423],{"id":273,"slug":5860,"dossier":47,"summary":5861,"aliases":5862,"sourceIds":5864,"published":5865,"modified":5866,"checkedAt":7,"severity":5867,"references":5869,"versionKeys":5878,"packageCount":32,"repositoryCount":2351},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[5863],"CVE-2026-112940",[273],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[5868],{"type":1398,"score":2967},[5870,5872,5874,5875,5876,5877],{"type":1364,"url":5871},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1367,"url":5873},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1364,"url":3669},{"type":1364,"url":3671},{"type":1372,"url":2343},{"type":1364,"url":2345},[2347,2348,2349,2350],{"id":274,"slug":5880,"dossier":47,"summary":5881,"aliases":5882,"sourceIds":5885,"published":5886,"modified":5887,"checkedAt":7,"severity":5888,"references":5890,"versionKeys":5898,"packageCount":32,"repositoryCount":34},"ghsa-v87r-6q3f-2j67-81913ca6","GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath",[5883,5884],"CVE-2026-44244","PYSEC-2026-2163",[274,5884],"2026-05-06T21:58:00Z","2026-09-10T03:50:47.691444343Z",[5889],{"type":1398,"score":3026},[5891,5893,5895,5896],{"type":1404,"url":5892},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-v87r-6q3f-2j67",{"type":1367,"url":5894},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44244",{"type":1372,"url":1413},{"type":1464,"url":5897},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.49",[1421,1422,1423],{"id":275,"slug":5900,"dossier":47,"summary":5901,"aliases":5902,"sourceIds":5906,"published":5907,"modified":5908,"checkedAt":7,"severity":5909,"references":5911,"versionKeys":5922,"packageCount":32,"repositoryCount":1719},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[5903,5904,5905],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[275,5905],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[5910],{"type":1398,"score":1604},[5912,5914,5916,5918,5920,5921],{"type":1367,"url":5913},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1367,"url":5915},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1763,"url":5917},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1464,"url":5919},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1372,"url":1373},{"type":1367,"url":1375},[1379,1380,1381,1382,1383,1384,1385,1386],{"id":276,"slug":5924,"dossier":47,"summary":5925,"aliases":5926,"sourceIds":5930,"published":4045,"modified":5931,"checkedAt":7,"severity":5932,"references":5935,"versionKeys":5950,"packageCount":32,"repositoryCount":427},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[5927,5928,5929],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[276],"2026-06-10T17:41:15.774477397Z",[5933,5934],{"type":1398,"score":3394},{"type":1360,"score":4050},[5936,5938,5939,5940,5941,5943,5944,5946,5948],{"type":1367,"url":5937},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1364,"url":4055},{"type":1364,"url":4057},{"type":1364,"url":4059},{"type":1364,"url":5942},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1372,"url":1770},{"type":1364,"url":5945},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1364,"url":5947},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1364,"url":5949},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1782,1783,1784,2650,2651,2652,2653],{"id":277,"slug":5952,"dossier":47,"summary":5953,"aliases":5954,"sourceIds":5958,"published":5959,"modified":5960,"checkedAt":7,"severity":5961,"references":5963,"versionKeys":5977,"packageCount":32,"repositoryCount":2055},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5955,5956,5957],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[277,5957],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5962],{"type":1360,"score":2364},[5964,5966,5968,5970,5972,5973,5974,5975],{"type":1364,"url":5965},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1367,"url":5967},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1364,"url":5969},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1364,"url":5971},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1372,"url":1373},{"type":1364,"url":2602},{"type":1372,"url":2604},{"type":1367,"url":5976},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":278,"slug":5979,"dossier":47,"summary":5980,"aliases":5981,"sourceIds":5984,"published":5985,"modified":5986,"checkedAt":7,"severity":5987,"references":5993,"versionKeys":6019,"packageCount":32,"repositoryCount":468},"ghsa-vqwp-45wm-r9r5-eaa960a2","Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission",[5982,5983],"CVE-2026-10804","PYSEC-2026-212",[278,5983],"2026-06-04T12:16:24.620Z","2026-07-23T15:00:23.893493649Z",[5988,5990,5992],{"type":1398,"score":5989},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1360,"score":5991},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1398,"score":4233},[5994,5996,5998,6000,6002,6004,6006,6007,6009,6011,6013,6015,6017],{"type":1367,"url":5995},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10804",{"type":1464,"url":5997},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fissues\u002F14622",{"type":1464,"url":5999},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F14635",{"type":1364,"url":6001},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F15397",{"type":1364,"url":6003},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002Ffec0f584dae9261abed16cad35b32922104bb933",{"type":1364,"url":6005},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstreamlit\u002FPYSEC-2026-212.yaml",{"type":1372,"url":3207},{"type":1367,"url":6008},"https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-10804",{"type":1367,"url":6010},"https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F831508",{"type":1367,"url":6012},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253",{"type":1763,"url":6014},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253\u002Fcti",{"type":1364,"url":6016},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002F",{"type":1367,"url":6018},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqwp-45wm-r9r5",[3211,3212,3213],{"id":279,"slug":6021,"dossier":47,"summary":6022,"aliases":6023,"sourceIds":6025,"published":6026,"modified":6027,"checkedAt":7,"severity":6028,"references":6030,"versionKeys":6037,"packageCount":32,"repositoryCount":417},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[6024],"CVE-2026-112899",[279],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[6029],{"type":1360,"score":2734},[6031,6033,6035,6036],{"type":1364,"url":6032},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1364,"url":6034},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":280,"slug":6039,"dossier":90,"summary":6040,"aliases":6041,"sourceIds":6044,"published":6045,"modified":6046,"checkedAt":7,"severity":6047,"references":6049,"versionKeys":6061,"packageCount":32,"repositoryCount":2749},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[6042,6043],"CVE-2026-97689","PYSEC-2026-4177",[280,6043],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[6048],{"type":1360,"score":1695},[6050,6052,6054,6056,6057,6058,6059],{"type":1364,"url":6051},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1367,"url":6053},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1364,"url":6055},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1372,"url":1710},{"type":1364,"url":3323},{"type":1372,"url":1712},{"type":1367,"url":6060},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1714,1715,1716,1717,1718,3328,3329],{"id":281,"slug":6063,"dossier":47,"summary":6064,"aliases":6065,"sourceIds":6068,"published":6069,"modified":6070,"checkedAt":7,"severity":6071,"references":6074,"versionKeys":6091,"packageCount":32,"repositoryCount":2657},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[6066,6067],"CVE-2025-68146","PYSEC-2026-1375",[281,6067],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[6072],{"type":1398,"score":6073},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[6075,6077,6079,6080,6082,6084,6086,6087,6089],{"type":1364,"url":6076},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1364,"url":6078},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1372,"url":2343},{"type":1364,"url":6081},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1364,"url":6083},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1364,"url":6085},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1372,"url":5543},{"type":1367,"url":6088},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1367,"url":6090},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2792,2793,2794,2795],{"id":282,"slug":6093,"dossier":47,"summary":6094,"aliases":6095,"sourceIds":6098,"published":6099,"modified":6100,"checkedAt":7,"severity":6101,"references":6104,"versionKeys":6113,"packageCount":32,"repositoryCount":417},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[6096,6097],"BIT-pillow-2026-112900","CVE-2026-112900",[282],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[6102],{"type":1360,"score":6103},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6105,6107,6109,6111,6112],{"type":1364,"url":6106},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1367,"url":6108},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1364,"url":6110},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1372,"url":1373},{"type":1364,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":283,"slug":6115,"dossier":47,"summary":6116,"aliases":6117,"sourceIds":6119,"published":6120,"modified":6121,"checkedAt":7,"severity":6122,"references":6124,"versionKeys":6133,"packageCount":32,"repositoryCount":34},"ghsa-w8jc-g24h-crhw-5553514f","GitPython command wrappers omit unsafe protocol and option checks",[6118],"CVE-2026-110857",[283],"2026-10-27T15:26:43Z","2026-10-27T15:47:24.947223105Z",[6123],{"type":1398,"score":3224},[6125,6127,6129,6131,6132],{"type":1364,"url":6126},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-w8jc-g24h-crhw",{"type":1364,"url":6128},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2251",{"type":1364,"url":6130},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9ad28cc4c7176d22cd6181d69805058a719dd03b",{"type":1372,"url":1413},{"type":1364,"url":1444},[1421,1422,1423],{"id":284,"slug":6135,"dossier":47,"summary":6136,"aliases":6137,"sourceIds":6141,"published":6142,"modified":6143,"checkedAt":7,"severity":6144,"references":6147,"versionKeys":6185,"packageCount":32,"repositoryCount":1719},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[6138,6139,6140],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[284,6140],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[6145,6146],{"type":1398,"score":1540},{"type":1360,"score":2364},[6148,6150,6152,6154,6156,6157,6159,6161,6163,6165,6167,6169,6170,6172,6174,6176,6177,6179,6181,6183],{"type":1364,"url":6149},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1367,"url":6151},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1364,"url":6153},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1364,"url":6155},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1372,"url":1373},{"type":1364,"url":6158},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1364,"url":6160},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1364,"url":6162},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1367,"url":6164},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1367,"url":6166},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1367,"url":6168},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1367,"url":3844},{"type":1367,"url":6171},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1367,"url":6173},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1367,"url":6175},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1367,"url":3846},{"type":1367,"url":6178},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1367,"url":6180},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1367,"url":6182},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1367,"url":6184},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1377,1378,1379,1380,1381,1382,1383,1384],{"id":285,"slug":6187,"dossier":47,"summary":6188,"aliases":6189,"sourceIds":6193,"published":6194,"modified":6195,"checkedAt":7,"severity":6196,"references":6199,"versionKeys":6208,"packageCount":32,"repositoryCount":1719},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[6190,6191,6192],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[285,6192],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[6197,6198],{"type":1398,"score":1758},{"type":1360,"score":2538},[6200,6202,6204,6206,6207],{"type":1367,"url":6201},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1367,"url":6203},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1364,"url":6205},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1372,"url":1373},{"type":1367,"url":2552},[1377,1378,1379,1380,1381,1382,1383,1384],{"id":286,"slug":6210,"dossier":47,"summary":4669,"aliases":6211,"sourceIds":6214,"published":4674,"modified":6215,"checkedAt":7,"severity":6216,"references":6219,"versionKeys":6233,"packageCount":32,"repositoryCount":32},"ghsa-wrfc-pvp9-mr9g-c6b03ddf",[6212,6213],"CVE-2024-11393","PYSEC-2024-228",[286,6213],"2026-09-10T03:50:55.987633957Z",[6217,6218],{"type":1398,"score":4678},{"type":1398,"score":1399},[6220,6222,6223,6224,6225,6227,6229,6231],{"type":1367,"url":6221},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11393",{"type":1364,"url":4684},{"type":1364,"url":4686},{"type":1372,"url":1638},{"type":1364,"url":6226},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-228.yaml",{"type":1364,"url":6228},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514",{"type":1367,"url":6230},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514\u002F",{"type":1367,"url":6232},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wrfc-pvp9-mr9g",[1644],{"id":287,"slug":6235,"dossier":47,"summary":6236,"aliases":6237,"sourceIds":6240,"published":6241,"modified":6242,"checkedAt":7,"severity":6243,"references":6245,"versionKeys":6260,"packageCount":32,"repositoryCount":34},"ghsa-wvpp-8hx9-p66j-188b3951","GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution",[6238,6239],"CVE-2026-76220","PYSEC-2026-3843",[287,6239],"2026-08-07T15:49:07Z","2026-09-10T12:26:01.792035310Z",[6244],{"type":1398,"score":1664},[6246,6248,6250,6251,6253,6254,6255,6257,6258],{"type":1364,"url":6247},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",{"type":1367,"url":6249},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76220",{"type":1364,"url":2122},{"type":1364,"url":6252},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F96a888f4d782cb2f80452148e48e60ce4af6d541",{"type":1372,"url":1413},{"type":1364,"url":2127},{"type":1364,"url":6256},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-execution-via-split-single-char-options",{"type":1372,"url":1680},{"type":1367,"url":6259},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",[1421,1422,1423],{"id":288,"slug":6262,"dossier":47,"summary":6263,"aliases":6264,"sourceIds":6266,"published":6267,"modified":6268,"checkedAt":7,"severity":6269,"references":6272,"versionKeys":6284,"packageCount":32,"repositoryCount":478},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[6265],"CVE-2026-91991",[288],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[6270],{"type":1360,"score":6271},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6273,6275,6276,6278,6280,6282,6283],{"type":1364,"url":6274},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1364,"url":3252},{"type":1364,"url":6277},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1364,"url":6279},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1364,"url":6281},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1372,"url":1885},{"type":1364,"url":3259},[1893,1894],{"id":289,"slug":6286,"dossier":47,"summary":6287,"aliases":6288,"sourceIds":6291,"published":6292,"modified":6293,"checkedAt":7,"severity":6294,"references":6297,"versionKeys":6306,"packageCount":32,"repositoryCount":34},"ghsa-x2qx-6953-8485-107f8fe2","GitPython: Unsafe option check validates multi_options before shlex.split transformation",[6289,6290],"CVE-2026-42284","PYSEC-2026-2161",[289,6290],"2026-04-25T23:41:49Z","2026-09-10T03:51:03.787491179Z",[6295,6296],{"type":1398,"score":3082},{"type":1398,"score":1604},[6298,6300,6302,6303,6304],{"type":1404,"url":6299},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-x2qx-6953-8485",{"type":1367,"url":6301},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42284",{"type":1372,"url":1413},{"type":1464,"url":5793},{"type":1364,"url":6305},"https:\u002F\u002Fwww.tenable.com\u002Fcve\u002FCVE-2026-32686",[1421,1422,1423],{"id":290,"slug":6308,"dossier":47,"summary":6309,"aliases":6310,"sourceIds":6314,"published":6315,"modified":6316,"checkedAt":7,"severity":6317,"references":6322,"versionKeys":6338,"packageCount":32,"repositoryCount":478},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[6311,6312,6313],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[290],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[6318,6320],{"type":1398,"score":6319},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":1360,"score":6321},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6323,6325,6327,6329,6331,6332,6334,6336],{"type":1367,"url":6324},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1364,"url":6326},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1364,"url":6328},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1364,"url":6330},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1372,"url":1770},{"type":1364,"url":6333},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1364,"url":6335},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1364,"url":6337},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1782,1783],{"id":291,"slug":6340,"dossier":47,"summary":6341,"aliases":6342,"sourceIds":6345,"published":6346,"modified":6347,"checkedAt":7,"severity":6348,"references":6350,"versionKeys":6365,"packageCount":32,"repositoryCount":427},"ghsa-x9r9-c232-4q39-1586e326","Hugging Face Transformers downloads custom generation code before trust consent",[6343,6344],"CVE-2026-80047","PYSEC-2026-4174",[291,6344],"2026-09-01T15:31:13Z","2026-10-01T17:55:55.397425521Z",[6349],{"type":1398,"score":3026},[6351,6353,6355,6357,6358,6360,6362,6363],{"type":1367,"url":6352},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80047",{"type":1364,"url":6354},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F48620",{"type":1364,"url":6356},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fcbc1651a032b923da7f4b44b3d0e6f68e6ba6b55",{"type":1372,"url":1638},{"type":1364,"url":6359},"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1364,"url":6361},"https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1372,"url":1808},{"type":1367,"url":6364},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-x9r9-c232-4q39",[1645,1646,1647,1648,1649,1650,1651,1652,6366],"pypi:transformers@5.8.0",{"id":292,"slug":6368,"dossier":47,"summary":6369,"aliases":6370,"sourceIds":6374,"published":6375,"modified":6376,"checkedAt":7,"severity":6377,"references":6379,"versionKeys":6393,"packageCount":32,"repositoryCount":449},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[6371,6372,6373],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[292,6373],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[6378],{"type":1398,"score":2967},[6380,6382,6384,6386,6388,6390,6391],{"type":1367,"url":6381},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1367,"url":6383},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1364,"url":6385},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1464,"url":6387},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1364,"url":6389},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1372,"url":1373},{"type":1364,"url":6392},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1380],{"id":293,"slug":6395,"dossier":47,"summary":6396,"aliases":6397,"sourceIds":6401,"published":6402,"modified":6403,"checkedAt":7,"severity":6404,"references":6407,"versionKeys":6416,"packageCount":32,"repositoryCount":417},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[6398,6399,6400],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[293,6400],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[6405,6406],{"type":1360,"score":2734},{"type":1398,"score":1540},[6408,6410,6412,6414,6415],{"type":1464,"url":6409},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1367,"url":6411},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1464,"url":6413},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":294,"slug":6418,"dossier":47,"summary":6419,"aliases":6420,"sourceIds":6424,"published":6425,"modified":6426,"checkedAt":7,"severity":6427,"references":6430,"versionKeys":6441,"packageCount":32,"repositoryCount":2055},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[6421,6422,6423],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[294,6423],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[6428],{"type":1398,"score":6429},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[6431,6433,6435,6437,6439,6440],{"type":1404,"url":6432},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1367,"url":6434},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1464,"url":6436},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1464,"url":6438},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1372,"url":1373},{"type":1367,"url":2602},[1377,1378,1379,1380,1381,1382,1383,1384,1385],{"id":295,"slug":6443,"dossier":47,"summary":6444,"aliases":6445,"sourceIds":6446,"published":6447,"modified":6448,"checkedAt":7,"severity":6449,"references":6452,"versionKeys":6462,"packageCount":32,"repositoryCount":417},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[295],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[6450],{"type":1360,"score":6451},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[6453,6455,6457,6459,6460],{"type":1364,"url":6454},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1364,"url":6456},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1364,"url":6458},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1372,"url":2447},{"type":1364,"url":6461},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[2453,2454,2455,2456,4567,4568,4569,4570,4571,4572,4573,4574],{"id":296,"slug":6464,"dossier":47,"summary":6465,"aliases":6466,"sourceIds":6469,"published":6470,"modified":6471,"checkedAt":7,"severity":6472,"references":6475,"versionKeys":6488,"packageCount":32,"repositoryCount":42},"ghsa-xrqw-3rrv-vx5w-3d985837","Transformers save_pretrained path traversal allows arbitrary file writes through chat template names",[6467,6468],"CVE-2026-9856","PYSEC-2026-3929",[296,6468],"2026-08-02T18:30:20Z","2026-09-10T12:25:36.528730268Z",[6473],{"type":1398,"score":6474},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[6476,6478,6480,6482,6483,6485,6486],{"type":1367,"url":6477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9856",{"type":1364,"url":6479},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F46191",{"type":1364,"url":6481},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Feaaaf8494dd5386634ae37d1d122212fdc315be5",{"type":1372,"url":1638},{"type":1364,"url":6484},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F362824d5-fe18-40e8-a6cf-62277f97a170",{"type":1372,"url":1808},{"type":1367,"url":6487},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xrqw-3rrv-vx5w",[1644,1645,1646,1647,1648,1649,1650,1651,1652,6366],{"id":297,"slug":6490,"dossier":47,"summary":6491,"aliases":6492,"sourceIds":6495,"published":6496,"modified":6497,"checkedAt":7,"severity":6498,"references":6503,"versionKeys":6518,"packageCount":32,"repositoryCount":417},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[6493,6494],"CVE-2026-112902","PYSEC-2026-4363",[297,6494],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[6499,6501],{"type":1360,"score":6500},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1398,"score":6502},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[6504,6506,6508,6510,6512,6514,6516,6517],{"type":1464,"url":6505},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1367,"url":6507},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1364,"url":6509},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1464,"url":6511},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1464,"url":6513},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1364,"url":6515},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1372,"url":1373},{"type":1367,"url":1375},[1377,1378,1379,1380,1381,1382,1383,1384,1385,1386],{"id":298,"slug":6520,"dossier":47,"summary":83,"aliases":6521,"sourceIds":6524,"published":6525,"modified":6526,"checkedAt":7,"severity":6527,"references":6530,"versionKeys":6539,"packageCount":32,"repositoryCount":32},"pysec-2025-112-653e8a7c",[6522,6523],"CVE-2025-64429","GHSA-vmp8-hg63-v2hp",[298],"2025-11-12T22:15:49.813Z","2026-05-20T09:18:59.601738Z",[6528],{"type":1398,"score":6529},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[6531,6533,6535,6537],{"type":1364,"url":6532},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fblob\u002F029a5b87ff5b1cd22f7f9717d48cd8830d00807c\u002Fsrc\u002Fcommon\u002Frandom_engine.cpp#L20",{"type":1367,"url":6534},"https:\u002F\u002Fduckdb.org\u002F2025\u002F09\u002F16\u002Fannouncing-duckdb-140.html",{"type":1367,"url":6536},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fsecurity\u002Fadvisories\u002FGHSA-vmp8-hg63-v2hp",{"type":1464,"url":6538},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fpull\u002F17275",[6540],"pypi:duckdb@1.4.1",{"id":299,"slug":6542,"dossier":47,"summary":83,"aliases":6543,"sourceIds":6546,"published":6547,"modified":6548,"checkedAt":7,"severity":6549,"references":6551,"versionKeys":6560,"packageCount":32,"repositoryCount":478},"pysec-2025-198-62b25ed4",[6544,6545],"BIT-pytorch-2025-46148","CVE-2025-46148",[299],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[6550],{"type":1398,"score":2709},[6552,6554,6556,6558],{"type":1367,"url":6553},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1367,"url":6555},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1763,"url":6557},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1464,"url":6559},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1782,1783],{"id":300,"slug":6562,"dossier":47,"summary":83,"aliases":6563,"sourceIds":6566,"published":6567,"modified":6568,"checkedAt":7,"severity":6569,"references":6571,"versionKeys":6577,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[6564,6565],"BIT-pytorch-2025-46149","CVE-2025-46149",[300],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[6570],{"type":1398,"score":2709},[6572,6573,6575],{"type":1367,"url":6553},{"type":1763,"url":6574},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1464,"url":6576},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1783],{"id":301,"slug":6579,"dossier":47,"summary":83,"aliases":6580,"sourceIds":6583,"published":6584,"modified":6585,"checkedAt":7,"severity":6586,"references":6588,"versionKeys":6596,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[6581,6582],"BIT-pytorch-2025-46150","CVE-2025-46150",[301],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[6587],{"type":1398,"score":2709},[6589,6590,6592,6594],{"type":1367,"url":6553},{"type":1763,"url":6591},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1763,"url":6593},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1464,"url":6595},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1783],{"id":302,"slug":6598,"dossier":47,"summary":83,"aliases":6599,"sourceIds":6602,"published":6603,"modified":6604,"checkedAt":7,"severity":6605,"references":6607,"versionKeys":6613,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[6600,6601],"BIT-pytorch-2025-46152","CVE-2025-46152",[302],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[6606],{"type":1398,"score":1796},[6608,6609,6611],{"type":1367,"url":6553},{"type":1763,"url":6610},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1464,"url":6612},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1783],{"id":303,"slug":6615,"dossier":47,"summary":83,"aliases":6616,"sourceIds":6619,"published":6620,"modified":6621,"checkedAt":7,"severity":6622,"references":6624,"versionKeys":6634,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[6617,6618],"BIT-pytorch-2025-46153","CVE-2025-46153",[303],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[6623],{"type":1398,"score":2709},[6625,6627,6628,6630,6632],{"type":1364,"url":6626},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1367,"url":6553},{"type":1367,"url":6629},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1763,"url":6631},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1464,"url":6633},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1783],{"id":304,"slug":6636,"dossier":47,"summary":83,"aliases":6637,"sourceIds":6640,"published":6641,"modified":6642,"checkedAt":7,"severity":6643,"references":6645,"versionKeys":6650,"packageCount":32,"repositoryCount":3805},"pysec-2025-203-2febb201",[6638,6639],"BIT-pytorch-2025-55551","CVE-2025-55551",[304],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[6644],{"type":1398,"score":1540},[6646,6648],{"type":1367,"url":6647},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1763,"url":6649},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1782,1783,1784,2650,2651,2652],{"id":305,"slug":6652,"dossier":47,"summary":83,"aliases":6653,"sourceIds":6656,"published":6657,"modified":6658,"checkedAt":7,"severity":6659,"references":6661,"versionKeys":6665,"packageCount":32,"repositoryCount":3805},"pysec-2025-204-cdae47da",[6654,6655],"BIT-pytorch-2025-55552","CVE-2025-55552",[305],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[6660],{"type":1398,"score":1540},[6662,6663],{"type":1367,"url":6647},{"type":1763,"url":6664},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1782,1783,1784,2650,2651,2652],{"id":306,"slug":6667,"dossier":47,"summary":83,"aliases":6668,"sourceIds":6671,"published":6672,"modified":6673,"checkedAt":7,"severity":6674,"references":6676,"versionKeys":6682,"packageCount":32,"repositoryCount":468},"pysec-2025-205-fd5e58fd",[6669,6670],"BIT-pytorch-2025-55553","CVE-2025-55553",[306],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[6675],{"type":1398,"score":1540},[6677,6678,6680],{"type":1367,"url":6647},{"type":1763,"url":6679},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1464,"url":6681},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1782,1783,1784],{"id":307,"slug":6684,"dossier":47,"summary":83,"aliases":6685,"sourceIds":6688,"published":6689,"modified":6690,"checkedAt":7,"severity":6691,"references":6693,"versionKeys":6697,"packageCount":32,"repositoryCount":3805},"pysec-2025-206-58322476",[6686,6687],"BIT-pytorch-2025-55554","CVE-2025-55554",[307],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[6692],{"type":1398,"score":1796},[6694,6695],{"type":1367,"url":6647},{"type":1763,"url":6696},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1782,1783,1784,2650,2651,2652],{"id":308,"slug":6699,"dossier":47,"summary":83,"aliases":6700,"sourceIds":6703,"published":6704,"modified":6705,"checkedAt":7,"severity":6706,"references":6708,"versionKeys":6714,"packageCount":32,"repositoryCount":468},"pysec-2025-207-2abef3fc",[6701,6702],"BIT-pytorch-2025-55557","CVE-2025-55557",[308],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[6707],{"type":1398,"score":1540},[6709,6710,6712],{"type":1367,"url":6647},{"type":1763,"url":6711},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1464,"url":6713},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1782,1783,1784],{"id":309,"slug":6716,"dossier":47,"summary":83,"aliases":6717,"sourceIds":6720,"published":6721,"modified":6722,"checkedAt":7,"severity":6723,"references":6725,"versionKeys":6731,"packageCount":32,"repositoryCount":468},"pysec-2025-208-6e93fe9d",[6718,6719],"BIT-pytorch-2025-55558","CVE-2025-55558",[309],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[6724],{"type":1398,"score":1540},[6726,6727,6729],{"type":1367,"url":6647},{"type":1763,"url":6728},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1464,"url":6730},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1782,1783,1784],{"id":310,"slug":6733,"dossier":47,"summary":83,"aliases":6734,"sourceIds":6737,"published":6738,"modified":6739,"checkedAt":7,"severity":6740,"references":6742,"versionKeys":6748,"packageCount":32,"repositoryCount":468},"pysec-2025-209-e6f352b0",[6735,6736],"BIT-pytorch-2025-55560","CVE-2025-55560",[310],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[6741],{"type":1398,"score":1540},[6743,6744,6746],{"type":1367,"url":6647},{"type":1763,"url":6745},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1464,"url":6747},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1782,1783,1784],{"id":311,"slug":6750,"dossier":47,"summary":83,"aliases":6751,"sourceIds":6753,"published":6754,"modified":6755,"checkedAt":7,"severity":6756,"references":6758,"versionKeys":6761,"packageCount":32,"repositoryCount":2351},"pysec-2025-211-d8bd15de",[6752],"CVE-2025-14920",[311],"2025-12-23T21:15:47.183Z","2026-05-21T15:00:32.080516132Z",[6757],{"type":1398,"score":1631},[6759],{"type":1367,"url":6760},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1150\u002F",[1644,1645,1646,1647,1648],{"id":312,"slug":6763,"dossier":47,"summary":83,"aliases":6764,"sourceIds":6766,"published":6767,"modified":6768,"checkedAt":7,"severity":6769,"references":6771,"versionKeys":6774,"packageCount":32,"repositoryCount":2351},"pysec-2025-212-a011b97d",[6765],"CVE-2025-14921",[312],"2025-12-23T21:15:47.340Z","2026-05-21T15:00:32.052313357Z",[6770],{"type":1398,"score":1631},[6772],{"type":1367,"url":6773},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1149\u002F",[1644,1645,1646,1647,1648],{"id":313,"slug":6776,"dossier":47,"summary":83,"aliases":6777,"sourceIds":6779,"published":6780,"modified":6781,"checkedAt":7,"severity":6782,"references":6784,"versionKeys":6787,"packageCount":32,"repositoryCount":2351},"pysec-2025-213-9043dc9b",[6778],"CVE-2025-14924",[313],"2025-12-23T21:15:47.600Z","2026-05-21T15:00:32.048516839Z",[6783],{"type":1398,"score":1631},[6785],{"type":1367,"url":6786},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1141\u002F",[1644,1645,1646,1647,1648],{"id":314,"slug":6789,"dossier":47,"summary":83,"aliases":6790,"sourceIds":6792,"published":6793,"modified":6794,"checkedAt":7,"severity":6795,"references":6797,"versionKeys":6800,"packageCount":32,"repositoryCount":2351},"pysec-2025-214-eb241255",[6791],"CVE-2025-14926",[314],"2025-12-23T21:15:47.857Z","2026-05-21T15:00:32.929011749Z",[6796],{"type":1398,"score":1631},[6798],{"type":1367,"url":6799},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1147\u002F",[1644,1645,1646,1647,1648],{"id":315,"slug":6802,"dossier":47,"summary":83,"aliases":6803,"sourceIds":6805,"published":6806,"modified":6807,"checkedAt":7,"severity":6808,"references":6810,"versionKeys":6813,"packageCount":32,"repositoryCount":2351},"pysec-2025-215-6064f491",[6804],"CVE-2025-14927",[315],"2025-12-23T21:15:47.987Z","2026-05-21T15:00:32.888290877Z",[6809],{"type":1398,"score":1631},[6811],{"type":1367,"url":6812},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1148\u002F",[1644,1645,1646,1647,1648],{"id":316,"slug":6815,"dossier":47,"summary":83,"aliases":6816,"sourceIds":6818,"published":6819,"modified":6820,"checkedAt":7,"severity":6821,"references":6823,"versionKeys":6826,"packageCount":32,"repositoryCount":2351},"pysec-2025-216-5708ed01",[6817],"CVE-2025-14928",[316],"2025-12-23T21:15:48.110Z","2026-05-21T15:00:32.939311939Z",[6822],{"type":1398,"score":1631},[6824],{"type":1367,"url":6825},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1146\u002F",[1644,1645,1646,1647,1648],{"id":317,"slug":6828,"dossier":47,"summary":83,"aliases":6829,"sourceIds":6831,"published":6832,"modified":6833,"checkedAt":7,"severity":6834,"references":6836,"versionKeys":6839,"packageCount":32,"repositoryCount":427},"pysec-2025-217-2c1ad388",[6830],"CVE-2025-14929",[317],"2025-12-23T21:15:48.240Z","2026-05-21T15:00:24.271970226Z",[6835],{"type":1398,"score":1631},[6837],{"type":1367,"url":6838},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1144\u002F",[1644,1645,1646,1647,1648,1649,1650,1651,1652],{"id":318,"slug":6841,"dossier":47,"summary":83,"aliases":6842,"sourceIds":6844,"published":6845,"modified":6846,"checkedAt":7,"severity":6847,"references":6849,"versionKeys":6852,"packageCount":32,"repositoryCount":2104},"pysec-2025-218-39811fc3",[6843],"CVE-2025-14930",[318],"2025-12-23T21:15:48.367Z","2026-05-21T15:00:33.791364554Z",[6848],{"type":1398,"score":1631},[6850],{"type":1367,"url":6851},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1145\u002F",[1644,1645,1646,1647,1648,1649],{"id":319,"slug":6854,"dossier":47,"summary":83,"aliases":6855,"sourceIds":6858,"published":6859,"modified":6860,"checkedAt":7,"severity":6861,"references":6863,"versionKeys":6874,"packageCount":32,"repositoryCount":103},"pysec-2026-139-96951ff6",[6856,6857],"BIT-pytorch-2026-4538","CVE-2026-4538",[319],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[6862],{"type":1398,"score":3026},[6864,6866,6868,6870,6872],{"type":1364,"url":6865},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1367,"url":6867},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1367,"url":6869},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1763,"url":6871},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1464,"url":6873},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[5826,1782,1783,1784,2650,2651,2652,2653,2654,2655,2656],1794474422290]