[{"data":1,"prerenderedAt":6185},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-13749":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":77,"entity":78,"evidence":292,"related":300},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-15T06:22:58.222Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-15T06:19:38.732Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5086,5074,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":66,"licenseExpressionCount":67,"knownLicensePackageCount":68,"unknownLicensePackageCount":69,"advisoryCount":70,"matchedAdvisoryRepositoryCount":71,"topPackage":72},2871,51,9941,11,63,2832,39,1120,43,{"id":73,"slug":74,"label":75,"repositoryCount":33,"repositoryShare":76},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":103,"artifactResolvedComponentCount":102,"exactManifestPinCount":32,"packageCount":102,"ecosystems":104,"aiPackageCount":32,"licenseExpressionCount":106,"unknownLicensePackageCount":39,"advisoryIds":107,"advisoryCount":290,"providers":291},"opencode:13749","opencode-13749",13749,"data_quality_in_wastewater_surveillance","uba-ki-lab\u002Fdata_quality_in_wastewater_surveillance","In this project, the data quality of wastewater treatment plants (WWTPs) and laboratories is evaluated based on different data quality indicators. This can be used to rank WWTPs and laboratories and to select the most suitable ones for future probing. Pathogen data of SARS-Cov-2, Influenza A & B and RSV A, B & AB were evaluated, alongside with other parameters (e.g. water temperature, pH, inflow to the WWTPs).","https:\u002F\u002Fgitlab.opencode.de\u002Fuba-ki-lab\u002Fdata_quality_in_wastewater_surveillance","0af16889aafa3845d5df2fdddeeed333c5e4b85b","https:\u002F\u002Fgitlab.opencode.de\u002Fuba-ki-lab\u002Fdata_quality_in_wastewater_surveillance\u002F-\u002Fcommit\u002F0af16889aafa3845d5df2fdddeeed333c5e4b85b","2026-10-29T10:51:46.074Z","2026-10-29T10:51:29.000Z",{"complete":91,"entryCount":92,"truncated":47},true,37,[94],{"path":95,"kind":96,"blobSha":97,"sourceUrl":98,"commitSha":86,"contentSha256":99,"byteCount":100,"state":101,"componentCount":102},"sbom.json","sbom-json","5ad0fbc6b08df4722ff5bb79571cb77c8f34a900","https:\u002F\u002Fgitlab.opencode.de\u002Fuba-ki-lab\u002Fdata_quality_in_wastewater_surveillance\u002F-\u002Fblob\u002F0af16889aafa3845d5df2fdddeeed333c5e4b85b\u002Fsbom.json","806793e1fdd922d089f51c76029c4a3673d05a0267c358bc3042808a343982e1",199673,"parsed",136,137,[105],"pypi",20,[108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289],"GHSA-22hg-r758-rrw9","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-2hm2-hc3v-44h9","GHSA-2wc2-fm75-p42x","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-33p9-3p43-82vq","GHSA-38jv-5279-wg99","GHSA-394h-qwmc-48pf","GHSA-3hv7-mjh2-fv65","GHSA-3j72-p6qg-6xp7","GHSA-3x9g-8vmp-wqvf","GHSA-43mp-35q3-x3fq","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-494p-63j8-28p3","GHSA-4c99-qj7h-p3vg","GHSA-4j32-57v6-6g45","GHSA-4j63-6c4x-wfg4","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4x4j-2g7c-83w6","GHSA-4xh5-x5gv-qwph","GHSA-5239-wwwm-4pmq","GHSA-558c-9hv2-4prj","GHSA-567q-5qvw-pf92","GHSA-58cw-g322-p94v","GHSA-58qw-9mgm-455v","GHSA-58r4-6rv3-gfh8","GHSA-597g-3phw-6986","GHSA-5cjw-f85j-cv6r","GHSA-5vjq-rrrf-7h2q","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-62p4-gmf7-7g93","GHSA-6497-prx7-gpmq","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-6655-6qjp-jx7x","GHSA-69hj-f68j-2879","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6vgw-5pg2-w6jp","GHSA-6w3r-xr62-4xcp","GHSA-6w46-j5rx-g56g","GHSA-74r2-7ff9-mjj2","GHSA-768j-98cg-p3fv","GHSA-78cv-mqj4-43f7","GHSA-78g4-xqwv-q3g8","GHSA-7cx3-6m66-7c5m","GHSA-7g44-g9rc-x53w","GHSA-7jqv-fw35-gmx9","GHSA-7mwm-ghpf-9vrm","GHSA-836r-79rf-4m37","GHSA-8423-8fgw-73vq","GHSA-8988-9cw3-xx77","GHSA-8c25-4j27-2rv3","GHSA-8g5g-8vmr-9782","GHSA-8g87-j6q8-g93x","GHSA-8mp2-v27r-99xp","GHSA-8mpj-m6qm-5qr8","GHSA-8mx5-7m5m-r77g","GHSA-8rfp-98v4-mmr6","GHSA-8rjx-v5ww-45pp","GHSA-8v84-f9pq-wr9x","GHSA-94p9-xgh2-xp45","GHSA-9754-6rhw-gj3h","GHSA-9h9j-4vrj-gf7g","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c6hw-5grf-ff96","GHSA-c8j7-8cv4-2xmq","GHSA-c947-3pg5-gm8q","GHSA-c978-59m8-c77v","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cw65-gx24-rc82","GHSA-cwqr-hh33-gh44","GHSA-cx28-75q4-x26q","GHSA-cx3h-4qpv-8hc9","GHSA-f2g6-542v-9j58","GHSA-fc2g-4w5p-6whm","GHSA-fc9g-5qg7-mf45","GHSA-ffq3-xpv3-j92q","GHSA-fj7v-r99m-22gq","GHSA-fq56-3cx3-fjxp","GHSA-g4qv-2jxx-769h","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-g97x-gvcm-x72h","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gj48-438w-jh9v","GHSA-gjv8-xp57-g29c","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-h75v-3vvj-5mfj","GHSA-h7ww-273w-6cm8","GHSA-hhxq-47xx-j5xx","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-j934-xhv5-fg8f","GHSA-jg86-v3jv-hrpm","GHSA-jhmp-mqwm-3gq8","GHSA-jjj6-mw9f-p565","GHSA-jp4c-xjxw-mgf9","GHSA-jw8x-6495-233v","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mgf9-4vpg-hj56","GHSA-mmhr-3c5m-f64f","GHSA-mpf4-983q-p7j4","GHSA-mq26-g339-26xf","GHSA-mrfp-p49p-3hf2","GHSA-p4wg-p73j-c528","GHSA-p58f-9548-mpm2","GHSA-p8hx-v2p6-rp84","GHSA-pcg2-g6cj-q92c","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phj9-mv4w-65pm","GHSA-pjvx-prjx-h659","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pw9p-v7r6-gx4p","GHSA-pwv6-vv43-88gr","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qcq2-496w-v96p","GHSA-qfrw-5rxm-mhh2","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-qmx5-4p3x-wvqf","GHSA-qwm4-qh6w-59xr","GHSA-r4j5-9xpp-3985","GHSA-r4rv-85jg-w4mf","GHSA-r73j-pqj5-w3x7","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-v4x8-3wr5-3wq8","GHSA-v87v-83h2-53w7","GHSA-v9pv-5gc8-w2m6","GHSA-vfmq-68hx-4jfw","GHSA-vjc4-5qp5-m44j","GHSA-vx6w-vv9f-6gvg","GHSA-vxj4-q4g9-crj7","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-wf93-45jw-7689","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wqgw-9xfh-qf2g","GHSA-wwv5-g3v4-889x","GHSA-x78j-v8h9-3j2q","GHSA-xcvg-w56q-r89m","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xm59-rqc7-hhvf","GHSA-xvh5-g6gv-559v","PYSEC-2026-2208","PYSEC-2026-2209",182,[],{"files":293,"occurrenceCount":103},[294,299],{"path":295,"kind":296,"sourceUrl":297,"commitSha":86,"blobSha":298,"state":101,"componentCount":32},"requirements.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Fuba-ki-lab\u002Fdata_quality_in_wastewater_surveillance\u002F-\u002Fblob\u002F0af16889aafa3845d5df2fdddeeed333c5e4b85b\u002Frequirements.txt","fcff200e19c80173c9a06dd18369836885f00eef",{"path":95,"kind":96,"blobSha":97,"sourceUrl":98,"commitSha":86,"contentSha256":99,"byteCount":100,"state":101,"componentCount":102},{"packages":301,"vulnerabilities":1542},[302,315,326,336,346,356,366,376,386,396,406,416,426,435,445,454,463,472,481,490,500,509,518,528,537,546,555,564,573,582,591,602,611,620,629,638,647,656,665,674,683,692,702,711,720,729,738,747,756,765,776,785,794,803,812,820,829,839,848,857,865,874,883,892,901,911,920,929,938,948,957,966,975,984,993,1002,1011,1019,1028,1037,1047,1056,1065,1075,1084,1093,1102,1111,1120,1129,1138,1147,1156,1165,1173,1181,1190,1199,1208,1217,1226,1234,1242,1250,1259,1268,1277,1286,1295,1304,1313,1322,1331,1340,1349,1358,1367,1376,1385,1394,1403,1412,1421,1430,1439,1448,1457,1465,1474,1480,1488,1497,1506,1515,1524,1533],{"id":303,"slug":304,"identity":305,"label":306,"aiRelevant":91,"provider":307,"advisoryCount":32,"licenseExpressions":308,"versions":311,"dossier":91,"occurrenceCount":313,"directOccurrenceCount":32,"evidenceFiles":314},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",null,[309,310],"BSD-3-Clause","non-standard",[312],"1.7.2",2,[295,95],{"id":316,"slug":317,"identity":318,"label":319,"aiRelevant":47,"provider":307,"advisoryCount":67,"licenseExpressions":320,"versions":323,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":325},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",[321,322],"HPND","MIT-CMU",[324],"11.3.0",[95],{"id":327,"slug":328,"identity":329,"label":330,"aiRelevant":47,"provider":307,"advisoryCount":106,"licenseExpressions":331,"versions":333,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":335},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",[332],"Apache-2.0",[334],"6.5.2",[95],{"id":337,"slug":338,"identity":339,"label":340,"aiRelevant":47,"provider":307,"advisoryCount":106,"licenseExpressions":341,"versions":343,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":345},"package:pypi:virtualenv","virtualenv-aeb2a546","pypi:virtualenv","virtualenv",[342],"MIT",[344],"20.32.0",[95],{"id":347,"slug":348,"identity":349,"label":350,"aiRelevant":47,"provider":307,"advisoryCount":351,"licenseExpressions":352,"versions":353,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":355},"package:pypi:mistune","mistune-883ae9a9","pypi:mistune","mistune",17,[309],[354],"3.1.4",[95],{"id":357,"slug":358,"identity":359,"label":360,"aiRelevant":47,"provider":307,"advisoryCount":66,"licenseExpressions":361,"versions":363,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":365},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",[342,362],"Unlicense",[364],"3.18.0",[95],{"id":367,"slug":368,"identity":369,"label":370,"aiRelevant":47,"provider":307,"advisoryCount":371,"licenseExpressions":372,"versions":373,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":375},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[342],[374],"2.5.0",[95],{"id":377,"slug":378,"identity":379,"label":380,"aiRelevant":47,"provider":307,"advisoryCount":381,"licenseExpressions":382,"versions":383,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":385},"package:pypi:soupsieve","soupsieve-91552d8b","pypi:soupsieve","soupsieve",8,[342],[384],"2.8",[95],{"id":387,"slug":388,"identity":389,"label":390,"aiRelevant":47,"provider":307,"advisoryCount":391,"licenseExpressions":392,"versions":393,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":395},"package:pypi:pip","pip-2911c768","pypi:pip","pip",7,[342],[394],"26.2.1",[95],{"id":397,"slug":398,"identity":399,"label":400,"aiRelevant":47,"provider":307,"advisoryCount":401,"licenseExpressions":402,"versions":403,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":405},"package:pypi:nbconvert","nbconvert-a72151db","pypi:nbconvert","nbconvert",5,[309],[404],"7.16.6",[95],{"id":407,"slug":408,"identity":409,"label":410,"aiRelevant":47,"provider":307,"advisoryCount":411,"licenseExpressions":412,"versions":413,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":415},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[309,310],[414],"3.1.6",[95],{"id":417,"slug":418,"identity":419,"label":420,"aiRelevant":47,"provider":307,"advisoryCount":421,"licenseExpressions":422,"versions":423,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":425},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[332],[424],"2.32.5",[95],{"id":427,"slug":428,"identity":429,"label":430,"aiRelevant":47,"provider":307,"advisoryCount":313,"licenseExpressions":431,"versions":432,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":434},"package:pypi:bleach","bleach-b1747264","pypi:bleach","bleach",[332,310],[433],"6.2.0",[95],{"id":436,"slug":437,"identity":438,"label":439,"aiRelevant":47,"provider":307,"advisoryCount":313,"licenseExpressions":440,"versions":442,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":444},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[441],"MPL-2.0",[443],"2025.8.3",[95],{"id":446,"slug":447,"identity":448,"label":449,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":450,"versions":451,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":453},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[342],[452],"4.59.2",[95],{"id":455,"slug":456,"identity":457,"label":458,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":459,"versions":460,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":462},"package:pypi:geopandas","geopandas-968b51b0","pypi:geopandas","geopandas",[309],[461],"1.1.3",[95],{"id":464,"slug":465,"identity":466,"label":467,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":468,"versions":469,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":471},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[309,310],[470],"3.10",[95],{"id":473,"slug":474,"identity":475,"label":476,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":477,"versions":478,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":480},"package:pypi:jupyter-core","jupyter-core-44178c79","pypi:jupyter-core","jupyter-core",[309],[479],"5.8.1",[95],{"id":482,"slug":483,"identity":484,"label":485,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":486,"versions":487,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":489},"package:pypi:lxml","lxml-53ddfa54","pypi:lxml","lxml",[309],[488],"6.1.3",[95],{"id":491,"slug":492,"identity":493,"label":494,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":495,"versions":497,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":499},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[496],"BSD-2-Clause",[498],"2.19.2",[95],{"id":501,"slug":502,"identity":503,"label":504,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":505,"versions":506,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":508},"package:pypi:pytest","pytest-07c6f86c","pypi:pytest","pytest",[342],[507],"8.4.2",[95],{"id":510,"slug":511,"identity":512,"label":513,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":514,"versions":515,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":517},"package:pypi:python-dotenv","python-dotenv-27b12285","pypi:python-dotenv","python-dotenv",[309],[516],"1.1.1",[95],{"id":519,"slug":520,"identity":521,"label":522,"aiRelevant":47,"provider":307,"advisoryCount":32,"licenseExpressions":523,"versions":525,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":527},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[524],"MIT AND MPL-2.0",[526],"4.67.1",[95],{"id":529,"slug":530,"identity":531,"label":532,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":533,"versions":534,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":536},"package:pypi:arrow","arrow-d0e153a5","pypi:arrow","arrow",[310],[535],"1.4.0",[95],{"id":538,"slug":539,"identity":540,"label":541,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":542,"versions":543,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":545},"package:pypi:asttokens","asttokens-c349c5f9","pypi:asttokens","asttokens",[332],[544],"3.0.0",[95],{"id":547,"slug":548,"identity":549,"label":550,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":551,"versions":552,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":554},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[342],[553],"25.3.0",[95],{"id":556,"slug":557,"identity":558,"label":559,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":560,"versions":561,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":563},"package:pypi:backcall","backcall-641b907e","pypi:backcall","backcall",[310],[562],"0.2.0",[95],{"id":565,"slug":566,"identity":567,"label":568,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":569,"versions":570,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":572},"package:pypi:beautifulsoup4","beautifulsoup4-eddf0c04","pypi:beautifulsoup4","beautifulsoup4",[342],[571],"4.13.5",[95],{"id":574,"slug":575,"identity":576,"label":577,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":578,"versions":579,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":581},"package:pypi:boolean-py","boolean-py-d2700117","pypi:boolean-py","boolean-py",[496],[580],"5.0",[95],{"id":583,"slug":584,"identity":585,"label":586,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":587,"versions":588,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":590},"package:pypi:cfgv","cfgv-4583061f","pypi:cfgv","cfgv",[342],[589],"3.4.0",[95],{"id":592,"slug":593,"identity":594,"label":595,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":596,"versions":599,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":601},"package:pypi:chardet","chardet-69451fbd","pypi:chardet","chardet",[597,598],"0BSD","LGPL-2.1",[600],"7.6.0",[95],{"id":603,"slug":604,"identity":605,"label":606,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":607,"versions":608,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":610},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[342],[609],"3.4.3",[95],{"id":612,"slug":613,"identity":614,"label":615,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":616,"versions":617,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":619},"package:pypi:cloudpickle","cloudpickle-12e9c0d7","pypi:cloudpickle","cloudpickle",[309],[618],"3.1.1",[95],{"id":621,"slug":622,"identity":623,"label":624,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":625,"versions":626,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":628},"package:pypi:colour","colour-22bcf9f9","pypi:colour","colour",[309],[627],"0.1.5",[95],{"id":630,"slug":631,"identity":632,"label":633,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":634,"versions":635,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":637},"package:pypi:comm","comm-0720ed7b","pypi:comm","comm",[309],[636],"0.2.3",[95],{"id":639,"slug":640,"identity":641,"label":642,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":643,"versions":644,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":646},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[309],[645],"1.3.3",[95],{"id":648,"slug":649,"identity":650,"label":651,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":652,"versions":653,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":655},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[309],[654],"0.12.1",[95],{"id":657,"slug":658,"identity":659,"label":660,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":661,"versions":662,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":664},"package:pypi:cyclonedx-python-lib","cyclonedx-python-lib-af6d232b","pypi:cyclonedx-python-lib","cyclonedx-python-lib",[332],[663],"11.12.0",[95],{"id":666,"slug":667,"identity":668,"label":669,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":670,"versions":671,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":673},"package:pypi:debugpy","debugpy-71725cbb","pypi:debugpy","debugpy",[342],[672],"1.8.16",[95],{"id":675,"slug":676,"identity":677,"label":678,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":679,"versions":680,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":682},"package:pypi:decorator","decorator-500c1fb8","pypi:decorator","decorator",[496,310],[681],"5.2.1",[95],{"id":684,"slug":685,"identity":686,"label":687,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":688,"versions":689,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":691},"package:pypi:defusedxml","defusedxml-fab5db42","pypi:defusedxml","defusedxml",[310],[690],"0.7.1",[95],{"id":693,"slug":694,"identity":695,"label":696,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":697,"versions":699,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":701},"package:pypi:distlib","distlib-d66be865","pypi:distlib","distlib",[698],"PSF-2.0",[700],"0.4.0",[95],{"id":703,"slug":704,"identity":705,"label":706,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":707,"versions":708,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":710},"package:pypi:docopt","docopt-a034efe2","pypi:docopt","docopt",[342],[709],"0.6.2",[95],{"id":712,"slug":713,"identity":714,"label":715,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":716,"versions":717,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":719},"package:pypi:dtreeviz","dtreeviz-cf6aef0c","pypi:dtreeviz","dtreeviz",[342],[718],"2.2.2",[95],{"id":721,"slug":722,"identity":723,"label":724,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":725,"versions":726,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":728},"package:pypi:et-xmlfile","et-xmlfile-634469c0","pypi:et-xmlfile","et-xmlfile",[342],[727],"2.0.0",[95],{"id":730,"slug":731,"identity":732,"label":733,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":734,"versions":735,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":737},"package:pypi:executing","executing-36845a5b","pypi:executing","executing",[342],[736],"2.2.1",[95],{"id":739,"slug":740,"identity":741,"label":742,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":743,"versions":744,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":746},"package:pypi:fastjsonschema","fastjsonschema-8288c29a","pypi:fastjsonschema","fastjsonschema",[309,310],[745],"2.21.2",[95],{"id":748,"slug":749,"identity":750,"label":751,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":752,"versions":753,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":755},"package:pypi:fqdn","fqdn-2616214a","pypi:fqdn","fqdn",[441],[754],"1.6.0",[95],{"id":757,"slug":758,"identity":759,"label":760,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":761,"versions":762,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":764},"package:pypi:graphviz","graphviz-e85b83de","pypi:graphviz","graphviz",[342],[763],"0.21",[95],{"id":766,"slug":767,"identity":768,"label":769,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":770,"versions":773,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":775},"package:pypi:greenlet","greenlet-cd6f7934","pypi:greenlet","greenlet",[342,771,772],"MIT AND PSF-2.0","MIT AND Python-2.0",[774],"3.2.4",[95],{"id":777,"slug":778,"identity":779,"label":780,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":781,"versions":782,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":784},"package:pypi:identify","identify-bd45ae56","pypi:identify","identify",[342],[783],"2.6.12",[95],{"id":786,"slug":787,"identity":788,"label":789,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":790,"versions":791,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":793},"package:pypi:iniconfig","iniconfig-1f66e358","pypi:iniconfig","iniconfig",[342],[792],"2.1.0",[95],{"id":795,"slug":796,"identity":797,"label":798,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":799,"versions":800,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":802},"package:pypi:ipykernel","ipykernel-37162218","pypi:ipykernel","ipykernel",[309],[801],"6.30.1",[95],{"id":804,"slug":805,"identity":806,"label":807,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":808,"versions":809,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":811},"package:pypi:ipython","ipython-7a140323","pypi:ipython","ipython",[309],[810],"8.12.3",[95],{"id":813,"slug":814,"identity":815,"label":816,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":817,"versions":818,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":819},"package:pypi:ipython-pygments-lexers","ipython-pygments-lexers-6216051e","pypi:ipython-pygments-lexers","ipython-pygments-lexers",[310],[516],[95],{"id":821,"slug":822,"identity":823,"label":824,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":825,"versions":826,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":828},"package:pypi:ipywidgets","ipywidgets-5079daea","pypi:ipywidgets","ipywidgets",[309],[827],"8.1.8",[95],{"id":830,"slug":831,"identity":832,"label":833,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":834,"versions":836,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":838},"package:pypi:isoduration","isoduration-e8f86ac8","pypi:isoduration","isoduration",[835],"ISC",[837],"20.11.0",[95],{"id":840,"slug":841,"identity":842,"label":843,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":844,"versions":845,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":847},"package:pypi:jedi","jedi-9eb0c211","pypi:jedi","jedi",[342],[846],"0.19.2",[95],{"id":849,"slug":850,"identity":851,"label":852,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":853,"versions":854,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":856},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[309],[855],"1.5.2",[95],{"id":858,"slug":859,"identity":860,"label":861,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":862,"versions":863,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":864},"package:pypi:jsonpointer","jsonpointer-a61b5f8f","pypi:jsonpointer","jsonpointer",[309,310],[618],[95],{"id":866,"slug":867,"identity":868,"label":869,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":870,"versions":871,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":873},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[342],[872],"4.25.1",[95],{"id":875,"slug":876,"identity":877,"label":878,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":879,"versions":880,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":882},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[342],[881],"2025.9.1",[95],{"id":884,"slug":885,"identity":886,"label":887,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":888,"versions":889,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":891},"package:pypi:jupyter-client","jupyter-client-3b4db88c","pypi:jupyter-client","jupyter-client",[309],[890],"8.6.3",[95],{"id":893,"slug":894,"identity":895,"label":896,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":897,"versions":898,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":900},"package:pypi:jupyterlab-pygments","jupyterlab-pygments-f3159f9e","pypi:jupyterlab-pygments","jupyterlab-pygments",[309],[899],"0.3.0",[95],{"id":902,"slug":903,"identity":904,"label":905,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":906,"versions":908,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":910},"package:pypi:jupyterlab-widgets","jupyterlab-widgets-e76ed5e8","pypi:jupyterlab-widgets","jupyterlab-widgets",[309,907,835,342],"CC0-1.0",[909],"3.0.16",[95],{"id":912,"slug":913,"identity":914,"label":915,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":916,"versions":917,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":919},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[310],[918],"1.4.9",[95],{"id":921,"slug":922,"identity":923,"label":924,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":925,"versions":926,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":928},"package:pypi:lark","lark-56b23f4f","pypi:lark","lark",[342],[927],"1.3.1",[95],{"id":930,"slug":931,"identity":932,"label":933,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":934,"versions":935,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":937},"package:pypi:license-expression","license-expression-66cbb677","pypi:license-expression","license-expression",[332],[936],"30.4.4",[95],{"id":939,"slug":940,"identity":941,"label":942,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":943,"versions":945,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":947},"package:pypi:llvmlite","llvmlite-7b5a17d5","pypi:llvmlite","llvmlite",[332,496,944,310],"BSD-2-Clause AND Apache-2.0 WITH LLVM-exception",[946],"0.45.1",[95],{"id":949,"slug":950,"identity":951,"label":952,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":953,"versions":954,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":956},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[309],[955],"3.0.2",[95],{"id":958,"slug":959,"identity":960,"label":961,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":962,"versions":963,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":965},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[310],[964],"3.10.6",[95],{"id":967,"slug":968,"identity":969,"label":970,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":971,"versions":972,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":974},"package:pypi:matplotlib-inline","matplotlib-inline-50f95e0d","pypi:matplotlib-inline","matplotlib-inline",[309],[973],"0.1.7",[95],{"id":976,"slug":977,"identity":978,"label":979,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":980,"versions":981,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":983},"package:pypi:matplotlib-venn","matplotlib-venn-92ce9398","pypi:matplotlib-venn","matplotlib-venn",[342],[982],"1.1.2",[95],{"id":985,"slug":986,"identity":987,"label":988,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":989,"versions":990,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":992},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[342],[991],"2.16.0",[95],{"id":994,"slug":995,"identity":996,"label":997,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":998,"versions":999,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1001},"package:pypi:nbclient","nbclient-e201d8f1","pypi:nbclient","nbclient",[309],[1000],"0.10.2",[95],{"id":1003,"slug":1004,"identity":1005,"label":1006,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1007,"versions":1008,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1010},"package:pypi:nbformat","nbformat-2d86904f","pypi:nbformat","nbformat",[309],[1009],"5.10.4",[95],{"id":1012,"slug":1013,"identity":1014,"label":1015,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1016,"versions":1017,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1018},"package:pypi:nest-asyncio","nest-asyncio-f76531b1","pypi:nest-asyncio","nest-asyncio",[496],[754],[95],{"id":1020,"slug":1021,"identity":1022,"label":1023,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1024,"versions":1025,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1027},"package:pypi:nodeenv","nodeenv-71203cea","pypi:nodeenv","nodeenv",[309,310],[1026],"1.9.1",[95],{"id":1029,"slug":1030,"identity":1031,"label":1032,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1033,"versions":1034,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1036},"package:pypi:numba","numba-4cc2d278","pypi:numba","numba",[310],[1035],"0.62.1",[95],{"id":1038,"slug":1039,"identity":1040,"label":1041,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1042,"versions":1044,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1046},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[1043,310],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[1045],"2.1.3",[95],{"id":1048,"slug":1049,"identity":1050,"label":1051,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1052,"versions":1053,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1055},"package:pypi:openpyxl","openpyxl-2c369bc4","pypi:openpyxl","openpyxl",[342],[1054],"3.1.5",[95],{"id":1057,"slug":1058,"identity":1059,"label":1060,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1061,"versions":1062,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1064},"package:pypi:packageurl-python","packageurl-python-dc3afccd","pypi:packageurl-python","packageurl-python",[342],[1063],"0.17.6",[95],{"id":1066,"slug":1067,"identity":1068,"label":1069,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1070,"versions":1072,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1074},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[1071,310],"Apache-2.0 OR BSD-2-Clause",[1073],"25.0",[95],{"id":1076,"slug":1077,"identity":1078,"label":1079,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1080,"versions":1081,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1083},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[309,310],[1082],"2.2.3",[95],{"id":1085,"slug":1086,"identity":1087,"label":1088,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1089,"versions":1090,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1092},"package:pypi:pandocfilters","pandocfilters-f452098e","pypi:pandocfilters","pandocfilters",[309],[1091],"1.5.1",[95],{"id":1094,"slug":1095,"identity":1096,"label":1097,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1098,"versions":1099,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1101},"package:pypi:parso","parso-fa59fdde","pypi:parso","parso",[342],[1100],"0.8.5",[95],{"id":1103,"slug":1104,"identity":1105,"label":1106,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1107,"versions":1108,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1110},"package:pypi:patsy","patsy-d46c513b","pypi:patsy","patsy",[310],[1109],"1.0.2",[95],{"id":1112,"slug":1113,"identity":1114,"label":1115,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1116,"versions":1117,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1119},"package:pypi:pexpect","pexpect-9ad65a0c","pypi:pexpect","pexpect",[835],[1118],"4.9.0",[95],{"id":1121,"slug":1122,"identity":1123,"label":1124,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1125,"versions":1126,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1128},"package:pypi:pickleshare","pickleshare-5fcce33d","pypi:pickleshare","pickleshare",[342],[1127],"0.7.5",[95],{"id":1130,"slug":1131,"identity":1132,"label":1133,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1134,"versions":1135,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1137},"package:pypi:pip-requirements-parser","pip-requirements-parser-3a4c3c44","pypi:pip-requirements-parser","pip-requirements-parser",[342],[1136],"32.0.1",[95],{"id":1139,"slug":1140,"identity":1141,"label":1142,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1143,"versions":1144,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1146},"package:pypi:pipfreeze","pipfreeze-c02d60ee","pypi:pipfreeze","pipfreeze",[342],[1145],"2.0.3",[95],{"id":1148,"slug":1149,"identity":1150,"label":1151,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1152,"versions":1153,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1155},"package:pypi:pipreqs","pipreqs-44f88249","pypi:pipreqs","pipreqs",[332],[1154],"0.5.0",[95],{"id":1157,"slug":1158,"identity":1159,"label":1160,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1161,"versions":1162,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1164},"package:pypi:platformdirs","platformdirs-e64002f0","pypi:platformdirs","platformdirs",[342],[1163],"4.3.8",[95],{"id":1166,"slug":1167,"identity":1168,"label":1169,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1170,"versions":1171,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1172},"package:pypi:plotly","plotly-036ddabb","pypi:plotly","plotly",[342],[334],[95],{"id":1174,"slug":1175,"identity":1176,"label":1177,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1178,"versions":1179,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1180},"package:pypi:pluggy","pluggy-24479aaf","pypi:pluggy","pluggy",[342],[754],[95],{"id":1182,"slug":1183,"identity":1184,"label":1185,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1186,"versions":1187,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1189},"package:pypi:pre-commit","pre-commit-6a196b54","pypi:pre-commit","pre-commit",[342],[1188],"4.2.0",[95],{"id":1191,"slug":1192,"identity":1193,"label":1194,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1195,"versions":1196,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1198},"package:pypi:prompt-toolkit","prompt-toolkit-e6f4118a","pypi:prompt-toolkit","prompt-toolkit",[309,310],[1197],"3.0.52",[95],{"id":1200,"slug":1201,"identity":1202,"label":1203,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1204,"versions":1205,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1207},"package:pypi:psutil","psutil-840b9a74","pypi:psutil","psutil",[309],[1206],"7.0.0",[95],{"id":1209,"slug":1210,"identity":1211,"label":1212,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1213,"versions":1214,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1216},"package:pypi:psycopg2-binary","psycopg2-binary-128ab534","pypi:psycopg2-binary","psycopg2-binary",[310],[1215],"2.9.10",[95],{"id":1218,"slug":1219,"identity":1220,"label":1221,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1222,"versions":1223,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1225},"package:pypi:ptyprocess","ptyprocess-ec2650c7","pypi:ptyprocess","ptyprocess",[835],[1224],"0.7.0",[95],{"id":1227,"slug":1228,"identity":1229,"label":1230,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1231,"versions":1232,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1233},"package:pypi:pure-eval","pure-eval-24d2bc1c","pypi:pure-eval","pure-eval",[342],[636],[95],{"id":1235,"slug":1236,"identity":1237,"label":1238,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1239,"versions":1240,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1241},"package:pypi:py-serializable","py-serializable-cebfca90","pypi:py-serializable","py-serializable",[332],[792],[95],{"id":1243,"slug":1244,"identity":1245,"label":1246,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1247,"versions":1248,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1249},"package:pypi:pyogrio","pyogrio-ff34272a","pypi:pyogrio","pyogrio",[342],[654],[95],{"id":1251,"slug":1252,"identity":1253,"label":1254,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1255,"versions":1256,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1258},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[342],[1257],"3.2.3",[95],{"id":1260,"slug":1261,"identity":1262,"label":1263,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1264,"versions":1265,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1267},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[342],[1266],"3.7.2",[95],{"id":1269,"slug":1270,"identity":1271,"label":1272,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1273,"versions":1274,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1276},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[310],[1275],"2.9.0.post0",[95],{"id":1278,"slug":1279,"identity":1280,"label":1281,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1282,"versions":1283,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1285},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[342],[1284],"2025.2",[95],{"id":1287,"slug":1288,"identity":1289,"label":1290,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1291,"versions":1292,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1294},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[342],[1293],"6.0.2",[95],{"id":1296,"slug":1297,"identity":1298,"label":1299,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1300,"versions":1301,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1303},"package:pypi:pyzmq","pyzmq-30b92392","pypi:pyzmq","pyzmq",[309],[1302],"27.1.0",[95],{"id":1305,"slug":1306,"identity":1307,"label":1308,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1309,"versions":1310,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1312},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[342],[1311],"0.36.2",[95],{"id":1314,"slug":1315,"identity":1316,"label":1317,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1318,"versions":1319,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1321},"package:pypi:rfc3339-validator","rfc3339-validator-433f6951","pypi:rfc3339-validator","rfc3339-validator",[342],[1320],"0.1.4",[95],{"id":1323,"slug":1324,"identity":1325,"label":1326,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1327,"versions":1328,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1330},"package:pypi:rfc3986-validator","rfc3986-validator-723c00af","pypi:rfc3986-validator","rfc3986-validator",[342],[1329],"0.1.1",[95],{"id":1332,"slug":1333,"identity":1334,"label":1335,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1336,"versions":1337,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1339},"package:pypi:rfc3987-syntax","rfc3987-syntax-1f7c3c6b","pypi:rfc3987-syntax","rfc3987-syntax",[342],[1338],"1.1.0",[95],{"id":1341,"slug":1342,"identity":1343,"label":1344,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1345,"versions":1346,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1348},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[342],[1347],"0.27.1",[95],{"id":1350,"slug":1351,"identity":1352,"label":1353,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1354,"versions":1355,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1357},"package:pypi:ruff","ruff-d5943bdf","pypi:ruff","ruff",[342],[1356],"0.12.12",[95],{"id":1359,"slug":1360,"identity":1361,"label":1362,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1363,"versions":1364,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1366},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[310],[1365],"1.16.2",[95],{"id":1368,"slug":1369,"identity":1370,"label":1371,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1372,"versions":1373,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1375},"package:pypi:seaborn","seaborn-1018de9a","pypi:seaborn","seaborn",[310],[1374],"0.13.2",[95],{"id":1377,"slug":1378,"identity":1379,"label":1380,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1381,"versions":1382,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1384},"package:pypi:shap","shap-e70c5c55","pypi:shap","shap",[342],[1383],"0.49.1",[95],{"id":1386,"slug":1387,"identity":1388,"label":1389,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1390,"versions":1391,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1393},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[309],[1392],"2.1.2",[95],{"id":1395,"slug":1396,"identity":1397,"label":1398,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1399,"versions":1400,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1402},"package:pypi:six","six-3c3888bd","pypi:six","six",[342],[1401],"1.17.0",[95],{"id":1404,"slug":1405,"identity":1406,"label":1407,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1408,"versions":1409,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1411},"package:pypi:slicer","slicer-e58694d1","pypi:slicer","slicer",[342],[1410],"0.0.8",[95],{"id":1413,"slug":1414,"identity":1415,"label":1416,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1417,"versions":1418,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1420},"package:pypi:sortedcontainers","sortedcontainers-9601b229","pypi:sortedcontainers","sortedcontainers",[332],[1419],"2.4.0",[95],{"id":1422,"slug":1423,"identity":1424,"label":1425,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1426,"versions":1427,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1429},"package:pypi:sqlalchemy","sqlalchemy-5de7c53b","pypi:sqlalchemy","sqlalchemy",[342],[1428],"2.0.43",[95],{"id":1431,"slug":1432,"identity":1433,"label":1434,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1435,"versions":1436,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1438},"package:pypi:stack-data","stack-data-d640fe0e","pypi:stack-data","stack-data",[342],[1437],"0.6.3",[95],{"id":1440,"slug":1441,"identity":1442,"label":1443,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1444,"versions":1445,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1447},"package:pypi:statsmodels","statsmodels-e1c76ae8","pypi:statsmodels","statsmodels",[310],[1446],"0.14.6",[95],{"id":1449,"slug":1450,"identity":1451,"label":1452,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1453,"versions":1454,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1456},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[309],[1455],"3.6.0",[95],{"id":1458,"slug":1459,"identity":1460,"label":1461,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1462,"versions":1463,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1464},"package:pypi:tinycss2","tinycss2-301fccf6","pypi:tinycss2","tinycss2",[310],[535],[95],{"id":1466,"slug":1467,"identity":1468,"label":1469,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1470,"versions":1471,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1473},"package:pypi:traitlets","traitlets-52bd6ddb","pypi:traitlets","traitlets",[309],[1472],"5.14.3",[95],{"id":73,"slug":74,"identity":1475,"label":75,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1476,"versions":1477,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1479},"pypi:typing-extensions",[698,310],[1478],"4.15.0",[95],{"id":1481,"slug":1482,"identity":1483,"label":1484,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1485,"versions":1486,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1487},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[332],[1284],[95],{"id":1489,"slug":1490,"identity":1491,"label":1492,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1493,"versions":1494,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1496},"package:pypi:uri-template","uri-template-04c43560","pypi:uri-template","uri-template",[342],[1495],"1.3.0",[95],{"id":1498,"slug":1499,"identity":1500,"label":1501,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1502,"versions":1503,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1505},"package:pypi:wcwidth","wcwidth-038a8957","pypi:wcwidth","wcwidth",[342],[1504],"0.2.13",[95],{"id":1507,"slug":1508,"identity":1509,"label":1510,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1511,"versions":1512,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1514},"package:pypi:webcolors","webcolors-380e4f6b","pypi:webcolors","webcolors",[309],[1513],"25.10.0",[95],{"id":1516,"slug":1517,"identity":1518,"label":1519,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1520,"versions":1521,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1523},"package:pypi:webencodings","webencodings-04815c4d","pypi:webencodings","webencodings",[310],[1522],"0.5.1",[95],{"id":1525,"slug":1526,"identity":1527,"label":1528,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1529,"versions":1530,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1532},"package:pypi:widgetsnbextension","widgetsnbextension-8ee19027","pypi:widgetsnbextension","widgetsnbextension",[309],[1531],"4.0.15",[95],{"id":1534,"slug":1535,"identity":1536,"label":1537,"aiRelevant":47,"provider":307,"advisoryCount":39,"licenseExpressions":1538,"versions":1539,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1541},"package:pypi:yarg","yarg-5de2410d","pypi:yarg","yarg",[342],[1540],"0.1.9",[95],[1543,1582,1618,1642,1664,1688,1717,1743,1778,1800,1827,1853,1884,1915,1942,1965,1989,2016,2042,2064,2090,2114,2137,2160,2185,2209,2233,2262,2296,2337,2360,2387,2412,2438,2462,2489,2512,2535,2560,2583,2604,2635,2665,2702,2730,2758,2779,2802,2828,2864,2890,2916,2939,2976,2997,3029,3059,3083,3108,3130,3150,3173,3194,3217,3249,3272,3294,3314,3338,3361,3380,3399,3421,3444,3473,3491,3520,3558,3584,3611,3631,3661,3683,3705,3728,3749,3772,3797,3852,3877,3900,3932,3955,3975,3996,4020,4041,4065,4085,4108,4136,4159,4184,4208,4241,4266,4290,4317,4338,4362,4378,4403,4426,4455,4488,4508,4531,4552,4574,4598,4619,4641,4668,4694,4723,4744,4774,4795,4820,4845,4888,4911,4932,4960,4983,5006,5030,5057,5081,5104,5128,5152,5168,5195,5221,5248,5269,5288,5316,5338,5364,5392,5416,5447,5469,5491,5519,5541,5563,5584,5603,5627,5656,5683,5701,5723,5747,5777,5799,5851,5903,5926,5945,5969,5996,6017,6044,6067,6092,6125,6155,6170],{"id":108,"slug":1544,"dossier":91,"summary":1545,"aliases":1546,"sourceIds":1549,"published":1550,"modified":1551,"checkedAt":7,"severity":1552,"references":1556,"versionKeys":1570,"packageCount":32,"repositoryCount":1581},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[1547,1548],"BIT-pillow-2026-112390","CVE-2026-112390",[108],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[1553],{"type":1554,"score":1555},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1557,1560,1563,1565,1568],{"type":1558,"url":1559},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1561,"url":1562},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1558,"url":1564},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1566,"url":1567},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1558,"url":1569},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",19,{"id":109,"slug":1583,"dossier":47,"summary":1584,"aliases":1585,"sourceIds":1588,"published":1589,"modified":1590,"checkedAt":7,"severity":1591,"references":1595,"versionKeys":1616,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1586,1587],"CVE-2024-39689","PYSEC-2024-230",[109,1587],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1592],{"type":1593,"score":1594},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1596,1598,1600,1603,1605,1607,1610,1612,1614],{"type":1561,"url":1597},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1561,"url":1599},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1601,"url":1602},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1566,"url":1604},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1558,"url":1606},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1608,"url":1609},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1558,"url":1611},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1561,"url":1613},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1561,"url":1615},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1617],"pypi:certifi@2024.6.2",{"id":110,"slug":1619,"dossier":91,"summary":1620,"aliases":1621,"sourceIds":1624,"published":1625,"modified":1626,"checkedAt":7,"severity":1627,"references":1630,"versionKeys":1641,"packageCount":32,"repositoryCount":1581},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1622,1623],"BIT-pillow-2026-96638","CVE-2026-96638",[110],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1628],{"type":1593,"score":1629},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1631,1633,1635,1637,1639,1640],{"type":1558,"url":1632},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1561,"url":1634},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1558,"url":1636},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1558,"url":1638},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":111,"slug":1643,"dossier":91,"summary":1644,"aliases":1645,"sourceIds":1648,"published":1649,"modified":1650,"checkedAt":7,"severity":1651,"references":1654,"versionKeys":1663,"packageCount":32,"repositoryCount":1581},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1646,1647],"BIT-pillow-2026-112391","CVE-2026-112391",[111],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1652],{"type":1554,"score":1653},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1655,1657,1659,1661,1662],{"type":1558,"url":1656},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1561,"url":1658},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1558,"url":1660},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":112,"slug":1665,"dossier":91,"summary":1666,"aliases":1667,"sourceIds":1671,"published":1672,"modified":1673,"checkedAt":7,"severity":1674,"references":1678,"versionKeys":1687,"packageCount":32,"repositoryCount":1581},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1668,1669,1670],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[112,1670],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1675,1676],{"type":1554,"score":1555},{"type":1593,"score":1677},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1679,1681,1683,1685,1686],{"type":1601,"url":1680},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1561,"url":1682},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1601,"url":1684},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":113,"slug":1689,"dossier":47,"summary":1690,"aliases":1691,"sourceIds":1694,"published":1695,"modified":1696,"checkedAt":7,"severity":1697,"references":1700,"versionKeys":1714,"packageCount":32,"repositoryCount":313},"ghsa-2hm2-hc3v-44h9-93b1e859","Mistune toc \u002F TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with attacker-controlled `id=\"toc_N\"` content",[1692,1693],"CVE-2026-59930","PYSEC-2026-2218",[113,1693],"2026-07-08T17:17:28.867Z","2026-07-20T21:46:43.352385519Z",[1698],{"type":1593,"score":1699},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[1701,1704,1706,1708,1710,1712],{"type":1702,"url":1703},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-2hm2-hc3v-44h9",{"type":1561,"url":1705},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59930",{"type":1601,"url":1707},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002Fc4093c4742ed0d10d9332fb8edb455869b7b581b",{"type":1566,"url":1709},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune",{"type":1561,"url":1711},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Freleases\u002Ftag\u002Fv3.3.0",{"type":1558,"url":1713},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2218.yaml",[1715,1716],"pypi:mistune@3.1.3","pypi:mistune@3.1.4",{"id":114,"slug":1718,"dossier":47,"summary":1719,"aliases":1720,"sourceIds":1723,"published":1724,"modified":1725,"checkedAt":7,"severity":1726,"references":1728,"versionKeys":1739,"packageCount":32,"repositoryCount":34},"ghsa-2wc2-fm75-p42x-9941d681","Soup Sieve has Memory Exhaustion via Large Comma-Separated Selector Lists",[1721,1722],"CVE-2026-49476","PYSEC-2026-3071",[114,1722],"2026-07-09T13:37:40Z","2026-09-10T03:50:51.299551127Z",[1727],{"type":1593,"score":1677},[1729,1731,1733,1735,1737],{"type":1558,"url":1730},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-2wc2-fm75-p42x",{"type":1566,"url":1732},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve",{"type":1566,"url":1734},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsoupsieve",{"type":1561,"url":1736},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2wc2-fm75-p42x",{"type":1561,"url":1738},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49476",[1740,1741,1742],"pypi:soupsieve@2.6","pypi:soupsieve@2.7","pypi:soupsieve@2.8",{"id":115,"slug":1744,"dossier":47,"summary":1745,"aliases":1746,"sourceIds":1749,"published":1750,"modified":1751,"checkedAt":7,"severity":1752,"references":1755,"versionKeys":1772,"packageCount":32,"repositoryCount":351},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1747,1748],"CVE-2025-66471","PYSEC-2026-1994",[115,1748],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1753],{"type":1554,"score":1754},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1756,1758,1760,1762,1764,1766,1768,1770],{"type":1558,"url":1757},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1561,"url":1759},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1601,"url":1761},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1558,"url":1763},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1561,"url":1765},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1558,"url":1767},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1566,"url":1769},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1566,"url":1771},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1773,1774,1775,1776,1777],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",{"id":116,"slug":1779,"dossier":91,"summary":1780,"aliases":1781,"sourceIds":1784,"published":1785,"modified":1786,"checkedAt":7,"severity":1787,"references":1790,"versionKeys":1799,"packageCount":32,"repositoryCount":1581},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1782,1783],"BIT-pillow-2026-112393","CVE-2026-112393",[116],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1788],{"type":1554,"score":1789},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1791,1793,1795,1797,1798],{"type":1558,"url":1792},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1561,"url":1794},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1558,"url":1796},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":117,"slug":1801,"dossier":47,"summary":1802,"aliases":1803,"sourceIds":1806,"published":1807,"modified":1808,"checkedAt":7,"severity":1809,"references":1812,"versionKeys":1825,"packageCount":32,"repositoryCount":313},"ghsa-33p9-3p43-82vq-f6a57ddd","Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability",[1804,1805],"CVE-2025-30167","PYSEC-2026-1477",[117,1805],"2025-06-04T21:00:23Z","2026-09-10T03:50:24.754946270Z",[1810],{"type":1593,"score":1811},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1813,1815,1817,1819,1821,1823],{"type":1558,"url":1814},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fjupyter_core\u002Fsecurity\u002Fadvisories\u002FGHSA-33p9-3p43-82vq",{"type":1561,"url":1816},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-30167",{"type":1558,"url":1818},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fjupyter_core\u002Fcommit\u002F5e8965600adda6b416692ce7e85ecb2bd814bd52",{"type":1566,"url":1820},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fjupyter_core",{"type":1566,"url":1822},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjupyter-core",{"type":1561,"url":1824},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-33p9-3p43-82vq",[1826],"pypi:jupyter-core@5.7.2",{"id":118,"slug":1828,"dossier":47,"summary":1829,"aliases":1830,"sourceIds":1833,"published":1834,"modified":1835,"checkedAt":7,"severity":1836,"references":1839,"versionKeys":1852,"packageCount":32,"repositoryCount":351},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1831,1832],"CVE-2026-21441","PYSEC-2026-1996",[118,1832],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1837,1838],{"type":1593,"score":1677},{"type":1554,"score":1754},[1840,1842,1844,1846,1847,1849,1850],{"type":1558,"url":1841},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1561,"url":1843},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1601,"url":1845},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1566,"url":1769},{"type":1558,"url":1848},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1566,"url":1771},{"type":1561,"url":1851},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1773,1774,1775,1776,1777],{"id":119,"slug":1854,"dossier":47,"summary":1855,"aliases":1856,"sourceIds":1859,"published":1860,"modified":1861,"checkedAt":7,"severity":1862,"references":1865,"versionKeys":1878,"packageCount":32,"repositoryCount":381},"ghsa-394h-qwmc-48pf-2e9bb5ce","virtualenv: Xonsh activation literals depend on the script decoding codec",[1857,1858],"BIT-virtualenv-2026-113718","CVE-2026-113718",[119],"2026-10-23T22:24:43Z","2026-10-29T10:55:57.228294866Z",[1863],{"type":1554,"score":1864},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1866,1868,1870,1872,1874,1876],{"type":1558,"url":1867},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-394h-qwmc-48pf",{"type":1561,"url":1869},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113718",{"type":1558,"url":1871},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3432",{"type":1558,"url":1873},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fe5fc2e6e189a877ff559af288919e3525d13e5e0",{"type":1566,"url":1875},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv",{"type":1558,"url":1877},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.14.9",[1879,1880,1881,1882,1883],"pypi:virtualenv@20.30.0","pypi:virtualenv@20.31.1","pypi:virtualenv@20.32.0","pypi:virtualenv@20.34.0","pypi:virtualenv@20.35.4",{"id":120,"slug":1885,"dossier":47,"summary":1886,"aliases":1887,"sourceIds":1889,"published":1890,"modified":1891,"checkedAt":7,"severity":1892,"references":1895,"versionKeys":1908,"packageCount":32,"repositoryCount":66},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[1888],"CVE-2026-103261",[120],"2026-09-30T23:49:25Z","2026-10-02T03:56:09.601689224Z",[1893],{"type":1593,"score":1894},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1896,1898,1900,1902,1904,1906],{"type":1558,"url":1897},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1558,"url":1899},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1558,"url":1901},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1558,"url":1903},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1566,"url":1905},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1558,"url":1907},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1909,1910,1911,1912,1913,1914],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7",{"id":121,"slug":1916,"dossier":91,"summary":1917,"aliases":1918,"sourceIds":1922,"published":1923,"modified":1924,"checkedAt":7,"severity":1925,"references":1929,"versionKeys":1941,"packageCount":32,"repositoryCount":1581},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1919,1920,1921],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[121,1921],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1926,1928],{"type":1554,"score":1927},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":1629},[1930,1932,1934,1937,1939,1940],{"type":1561,"url":1931},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1561,"url":1933},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1935,"url":1936},"REPORT","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1601,"url":1938},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":122,"slug":1943,"dossier":47,"summary":1944,"aliases":1945,"sourceIds":1948,"published":1949,"modified":1950,"checkedAt":7,"severity":1951,"references":1954,"versionKeys":1964,"packageCount":32,"repositoryCount":371},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1946,1947],"CVE-2026-49853","PYSEC-2026-3387",[122,1947],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1952],{"type":1593,"score":1953},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1955,1957,1958,1960,1962],{"type":1558,"url":1956},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1566,"url":1905},{"type":1566,"url":1959},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1561,"url":1961},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1561,"url":1963},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1909,1910,1911,1912,1913],{"id":123,"slug":1966,"dossier":47,"summary":1967,"aliases":1968,"sourceIds":1971,"published":1972,"modified":1973,"checkedAt":7,"severity":1974,"references":1977,"versionKeys":1988,"packageCount":32,"repositoryCount":381},"ghsa-43mp-35q3-x3fq-895b1d20","virtualenv: Deletion recovery can change a symlink target's mode",[1969,1970],"BIT-virtualenv-2026-113724","CVE-2026-113724",[123],"2026-10-21T21:31:34Z","2026-10-29T10:55:47.691444554Z",[1975],{"type":1593,"score":1976},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[1978,1980,1982,1984,1986,1987],{"type":1558,"url":1979},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-43mp-35q3-x3fq",{"type":1561,"url":1981},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113724",{"type":1558,"url":1983},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3427",{"type":1558,"url":1985},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":124,"slug":1990,"dossier":91,"summary":1991,"aliases":1992,"sourceIds":1996,"published":1997,"modified":1998,"checkedAt":7,"severity":1999,"references":2004,"versionKeys":2015,"packageCount":32,"repositoryCount":1581},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[1993,1994,1995],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[124,1995],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[2000,2002],{"type":1554,"score":2001},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":2003},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[2005,2007,2009,2011,2013,2014],{"type":1702,"url":2006},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1561,"url":2008},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1558,"url":2010},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1601,"url":2012},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":125,"slug":2017,"dossier":47,"summary":2018,"aliases":2019,"sourceIds":2023,"published":2024,"modified":2025,"checkedAt":7,"severity":2026,"references":2028,"versionKeys":2040,"packageCount":32,"repositoryCount":2041},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[2020,2021,2022],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[125,2022],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[2027],{"type":1593,"score":1677},[2029,2031,2033,2035,2037,2038],{"type":1702,"url":2030},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1561,"url":2032},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1601,"url":2034},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1558,"url":2036},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1566,"url":1567},{"type":1561,"url":2039},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1571,1572,1573,1574,1575,1576,1577,1578,1579],18,{"id":126,"slug":2043,"dossier":91,"summary":2044,"aliases":2045,"sourceIds":2048,"published":2049,"modified":2050,"checkedAt":7,"severity":2051,"references":2054,"versionKeys":2063,"packageCount":32,"repositoryCount":1581},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[2046,2047],"BIT-pillow-2026-112395","CVE-2026-112395",[126],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[2052],{"type":1593,"score":2053},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[2055,2057,2059,2061,2062],{"type":1558,"url":2056},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1561,"url":2058},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1558,"url":2060},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":127,"slug":2065,"dossier":47,"summary":2066,"aliases":2067,"sourceIds":2070,"published":2071,"modified":2072,"checkedAt":7,"severity":2073,"references":2076,"versionKeys":2089,"packageCount":32,"repositoryCount":381},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[2068,2069],"CVE-2025-50182","PYSEC-2026-1997",[127,2069],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[2074],{"type":1593,"score":2075},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2077,2079,2081,2083,2084,2086,2087],{"type":1558,"url":2078},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1561,"url":2080},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1601,"url":2082},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1566,"url":1769},{"type":1558,"url":2085},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1566,"url":1771},{"type":1561,"url":2088},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1773,1774,1775,1776],{"id":128,"slug":2091,"dossier":47,"summary":2092,"aliases":2093,"sourceIds":2096,"published":2097,"modified":2098,"checkedAt":7,"severity":2099,"references":2102,"versionKeys":2113,"packageCount":32,"repositoryCount":381},"ghsa-494p-63j8-28p3-74531279","virtualenv: Downloaded wheel selection and caching precede verification",[2094,2095],"BIT-virtualenv-2026-113714","CVE-2026-113714",[128],"2026-10-23T22:25:22Z","2026-10-29T10:55:43.999222952Z",[2100],{"type":1554,"score":2101},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2103,2105,2107,2109,2111,2112],{"type":1558,"url":2104},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-494p-63j8-28p3",{"type":1561,"url":2106},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113714",{"type":1558,"url":2108},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3430",{"type":1558,"url":2110},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F7babec66e043e1cc8bc66869a063653898719d96",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":129,"slug":2115,"dossier":47,"summary":2116,"aliases":2117,"sourceIds":2120,"published":2121,"modified":2122,"checkedAt":7,"severity":2123,"references":2126,"versionKeys":2135,"packageCount":32,"repositoryCount":313},"ghsa-4c99-qj7h-p3vg-9bb362f6","nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames",[2118,2119],"CVE-2026-39377","PYSEC-2026-2229",[129,2119],"2026-04-21T01:16:05.937Z","2026-09-10T03:51:00.940697146Z",[2124],{"type":1593,"score":2125},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[2127,2129,2131,2133],{"type":1561,"url":2128},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fsecurity\u002Fadvisories\u002FGHSA-4c99-qj7h-p3vg",{"type":1561,"url":2130},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39377",{"type":1566,"url":2132},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert",{"type":1558,"url":2134},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Freleases\u002Ftag\u002Fv7.17.1",[2136],"pypi:nbconvert@7.16.6",{"id":130,"slug":2138,"dossier":47,"summary":2139,"aliases":2140,"sourceIds":2143,"published":2144,"modified":2145,"checkedAt":7,"severity":2146,"references":2148,"versionKeys":2159,"packageCount":32,"repositoryCount":313},"ghsa-4j32-57v6-6g45-cd8913d1","Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs",[2141,2142],"CVE-2026-59925","PYSEC-2026-2213",[130,2142],"2026-07-08T17:17:28.183Z","2026-07-20T21:46:43.348949802Z",[2147],{"type":1593,"score":1677},[2149,2151,2153,2155,2156,2157],{"type":1702,"url":2150},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-4j32-57v6-6g45",{"type":1561,"url":2152},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59925",{"type":1601,"url":2154},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002F5de41fb8e527004dbc363e047a3c380c9288c74f",{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":2158},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2213.yaml",[1715,1716],{"id":131,"slug":2161,"dossier":47,"summary":2162,"aliases":2163,"sourceIds":2165,"published":2166,"modified":2167,"checkedAt":7,"severity":2168,"references":2170,"versionKeys":2182,"packageCount":32,"repositoryCount":381},"ghsa-4j63-6c4x-wfg4-adb542fd","Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time",[2164],"CVE-2026-126192",[131],"2026-11-13T00:45:18Z","2026-11-13T01:00:06.040402597Z",[2169],{"type":1554,"score":1653},[2171,2173,2175,2177,2179,2180],{"type":1558,"url":2172},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-4j63-6c4x-wfg4",{"type":1561,"url":2174},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126192",{"type":1558,"url":2176},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fpull\u002F304",{"type":1558,"url":2178},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002Fffb88cca745c591224f74a8e86414a85e8f35fc0",{"type":1566,"url":1732},{"type":1558,"url":2181},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Freleases\u002Ftag\u002F2.10",[1740,1741,1742,2183,2184],"pypi:soupsieve@2.8.4","pypi:soupsieve@2.9.1",{"id":132,"slug":2186,"dossier":91,"summary":2187,"aliases":2188,"sourceIds":2192,"published":2193,"modified":2194,"checkedAt":7,"severity":2195,"references":2197,"versionKeys":2208,"packageCount":32,"repositoryCount":1581},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[2189,2190,2191],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[132,2191],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[2196],{"type":1593,"score":1629},[2198,2200,2202,2204,2206,2207],{"type":1561,"url":2199},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1561,"url":2201},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1935,"url":2203},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1601,"url":2205},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":133,"slug":2210,"dossier":47,"summary":2211,"aliases":2212,"sourceIds":2216,"published":2217,"modified":2218,"checkedAt":7,"severity":2219,"references":2223,"versionKeys":2232,"packageCount":32,"repositoryCount":66},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[2213,2214,2215],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[133,2215],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[2220,2222],{"type":1593,"score":2221},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1593,"score":1677},[2224,2226,2228,2230,2231],{"type":1702,"url":2225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1561,"url":2227},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1601,"url":2229},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1566,"url":1567},{"type":1561,"url":1569},[1575,1576,1577,1578,1579,1580],{"id":134,"slug":2234,"dossier":47,"summary":2235,"aliases":2236,"sourceIds":2240,"published":2241,"modified":2242,"checkedAt":7,"severity":2243,"references":2246,"versionKeys":2261,"packageCount":32,"repositoryCount":2041},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[2237,2238,2239],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[134,2239],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[2244],{"type":1593,"score":2245},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2247,2249,2251,2253,2255,2257,2259,2260],{"type":1702,"url":2248},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1561,"url":2250},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1601,"url":2252},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1601,"url":2254},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1601,"url":2256},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1558,"url":2258},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1566,"url":1567},{"type":1561,"url":2039},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":135,"slug":2263,"dossier":47,"summary":2264,"aliases":2265,"sourceIds":2268,"published":2269,"modified":2270,"checkedAt":7,"severity":2271,"references":2274,"versionKeys":2293,"packageCount":32,"repositoryCount":421},"ghsa-4xh5-x5gv-qwph-bdb101cb","pip's fallback tar extraction doesn't check symbolic links point to extraction directory",[2266,2267],"CVE-2025-8869","PYSEC-2026-1795",[135,2267],"2025-09-24T15:31:14Z","2026-09-10T03:50:27.949321787Z",[2272],{"type":1554,"score":2273},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2275,2277,2279,2281,2283,2285,2287,2289,2291],{"type":1561,"url":2276},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-8869",{"type":1558,"url":2278},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F13550",{"type":1601,"url":2280},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fcommit\u002Ff2b92314da012b9fffa36b3f3e67748a37ef464a",{"type":1566,"url":2282},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip",{"type":1558,"url":2284},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F10\u002Fmsg00028.html",{"type":1558,"url":2286},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FIF5A3GCJY3VH7BVHJKOWOJFKTW7VFQEN",{"type":1558,"url":2288},"https:\u002F\u002Fpip.pypa.io\u002Fen\u002Fstable\u002Fnews\u002F#v25-2",{"type":1566,"url":2290},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpip",{"type":1561,"url":2292},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4xh5-x5gv-qwph",[2294,2295],"pypi:pip@22.0.2","pypi:pip@25.1.1",{"id":136,"slug":2297,"dossier":47,"summary":2298,"aliases":2299,"sourceIds":2302,"published":2303,"modified":2304,"checkedAt":7,"severity":2305,"references":2310,"versionKeys":2333,"packageCount":32,"repositoryCount":2336},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[2300,2301],"CVE-2026-4539","PYSEC-2026-2987",[136,2301],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[2306,2308],{"type":1593,"score":2307},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1554,"score":2309},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2311,2313,2315,2317,2319,2321,2323,2325,2327,2329,2331],{"type":1561,"url":2312},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1558,"url":2314},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1558,"url":2316},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1558,"url":2318},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1566,"url":2320},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1558,"url":2322},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1558,"url":2324},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1558,"url":2326},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1558,"url":2328},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1566,"url":2330},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1561,"url":2332},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[2334,2335],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",16,{"id":137,"slug":2338,"dossier":47,"summary":2339,"aliases":2340,"sourceIds":2343,"published":2344,"modified":2345,"checkedAt":7,"severity":2346,"references":2348,"versionKeys":2359,"packageCount":32,"repositoryCount":381},"ghsa-558c-9hv2-4prj-1ba67416","virtualenv: Generated files can follow existing destination links",[2341,2342],"BIT-virtualenv-2026-113721","CVE-2026-113721",[137],"2026-10-22T17:03:12Z","2026-10-29T10:55:51.822936662Z",[2347],{"type":1593,"score":1976},[2349,2351,2353,2355,2357,2358],{"type":1558,"url":2350},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-558c-9hv2-4prj",{"type":1561,"url":2352},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113721",{"type":1558,"url":2354},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3431",{"type":1558,"url":2356},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fd25f28699eefb1fc34a251e5adf2b5de844c36cd",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":138,"slug":2361,"dossier":47,"summary":2362,"aliases":2363,"sourceIds":2365,"published":2366,"modified":2367,"checkedAt":7,"severity":2368,"references":2371,"versionKeys":2382,"packageCount":32,"repositoryCount":401},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[2364],"CVE-2026-112907",[138],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[2369],{"type":1593,"score":2370},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2372,2374,2376,2378,2380],{"type":1558,"url":2373},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1558,"url":2375},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1558,"url":2377},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1566,"url":2379},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1558,"url":2381},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[2383,2384,2385,2386],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",{"id":139,"slug":2388,"dossier":47,"summary":2389,"aliases":2390,"sourceIds":2393,"published":2394,"modified":2395,"checkedAt":7,"severity":2396,"references":2401,"versionKeys":2411,"packageCount":32,"repositoryCount":313},"ghsa-58cw-g322-p94v-a1eee673","Mistune has XSS via unescaped figclass\u002Ffigwidth in Figure directive",[2391,2392],"CVE-2026-44896","PYSEC-2026-168",[139,2392],"2026-05-08T23:43:12Z","2026-09-10T03:51:04.581184293Z",[2397,2399],{"type":1593,"score":2398},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1554,"score":2400},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:L\u002FSI:L\u002FSA:N",[2402,2404,2406,2408,2409],{"type":1561,"url":2403},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-58cw-g322-p94v",{"type":1561,"url":2405},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44896",{"type":1558,"url":2407},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002Fa3cb6e5655308797e8be021d6c7b5bab13cbace2",{"type":1566,"url":1709},{"type":1558,"url":2410},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-168.yaml",[1715,1716],{"id":140,"slug":2413,"dossier":47,"summary":2414,"aliases":2415,"sourceIds":2418,"published":2419,"modified":2420,"checkedAt":7,"severity":2421,"references":2424,"versionKeys":2437,"packageCount":32,"repositoryCount":421},"ghsa-58qw-9mgm-455v-d690efaf","pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files",[2416,2417],"CVE-2026-3219","PYSEC-2026-2875",[140,2417],"2026-04-20T18:31:48Z","2026-09-10T03:50:42.838011658Z",[2422],{"type":1554,"score":2423},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2425,2427,2429,2431,2432,2434,2435],{"type":1561,"url":2426},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-3219",{"type":1558,"url":2428},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fissues\u002F13867",{"type":1558,"url":2430},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F13870",{"type":1566,"url":2282},{"type":1558,"url":2433},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FQAJ5JIVWWCAJ4EZL2FP5MOOW35JS7LRJ",{"type":1566,"url":2290},{"type":1561,"url":2436},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-58qw-9mgm-455v",[2294,2295],{"id":141,"slug":2439,"dossier":91,"summary":2440,"aliases":2441,"sourceIds":2445,"published":2446,"modified":2447,"checkedAt":7,"severity":2448,"references":2452,"versionKeys":2461,"packageCount":32,"repositoryCount":1581},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[2442,2443,2444],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[141,2444],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[2449,2451],{"type":1554,"score":2450},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":1677},[2453,2455,2457,2459,2460],{"type":1702,"url":2454},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1561,"url":2456},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1601,"url":2458},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":142,"slug":2463,"dossier":47,"summary":2464,"aliases":2465,"sourceIds":2469,"published":2470,"modified":2471,"checkedAt":7,"severity":2472,"references":2474,"versionKeys":2488,"packageCount":32,"repositoryCount":381},"ghsa-597g-3phw-6986-6d75801e","virtualenv Has TOCTOU Vulnerabilities in Directory Creation",[2466,2467,2468],"BIT-virtualenv-2026-22702","CVE-2026-22702","PYSEC-2026-2009",[142,2468],"2026-01-13T18:45:57Z","2026-09-10T03:50:32.732715893Z",[2473],{"type":1593,"score":1976},[2475,2477,2479,2481,2483,2484,2486],{"type":1558,"url":2476},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-597g-3phw-6986",{"type":1561,"url":2478},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22702",{"type":1558,"url":2480},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3013",{"type":1601,"url":2482},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fdec4cec5d16edaf83a00a658f32d1e032661cebc",{"type":1566,"url":1875},{"type":1566,"url":2485},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fvirtualenv",{"type":1561,"url":2487},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-597g-3phw-6986",[1879,1880,1881,1882,1883],{"id":143,"slug":2490,"dossier":47,"summary":2491,"aliases":2492,"sourceIds":2494,"published":2495,"modified":2496,"checkedAt":7,"severity":2497,"references":2500,"versionKeys":2510,"packageCount":32,"repositoryCount":42},"ghsa-5cjw-f85j-cv6r-1c54e04a","Tornado: Open redirect via triple-slash redirect paths",[2493],"CVE-2026-126347",[143],"2026-11-13T20:31:22Z","2026-11-13T20:45:03.690595670Z",[2498],{"type":1593,"score":2499},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2501,2503,2505,2507,2508],{"type":1558,"url":2502},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-5cjw-f85j-cv6r",{"type":1561,"url":2504},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126347",{"type":1558,"url":2506},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fc503241622c0efe7c40110d89834ce8b7fead1e4",{"type":1566,"url":1905},{"type":1558,"url":2509},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.1",[1909,1910,1911,1912,1913,1914,2511],"pypi:tornado@6.6",{"id":144,"slug":2513,"dossier":47,"summary":2514,"aliases":2515,"sourceIds":2518,"published":2519,"modified":2520,"checkedAt":7,"severity":2521,"references":2524,"versionKeys":2534,"packageCount":32,"repositoryCount":381},"ghsa-5vjq-rrrf-7h2q-86d7b4a3","virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBST",[2516,2517],"BIT-virtualenv-2026-113726","CVE-2026-113726",[144],"2026-10-21T16:46:23Z","2026-10-29T10:55:33.825448161Z",[2522],{"type":1593,"score":2523},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2525,2527,2529,2531,2532],{"type":1558,"url":2526},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-5vjq-rrrf-7h2q",{"type":1561,"url":2528},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113726",{"type":1558,"url":2530},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F5b915367da82bd024b2a0d28d2f98007034b4aa2",{"type":1566,"url":1875},{"type":1558,"url":2533},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.14.4",[1879,1880,1881,1882,1883],{"id":145,"slug":2536,"dossier":91,"summary":2537,"aliases":2538,"sourceIds":2542,"published":2543,"modified":2544,"checkedAt":7,"severity":2545,"references":2550,"versionKeys":2559,"packageCount":32,"repositoryCount":1581},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2539,2540,2541],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[145,2541],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2546,2548],{"type":1554,"score":2547},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":2549},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2551,2553,2555,2557,2558],{"type":1702,"url":2552},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1561,"url":2554},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1601,"url":2556},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":146,"slug":2561,"dossier":47,"summary":2562,"aliases":2563,"sourceIds":2567,"published":2568,"modified":2569,"checkedAt":7,"severity":2570,"references":2572,"versionKeys":2582,"packageCount":32,"repositoryCount":2041},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2564,2565,2566],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[146,2566],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2571],{"type":1593,"score":1677},[2573,2575,2577,2578,2580,2581],{"type":1702,"url":2574},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1561,"url":2576},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1601,"url":2034},{"type":1558,"url":2579},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1566,"url":1567},{"type":1561,"url":2039},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":147,"slug":2584,"dossier":91,"summary":2585,"aliases":2586,"sourceIds":2589,"published":2590,"modified":2591,"checkedAt":7,"severity":2592,"references":2594,"versionKeys":2603,"packageCount":32,"repositoryCount":1581},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2587,2588],"BIT-pillow-2026-112399","CVE-2026-112399",[147],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2593],{"type":1554,"score":2450},[2595,2597,2599,2601,2602],{"type":1558,"url":2596},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1561,"url":2598},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1558,"url":2600},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":148,"slug":2605,"dossier":47,"summary":2606,"aliases":2607,"sourceIds":2611,"published":2612,"modified":2613,"checkedAt":7,"severity":2614,"references":2619,"versionKeys":2633,"packageCount":32,"repositoryCount":2634},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2608,2609,2610],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[148,2610],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2615,2617],{"type":1593,"score":2616},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1554,"score":2618},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2620,2622,2624,2626,2628,2630,2631],{"type":1561,"url":2621},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1561,"url":2623},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1558,"url":2625},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1558,"url":2627},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1558,"url":2629},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1566,"url":1567},{"type":1561,"url":2632},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1574,1575,1576,1577,1578],13,{"id":149,"slug":2636,"dossier":47,"summary":2637,"aliases":2638,"sourceIds":2642,"published":2643,"modified":2644,"checkedAt":7,"severity":2645,"references":2648,"versionKeys":2664,"packageCount":32,"repositoryCount":2041},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2639,2640,2641],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[149,2641],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2646],{"type":1554,"score":2647},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2649,2651,2653,2655,2657,2658,2660,2662],{"type":1558,"url":2650},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1561,"url":2652},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1558,"url":2654},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1558,"url":2656},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1566,"url":1567},{"type":1558,"url":2659},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1566,"url":2661},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1561,"url":2663},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":150,"slug":2666,"dossier":47,"summary":2667,"aliases":2668,"sourceIds":2671,"published":2672,"modified":2673,"checkedAt":7,"severity":2674,"references":2677,"versionKeys":2700,"packageCount":32,"repositoryCount":313},"ghsa-6497-prx7-gpmq-2b8ee85d","geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure",[2669,2670],"CVE-2025-69662","PYSEC-2026-62",[150,2670],"2026-01-30T19:16:11.967Z","2026-06-10T17:01:18.172032507Z",[2675],{"type":1593,"score":2676},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[2678,2680,2682,2684,2686,2688,2690,2692,2694,2696,2698],{"type":1561,"url":2679},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69662",{"type":1558,"url":2681},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fissues\u002F3679",{"type":1601,"url":2683},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fpull\u002F3681",{"type":1558,"url":2685},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fcommit\u002F6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419",{"type":1558,"url":2687},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas",{"type":1566,"url":2689},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas",{"type":1558,"url":2691},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Freleases\u002Ftag\u002Fv1.1.2",{"type":1558,"url":2693},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgeopandas\u002FPYSEC-2026-62.yaml",{"type":1558,"url":2695},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00025.html",{"type":1702,"url":2697},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas\u002F",{"type":1561,"url":2699},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6497-prx7-gpmq",[2701],"pypi:geopandas@1.0.1",{"id":151,"slug":2703,"dossier":47,"summary":2704,"aliases":2705,"sourceIds":2709,"published":2710,"modified":2711,"checkedAt":7,"severity":2712,"references":2717,"versionKeys":2728,"packageCount":32,"repositoryCount":2729},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2706,2707,2708],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[151,2708],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2713,2715],{"type":1554,"score":2714},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":2716},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2718,2720,2722,2724,2726,2727],{"type":1561,"url":2719},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1561,"url":2721},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1935,"url":2723},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1601,"url":2725},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1566,"url":1567},{"type":1561,"url":1569},[1574,1575,1576,1577,1578,1579,1580],15,{"id":152,"slug":2731,"dossier":91,"summary":2732,"aliases":2733,"sourceIds":2736,"published":2737,"modified":2738,"checkedAt":7,"severity":2739,"references":2743,"versionKeys":2752,"packageCount":32,"repositoryCount":2757},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2734,2735],"CVE-2026-45409","PYSEC-2026-215",[152,2735],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2740,2741],{"type":1593,"score":1894},{"type":1554,"score":2742},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2744,2746,2748,2750],{"type":1561,"url":2745},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1561,"url":2747},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1566,"url":2749},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1558,"url":2751},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2753,2754,2755,2756],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":153,"slug":2759,"dossier":91,"summary":2760,"aliases":2761,"sourceIds":2764,"published":2765,"modified":2766,"checkedAt":7,"severity":2767,"references":2769,"versionKeys":2778,"packageCount":32,"repositoryCount":1581},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2762,2763],"BIT-pillow-2026-112400","CVE-2026-112400",[153],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2768],{"type":1554,"score":2450},[2770,2772,2774,2776,2777],{"type":1558,"url":2771},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1561,"url":2773},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1558,"url":2775},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":154,"slug":2780,"dossier":47,"summary":2781,"aliases":2782,"sourceIds":2784,"published":2785,"modified":2786,"checkedAt":7,"severity":2787,"references":2789,"versionKeys":2801,"packageCount":32,"repositoryCount":381},"ghsa-6655-6qjp-jx7x-ff241ef7","Soup Sieve: Exponential ReDoS in selector compilation via \\9-run in CSS_ESCAPES\u002FIDENTIFIER",[2783],"CVE-2026-126191",[154],"2026-11-13T16:39:43Z","2026-11-13T16:45:03.387641194Z",[2788],{"type":1593,"score":1677},[2790,2792,2794,2796,2798,2799],{"type":1558,"url":2791},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-6655-6qjp-jx7x",{"type":1561,"url":2793},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126191",{"type":1558,"url":2795},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fpull\u002F300",{"type":1558,"url":2797},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002Fdbfa2854ff31a863326bd6660d4e55c6f068db9e",{"type":1566,"url":1732},{"type":1558,"url":2800},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Freleases\u002Ftag\u002F3.0",[1740,1741,1742,2183,2184],{"id":155,"slug":2803,"dossier":91,"summary":2804,"aliases":2805,"sourceIds":2807,"published":2808,"modified":2809,"checkedAt":7,"severity":2810,"references":2813,"versionKeys":2822,"packageCount":32,"repositoryCount":1581},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2806],"CVE-2026-112909",[155],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2811],{"type":1593,"score":2812},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2814,2816,2818,2819,2820,2821],{"type":1558,"url":2815},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1561,"url":2817},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1558,"url":2375},{"type":1558,"url":2377},{"type":1566,"url":2379},{"type":1558,"url":2381},[2823,2824,2825,2826,2827,2383,2384,2385,2386],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":156,"slug":2829,"dossier":91,"summary":2830,"aliases":2831,"sourceIds":2833,"published":2834,"modified":2835,"checkedAt":7,"severity":2836,"references":2839,"versionKeys":2851,"packageCount":32,"repositoryCount":2863},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2832],"PYSEC-2026-4320",[156,2832],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2837],{"type":1554,"score":2838},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2840,2842,2844,2846,2847,2849],{"type":1558,"url":2841},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1558,"url":2843},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1558,"url":2845},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1566,"url":1604},{"type":1566,"url":2848},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1561,"url":2850},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2852,1617,2853,2854,2855,2856,2857,2858,2859,2860,2861,2862],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":157,"slug":2865,"dossier":47,"summary":2866,"aliases":2867,"sourceIds":2871,"published":2872,"modified":2873,"checkedAt":7,"severity":2874,"references":2876,"versionKeys":2889,"packageCount":32,"repositoryCount":2041},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2868,2869,2870],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[157,2870],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2875],{"type":1593,"score":1677},[2877,2879,2881,2883,2885,2887,2888],{"type":1702,"url":2878},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1561,"url":2880},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1601,"url":2882},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1601,"url":2884},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1558,"url":2886},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1566,"url":1567},{"type":1561,"url":2659},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":158,"slug":2891,"dossier":47,"summary":2892,"aliases":2893,"sourceIds":2896,"published":2897,"modified":2898,"checkedAt":7,"severity":2899,"references":2902,"versionKeys":2915,"packageCount":32,"repositoryCount":421},"ghsa-6vgw-5pg2-w6jp-57c7d3f5","pip Path Traversal vulnerability",[2894,2895],"CVE-2026-1703","PYSEC-2026-1796",[158,2895],"2026-02-02T15:30:34Z","2026-09-10T03:50:34.266257578Z",[2900],{"type":1554,"score":2901},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2903,2905,2907,2909,2910,2912,2913],{"type":1561,"url":2904},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1703",{"type":1558,"url":2906},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F13777",{"type":1558,"url":2908},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fcommit\u002F8e227a9be4faa9594e05d02ca05a413a2a4e7735",{"type":1566,"url":2282},{"type":1558,"url":2911},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FWIEA34D4TABF2UNQJAOMXKCICSPBE2DJ",{"type":1566,"url":2290},{"type":1561,"url":2914},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6vgw-5pg2-w6jp",[2294,2295],{"id":159,"slug":2917,"dossier":47,"summary":2918,"aliases":2919,"sourceIds":2922,"published":2923,"modified":2924,"checkedAt":7,"severity":2925,"references":2927,"versionKeys":2938,"packageCount":32,"repositoryCount":381},"ghsa-6w3r-xr62-4xcp-69d1732a","virtualenv: Bash prompt values can change meaning under older compatibility modes",[2920,2921],"BIT-virtualenv-2026-113723","CVE-2026-113723",[159],"2026-10-23T22:21:57Z","2026-10-29T10:55:32.039209236Z",[2926],{"type":1554,"score":1864},[2928,2930,2932,2934,2936,2937],{"type":1558,"url":2929},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-6w3r-xr62-4xcp",{"type":1561,"url":2931},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113723",{"type":1558,"url":2933},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3418",{"type":1558,"url":2935},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F5f48d711731311428aebfae61d46957762155b22",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":160,"slug":2940,"dossier":47,"summary":2941,"aliases":2942,"sourceIds":2945,"published":2946,"modified":2947,"checkedAt":7,"severity":2948,"references":2951,"versionKeys":2970,"packageCount":32,"repositoryCount":381},"ghsa-6w46-j5rx-g56g-5324d549","pytest has vulnerable tmpdir handling",[2943,2944],"CVE-2025-71176","PYSEC-2026-1845",[160,2944],"2026-01-22T06:30:29Z","2026-09-10T03:50:32.768043789Z",[2949],{"type":1593,"score":2950},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:L",[2952,2954,2956,2958,2960,2962,2964,2966,2968],{"type":1561,"url":2953},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-71176",{"type":1558,"url":2955},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fissues\u002F13669",{"type":1558,"url":2957},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fpull\u002F14343",{"type":1558,"url":2959},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fcommit\u002F95d8423bd24992deea5b9df32555fa1741679e2c",{"type":1566,"url":2961},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytes",{"type":1558,"url":2963},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Freleases\u002Ftag\u002F9.0.3",{"type":1558,"url":2965},"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F01\u002F21\u002F5",{"type":1566,"url":2967},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytest",{"type":1561,"url":2969},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6w46-j5rx-g56g",[2971,2972,2973,2974,2975],"pypi:pytest@7.2.2","pypi:pytest@7.4.4","pypi:pytest@8.3.2","pypi:pytest@8.4.2","pypi:pytest@9.0.2",{"id":161,"slug":2977,"dossier":91,"summary":2978,"aliases":2979,"sourceIds":2982,"published":2983,"modified":2984,"checkedAt":7,"severity":2985,"references":2987,"versionKeys":2996,"packageCount":32,"repositoryCount":1581},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[2980,2981],"BIT-pillow-2026-112401","CVE-2026-112401",[161],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[2986],{"type":1554,"score":2742},[2988,2990,2992,2994,2995],{"type":1558,"url":2989},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1561,"url":2991},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1558,"url":2993},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":162,"slug":2998,"dossier":47,"summary":2999,"aliases":3000,"sourceIds":3003,"published":3004,"modified":3005,"checkedAt":7,"severity":3006,"references":3009,"versionKeys":3022,"packageCount":32,"repositoryCount":381},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[3001,3002],"CVE-2025-66034","PYSEC-2026-1389",[162,3002],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[3007],{"type":1593,"score":3008},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[3010,3012,3014,3016,3018,3020],{"type":1558,"url":3011},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1561,"url":3013},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1558,"url":3015},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1566,"url":3017},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1566,"url":3019},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1561,"url":3021},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[3023,3024,3025,3026,3027,3028],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",{"id":163,"slug":3030,"dossier":47,"summary":3031,"aliases":3032,"sourceIds":3036,"published":3037,"modified":3038,"checkedAt":7,"severity":3039,"references":3046,"versionKeys":3058,"packageCount":32,"repositoryCount":371},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[3033,3034,3035],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[163,3034,3035],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[3040,3042,3044],{"type":1593,"score":3041},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1593,"score":3043},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1593,"score":3045},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[3047,3049,3051,3052,3054,3056],{"type":1561,"url":3048},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1558,"url":3050},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1566,"url":1905},{"type":1558,"url":3053},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1561,"url":3055},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1561,"url":3057},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1909,1910,1911,1912],{"id":164,"slug":3060,"dossier":47,"summary":3061,"aliases":3062,"sourceIds":3063,"published":3064,"modified":3065,"checkedAt":7,"severity":3066,"references":3069,"versionKeys":3082,"packageCount":32,"repositoryCount":351},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[164],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[3067],{"type":1593,"score":3068},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3070,3072,3074,3076,3078,3079,3080],{"type":1558,"url":3071},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1558,"url":3073},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1558,"url":3075},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1558,"url":3077},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1566,"url":1567},{"type":1558,"url":1569},{"type":1558,"url":3081},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1573,1574,1575,1576,1577,1578,1579,1580],{"id":165,"slug":3084,"dossier":47,"summary":3085,"aliases":3086,"sourceIds":3089,"published":3090,"modified":3091,"checkedAt":7,"severity":3092,"references":3094,"versionKeys":3107,"packageCount":32,"repositoryCount":313},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[3087,3088],"CVE-2025-47287","PYSEC-2026-1974",[165,3088],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[3093],{"type":1593,"score":1677},[3095,3097,3099,3101,3102,3104,3105],{"type":1558,"url":3096},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1561,"url":3098},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1558,"url":3100},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1566,"url":1905},{"type":1558,"url":3103},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1566,"url":1959},{"type":1561,"url":3106},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1909],{"id":166,"slug":3109,"dossier":47,"summary":3110,"aliases":3111,"sourceIds":3113,"published":3114,"modified":3115,"checkedAt":7,"severity":3116,"references":3118,"versionKeys":3129,"packageCount":32,"repositoryCount":381},"ghsa-7g44-g9rc-x53w-58fa7733","Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack",[3112],"CVE-2026-126193",[166],"2026-11-13T16:34:59Z","2026-11-13T16:45:03.468864320Z",[3117],{"type":1593,"score":1894},[3119,3121,3123,3125,3127,3128],{"type":1558,"url":3120},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-7g44-g9rc-x53w",{"type":1561,"url":3122},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126193",{"type":1558,"url":3124},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fpull\u002F306",{"type":1558,"url":3126},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002F52de12f157a373614ad0f486d434551c5a4378ee",{"type":1566,"url":1732},{"type":1558,"url":2800},[1740,1741,1742,2183,2184],{"id":167,"slug":3131,"dossier":47,"summary":3132,"aliases":3133,"sourceIds":3136,"published":3137,"modified":3138,"checkedAt":7,"severity":3139,"references":3142,"versionKeys":3149,"packageCount":32,"repositoryCount":313},"ghsa-7jqv-fw35-gmx9-d6bf4abd","nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding",[3134,3135],"CVE-2026-39378","PYSEC-2026-2230",[167,3135],"2026-04-21T01:16:06.073Z","2026-09-10T03:50:43.685983757Z",[3140],{"type":1593,"score":3141},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3143,3145,3147,3148],{"type":1561,"url":3144},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fsecurity\u002Fadvisories\u002FGHSA-7jqv-fw35-gmx9",{"type":1561,"url":3146},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-39378",{"type":1566,"url":2132},{"type":1558,"url":2134},[2136],{"id":168,"slug":3151,"dossier":91,"summary":3152,"aliases":3153,"sourceIds":3157,"published":3158,"modified":3159,"checkedAt":7,"severity":3160,"references":3163,"versionKeys":3172,"packageCount":32,"repositoryCount":1581},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[3154,3155,3156],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[168,3156],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[3161,3162],{"type":1554,"score":2450},{"type":1593,"score":1677},[3164,3166,3168,3170,3171],{"type":1601,"url":3165},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1561,"url":3167},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1601,"url":3169},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":169,"slug":3174,"dossier":47,"summary":3175,"aliases":3176,"sourceIds":3179,"published":3180,"modified":3181,"checkedAt":7,"severity":3182,"references":3184,"versionKeys":3193,"packageCount":32,"repositoryCount":34},"ghsa-836r-79rf-4m37-54a23e8e","Soup Sieve: Regular Expression Denial of Service (ReDoS) via Selector Parser",[3177,3178],"CVE-2026-49477","PYSEC-2026-3072",[169,3178],"2026-07-09T13:37:46Z","2026-09-10T03:51:10.949295830Z",[3183],{"type":1593,"score":1677},[3185,3187,3188,3189,3191],{"type":1558,"url":3186},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-836r-79rf-4m37",{"type":1566,"url":1732},{"type":1566,"url":1734},{"type":1561,"url":3190},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-836r-79rf-4m37",{"type":1561,"url":3192},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49477",[1740,1741,1742],{"id":170,"slug":3195,"dossier":47,"summary":3196,"aliases":3197,"sourceIds":3199,"published":3200,"modified":3201,"checkedAt":7,"severity":3202,"references":3204,"versionKeys":3216,"packageCount":32,"repositoryCount":66},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[3198],"CVE-2026-91990",[170],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[3203],{"type":1554,"score":2742},[3205,3207,3209,3211,3213,3214],{"type":1558,"url":3206},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1558,"url":3208},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1558,"url":3210},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1558,"url":3212},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1566,"url":1905},{"type":1558,"url":3215},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1909,1910,1911,1912,1913,1914],{"id":171,"slug":3218,"dossier":91,"summary":3219,"aliases":3220,"sourceIds":3223,"published":3224,"modified":3225,"checkedAt":7,"severity":3226,"references":3229,"versionKeys":3246,"packageCount":32,"repositoryCount":2757},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[3221,3222],"CVE-2026-97687","PYSEC-2026-4175",[171,3222],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[3227],{"type":1554,"score":3228},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3230,3232,3234,3236,3238,3240,3241,3243,3244],{"type":1558,"url":3231},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1561,"url":3233},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1558,"url":3235},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1558,"url":3237},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1558,"url":3239},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1566,"url":1769},{"type":1558,"url":3242},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1566,"url":1771},{"type":1561,"url":3245},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1773,1774,1775,1776,1777,3247,3248],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":172,"slug":3250,"dossier":47,"summary":3251,"aliases":3252,"sourceIds":3255,"published":3256,"modified":3257,"checkedAt":7,"severity":3258,"references":3260,"versionKeys":3271,"packageCount":32,"repositoryCount":313},"ghsa-8c25-4j27-2rv3-4e2c246a","Mistune: XSS via percent-encoded javascript URI bypass in safe_url()",[3253,3254],"CVE-2026-59923","PYSEC-2026-2211",[172,3254],"2026-07-08T17:17:27.910Z","2026-07-20T21:46:43.351006286Z",[3259],{"type":1593,"score":2398},[3261,3263,3265,3267,3268,3269],{"type":1702,"url":3262},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-8c25-4j27-2rv3",{"type":1561,"url":3264},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59923",{"type":1601,"url":3266},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002Fc7101fcbb6e8790e8e39157c5ca2238fc6dd6cbc",{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":3270},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2211.yaml",[1715,1716],{"id":173,"slug":3273,"dossier":47,"summary":3274,"aliases":3275,"sourceIds":3279,"published":3280,"modified":3281,"checkedAt":7,"severity":3282,"references":3285,"versionKeys":3293,"packageCount":32,"repositoryCount":1581},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[3276,3277,3278],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[173,3278],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[3283,3284],{"type":1554,"score":2547},{"type":1593,"score":2549},[3286,3288,3290,3291,3292],{"type":1702,"url":3287},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1561,"url":3289},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1601,"url":2556},{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":174,"slug":3295,"dossier":47,"summary":3296,"aliases":3297,"sourceIds":3300,"published":3301,"modified":3302,"checkedAt":7,"severity":3303,"references":3305,"versionKeys":3313,"packageCount":32,"repositoryCount":313},"ghsa-8g87-j6q8-g93x-2e837b39","Mistune Math Plugin has an XSS Escape Bypass",[3298,3299],"CVE-2026-44708","PYSEC-2026-2206",[174,3299],"2026-05-08T23:40:04Z","2026-09-10T03:51:04.993819302Z",[3304],{"type":1593,"score":2398},[3306,3308,3310,3311],{"type":1702,"url":3307},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-8g87-j6q8-g93x",{"type":1561,"url":3309},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44708",{"type":1566,"url":1709},{"type":1561,"url":3312},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Freleases\u002Ftag\u002Fv3.2.1",[1715,1716],{"id":175,"slug":3315,"dossier":47,"summary":3316,"aliases":3317,"sourceIds":3320,"published":3321,"modified":3322,"checkedAt":7,"severity":3323,"references":3325,"versionKeys":3337,"packageCount":32,"repositoryCount":313},"ghsa-8mp2-v27r-99xp-3e3baa33","Mistune has a ReDoS in LINK_TITLE_RE that allows denial of service via crafted Markdown input",[3318,3319],"CVE-2026-33079","PYSEC-2026-2651",[175,3319],"2026-05-06T16:52:43Z","2026-09-10T03:51:05.039110483Z",[3324],{"type":1554,"score":2450},[3326,3328,3330,3331,3333,3335],{"type":1558,"url":3327},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-8mp2-v27r-99xp",{"type":1561,"url":3329},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33079",{"type":1566,"url":1709},{"type":1558,"url":3332},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fblob\u002Fdf23edd60b43b639d2e6760ef9dd3d618aa11c21\u002Fsrc\u002Fmistune\u002Fhelpers.py#L20-L25",{"type":1566,"url":3334},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fmistune",{"type":1561,"url":3336},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8mp2-v27r-99xp",[1715,1716],{"id":176,"slug":3339,"dossier":47,"summary":3340,"aliases":3341,"sourceIds":3344,"published":3345,"modified":3346,"checkedAt":7,"severity":3347,"references":3349,"versionKeys":3360,"packageCount":32,"repositoryCount":313},"ghsa-8mpj-m6qm-5qr8-24abd1d9","Mistune directives\u002Finclude: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two attacker-controlled markdown files",[3342,3343],"CVE-2026-59927","PYSEC-2026-2215",[176,3343],"2026-07-08T17:17:28.450Z","2026-07-20T21:30:45.969881443Z",[3348],{"type":1593,"score":1894},[3350,3352,3354,3356,3357,3358],{"type":1702,"url":3351},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-8mpj-m6qm-5qr8",{"type":1561,"url":3353},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59927",{"type":1601,"url":3355},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002F1bef343ade163fc3bb95572b15be720084cdb993",{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":3359},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2215.yaml",[1715,1716],{"id":177,"slug":3362,"dossier":47,"summary":3363,"aliases":3364,"sourceIds":3366,"published":3367,"modified":3368,"checkedAt":7,"severity":3369,"references":3372,"versionKeys":3379,"packageCount":32,"repositoryCount":1581},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[3365],"CVE-2026-112910",[177],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[3370],{"type":1593,"score":3371},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[3373,3375,3376,3377,3378],{"type":1558,"url":3374},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1558,"url":2375},{"type":1558,"url":2377},{"type":1566,"url":2379},{"type":1558,"url":2381},[2823,2824,2825,2826,2827,2383,2384,2385,2386],{"id":178,"slug":3381,"dossier":47,"summary":3382,"aliases":3383,"sourceIds":3384,"published":3385,"modified":3386,"checkedAt":7,"severity":3387,"references":3390,"versionKeys":3397,"packageCount":32,"repositoryCount":313},"ghsa-8rfp-98v4-mmr6-7ea7e5dd","Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output",[],[178],"2026-06-16T14:06:29Z","2026-09-10T03:50:49.026722271Z",[3388],{"type":1593,"score":3389},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:N",[3391,3393,3395],{"type":1558,"url":3392},"https:\u002F\u002Fgithub.com\u002Fmozilla\u002Fbleach\u002Fsecurity\u002Fadvisories\u002FGHSA-8rfp-98v4-mmr6",{"type":1558,"url":3394},"https:\u002F\u002Fbugzilla.mozilla.org\u002Fshow_bug.cgi?id=2023812",{"type":1566,"url":3396},"https:\u002F\u002Fgithub.com\u002Fmozilla\u002Fbleach",[3398],"pypi:bleach@6.2.0",{"id":179,"slug":3400,"dossier":47,"summary":3401,"aliases":3402,"sourceIds":3405,"published":3406,"modified":3407,"checkedAt":7,"severity":3408,"references":3410,"versionKeys":3420,"packageCount":32,"repositoryCount":381},"ghsa-8rjx-v5ww-45pp-d32996f1","virtualenv activation scripts run code from a path that contains a placeholder name",[3403,3404],"BIT-virtualenv-2026-113776","CVE-2026-113776",[179],"2026-10-21T16:39:38Z","2026-10-29T10:55:59.336337258Z",[3409],{"type":1593,"score":2523},[3411,3413,3415,3417,3418],{"type":1558,"url":3412},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-8rjx-v5ww-45pp",{"type":1561,"url":3414},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113776",{"type":1558,"url":3416},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F602b26623a724827ff171bf11fef4ad186d01f74",{"type":1566,"url":1875},{"type":1558,"url":3419},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.14.2",[1879,1880,1881,1882,1883],{"id":180,"slug":3422,"dossier":47,"summary":3423,"aliases":3424,"sourceIds":3428,"published":3429,"modified":3430,"checkedAt":7,"severity":3431,"references":3433,"versionKeys":3443,"packageCount":32,"repositoryCount":2041},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[3425,3426,3427],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[180,3427],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[3432],{"type":1593,"score":1677},[3434,3436,3438,3439,3441,3442],{"type":1702,"url":3435},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1561,"url":3437},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1601,"url":2034},{"type":1558,"url":3440},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1566,"url":1567},{"type":1561,"url":2039},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":181,"slug":3445,"dossier":47,"summary":3446,"aliases":3447,"sourceIds":3451,"published":3452,"modified":3453,"checkedAt":7,"severity":3454,"references":3457,"versionKeys":3472,"packageCount":32,"repositoryCount":381},"ghsa-94p9-xgh2-xp45-1ed45366","virtualenv: Downloaded seed wheels (pip\u002Fsetuptools) are not integrity-checked before use",[3448,3449,3450],"BIT-virtualenv-2026-102930","CVE-2026-102930","PYSEC-2026-4011",[181,3450],"2026-09-18T01:41:45Z","2026-10-06T15:26:06.490658879Z",[3455],{"type":1554,"score":3456},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3458,3460,3462,3464,3466,3468,3469,3471],{"type":1558,"url":3459},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-94p9-xgh2-xp45",{"type":1561,"url":3461},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102930",{"type":1558,"url":3463},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3251",{"type":1601,"url":3465},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fa01ed3e2f239d6ab1fce62c5c7664ccf268fff6d",{"type":1558,"url":3467},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvirtualenv\u002FPYSEC-2026-4011.yaml",{"type":1566,"url":1875},{"type":1558,"url":3470},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.7.12",{"type":1566,"url":2485},[1879,1880,1881,1882,1883],{"id":182,"slug":3474,"dossier":47,"summary":3475,"aliases":3476,"sourceIds":3478,"published":3479,"modified":3480,"checkedAt":7,"severity":3481,"references":3484,"versionKeys":3490,"packageCount":32,"repositoryCount":313},"ghsa-9754-6rhw-gj3h-68380eeb","jupyter\u002Fnbconvert allows Cross-site Scripting (XSS) via unsanitized `text\u002Fvnd.mermaid` output in HTML exports",[3477],"CVE-2026-6658",[182],"2026-06-26T12:30:29Z","2026-11-06T18:00:04.178054901Z",[3482],{"type":1593,"score":3483},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[3485,3487,3488],{"type":1561,"url":3486},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6658",{"type":1566,"url":2132},{"type":1558,"url":3489},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F47570290-3b26-4477-8cfa-fdef7db5aefe",[2136],{"id":183,"slug":3492,"dossier":47,"summary":3493,"aliases":3494,"sourceIds":3498,"published":3499,"modified":3500,"checkedAt":7,"severity":3501,"references":3504,"versionKeys":3519,"packageCount":32,"repositoryCount":381},"ghsa-9h9j-4vrj-gf7g-c50a1cd4","virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection",[3495,3496,3497],"BIT-virtualenv-2026-102938","CVE-2026-102938","PYSEC-2026-4012",[183,3497],"2026-09-17T16:42:47Z","2026-10-06T15:25:56.172772842Z",[3502],{"type":1554,"score":3503},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3505,3507,3509,3511,3513,3515,3516,3518],{"type":1558,"url":3506},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-9h9j-4vrj-gf7g",{"type":1561,"url":3508},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102938",{"type":1558,"url":3510},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3247",{"type":1601,"url":3512},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fa30f995461043acb6cacbf3a890951563ccf7140",{"type":1558,"url":3514},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvirtualenv\u002FPYSEC-2026-4012.yaml",{"type":1566,"url":1875},{"type":1558,"url":3517},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.7.11",{"type":1566,"url":2485},[1879,1880,1881,1882,1883],{"id":184,"slug":3521,"dossier":47,"summary":3522,"aliases":3523,"sourceIds":3526,"published":3527,"modified":3528,"checkedAt":7,"severity":3529,"references":3532,"versionKeys":3555,"packageCount":32,"repositoryCount":381},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[3524,3525],"CVE-2024-47081","PYSEC-2026-1872",[184,3525],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[3530],{"type":1593,"score":3531},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3533,3535,3537,3539,3541,3543,3545,3547,3549,3551,3553],{"type":1558,"url":3534},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1561,"url":3536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1558,"url":3538},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1601,"url":3540},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1561,"url":3542},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1566,"url":3544},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1558,"url":3546},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1558,"url":3548},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1566,"url":3550},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1558,"url":3552},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1558,"url":3554},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3556,3557],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":185,"slug":3559,"dossier":47,"summary":3560,"aliases":3561,"sourceIds":3565,"published":3566,"modified":3567,"checkedAt":7,"severity":3568,"references":3570,"versionKeys":3583,"packageCount":32,"repositoryCount":2041},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3562,3563,3564],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[185,3564],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3569],{"type":1593,"score":1677},[3571,3573,3575,3577,3579,3581,3582],{"type":1702,"url":3572},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1561,"url":3574},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1601,"url":3576},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1601,"url":3578},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1558,"url":3580},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1566,"url":1567},{"type":1561,"url":2659},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":186,"slug":3585,"dossier":47,"summary":3586,"aliases":3587,"sourceIds":3591,"published":3592,"modified":3593,"checkedAt":7,"severity":3594,"references":3599,"versionKeys":3610,"packageCount":32,"repositoryCount":1581},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3588,3589,3590],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[186,3590],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3595,3597],{"type":1554,"score":3596},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":3598},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3600,3602,3604,3606,3608,3609],{"type":1561,"url":3601},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1561,"url":3603},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1935,"url":3605},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1601,"url":3607},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":187,"slug":3612,"dossier":47,"summary":3613,"aliases":3614,"sourceIds":3616,"published":3617,"modified":3618,"checkedAt":7,"severity":3619,"references":3621,"versionKeys":3630,"packageCount":32,"repositoryCount":401},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3615],"CVE-2026-112913",[187],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3620],{"type":1593,"score":2307},[3622,3624,3626,3628,3629],{"type":1558,"url":3623},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1558,"url":3625},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1558,"url":3627},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1566,"url":2379},{"type":1558,"url":2381},[2383,2384,2385,2386],{"id":188,"slug":3632,"dossier":47,"summary":3633,"aliases":3634,"sourceIds":3637,"published":3638,"modified":3639,"checkedAt":7,"severity":3640,"references":3643,"versionKeys":3660,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3635,3636],"CVE-2024-35195","PYSEC-2026-1873",[188,3636],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3641],{"type":1593,"score":3642},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3644,3646,3648,3650,3652,3653,3655,3657,3658],{"type":1558,"url":3645},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1561,"url":3647},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1558,"url":3649},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1601,"url":3651},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1566,"url":3544},{"type":1558,"url":3654},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1558,"url":3656},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1566,"url":3550},{"type":1561,"url":3659},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3556],{"id":189,"slug":3662,"dossier":47,"summary":3663,"aliases":3664,"sourceIds":3666,"published":3667,"modified":3668,"checkedAt":7,"severity":3669,"references":3672,"versionKeys":3682,"packageCount":32,"repositoryCount":66},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[3665],"CVE-2026-103263",[189],"2026-09-30T23:48:55Z","2026-10-02T03:56:10.964622908Z",[3670],{"type":1554,"score":3671},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3673,3675,3676,3678,3680,3681],{"type":1558,"url":3674},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1558,"url":1899},{"type":1558,"url":3677},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1558,"url":3679},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1566,"url":1905},{"type":1558,"url":1907},[1909,1910,1911,1912,1913,1914],{"id":190,"slug":3684,"dossier":47,"summary":3685,"aliases":3686,"sourceIds":3689,"published":3690,"modified":3691,"checkedAt":7,"severity":3692,"references":3695,"versionKeys":3704,"packageCount":32,"repositoryCount":1581},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3687,3688],"BIT-pillow-2026-112404","CVE-2026-112404",[190],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3693],{"type":1554,"score":3694},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3696,3698,3700,3702,3703],{"type":1558,"url":3697},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1561,"url":3699},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1558,"url":3701},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":191,"slug":3706,"dossier":47,"summary":3707,"aliases":3708,"sourceIds":3711,"published":3712,"modified":3713,"checkedAt":7,"severity":3714,"references":3716,"versionKeys":3727,"packageCount":32,"repositoryCount":313},"ghsa-c8j7-8cv4-2xmq-1ef013c3","Mistune plugins\u002Fformatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough \u002F mark \u002F insert)",[3709,3710],"CVE-2026-59922","PYSEC-2026-2210",[191,3710],"2026-07-08T17:17:27.770Z","2026-07-20T21:46:39.999565306Z",[3715],{"type":1593,"score":1677},[3717,3719,3721,3723,3724,3725],{"type":1702,"url":3718},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-c8j7-8cv4-2xmq",{"type":1561,"url":3720},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59922",{"type":1601,"url":3722},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002F96d0f57f8fe9eeb06bb4cff521962a27d7c402e7",{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":3726},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2210.yaml",[1715,1716],{"id":192,"slug":3729,"dossier":47,"summary":3730,"aliases":3731,"sourceIds":3734,"published":3735,"modified":3736,"checkedAt":7,"severity":3737,"references":3739,"versionKeys":3748,"packageCount":32,"repositoryCount":381},"ghsa-c947-3pg5-gm8q-45da7664","virtualenv activate.fish runs commands from a path or prompt with a backslash before a quote",[3732,3733],"BIT-virtualenv-2026-113732","CVE-2026-113732",[192],"2026-10-21T16:39:58Z","2026-10-29T10:55:30.348006947Z",[3738],{"type":1593,"score":2523},[3740,3742,3744,3746,3747],{"type":1558,"url":3741},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-c947-3pg5-gm8q",{"type":1561,"url":3743},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113732",{"type":1558,"url":3745},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F3bddeaf8d02c3ee7f576503efb082f8f494cfcab",{"type":1566,"url":1875},{"type":1558,"url":3419},[1879,1880,1881,1882,1883],{"id":193,"slug":3750,"dossier":47,"summary":3751,"aliases":3752,"sourceIds":3755,"published":3756,"modified":3757,"checkedAt":7,"severity":3758,"references":3760,"versionKeys":3771,"packageCount":32,"repositoryCount":381},"ghsa-c978-59m8-c77v-420aeea3","virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax",[3753,3754],"BIT-virtualenv-2026-113722","CVE-2026-113722",[193],"2026-10-21T21:30:12Z","2026-10-29T10:55:46.719521464Z",[3759],{"type":1593,"score":2523},[3761,3763,3765,3767,3769,3770],{"type":1558,"url":3762},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-c978-59m8-c77v",{"type":1561,"url":3764},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113722",{"type":1558,"url":3766},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3417",{"type":1558,"url":3768},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F2519941bed33ee0d3ac99277f67913e439e476a9",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":194,"slug":3773,"dossier":47,"summary":3774,"aliases":3775,"sourceIds":3778,"published":3779,"modified":3780,"checkedAt":7,"severity":3781,"references":3783,"versionKeys":3795,"packageCount":32,"repositoryCount":3796},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[3776,3777],"CVE-2025-67725","PYSEC-2025-266",[194,3777],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[3782],{"type":1593,"score":1677},[3784,3786,3788,3790,3792,3793],{"type":1561,"url":3785},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1561,"url":3787},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1601,"url":3789},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1558,"url":3791},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1566,"url":1905},{"type":1561,"url":3794},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1909,1910,1911],9,{"id":195,"slug":3798,"dossier":47,"summary":3799,"aliases":3800,"sourceIds":3804,"published":3805,"modified":3806,"checkedAt":7,"severity":3807,"references":3811,"versionKeys":3851,"packageCount":32,"repositoryCount":2336},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3801,3802,3803],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[195,3803],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3808,3810],{"type":1554,"score":3809},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":1677},[3812,3814,3816,3818,3820,3822,3823,3825,3827,3829,3831,3833,3835,3837,3839,3841,3843,3845,3847,3849],{"type":1558,"url":3813},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1561,"url":3815},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1558,"url":3817},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1558,"url":3819},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1558,"url":3821},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1566,"url":1567},{"type":1558,"url":3824},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1558,"url":3826},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1558,"url":3828},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1561,"url":3830},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1561,"url":3832},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1561,"url":3834},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1561,"url":3836},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1561,"url":3838},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1561,"url":3840},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1561,"url":3842},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1561,"url":3844},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1561,"url":3846},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1561,"url":3848},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1561,"url":3850},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1571,1572,1573,1574,1575,1576,1577],{"id":196,"slug":3853,"dossier":47,"summary":3854,"aliases":3855,"sourceIds":3857,"published":3858,"modified":3859,"checkedAt":7,"severity":3860,"references":3862,"versionKeys":3876,"packageCount":32,"repositoryCount":66},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[3856],"CVE-2026-103262",[196],"2026-09-30T23:49:13Z","2026-10-02T03:56:11.819291984Z",[3861],{"type":1593,"score":1677},[3863,3865,3866,3868,3870,3872,3874,3875],{"type":1558,"url":3864},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1558,"url":1899},{"type":1558,"url":3867},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1558,"url":3869},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1558,"url":3871},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1558,"url":3873},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1566,"url":1905},{"type":1558,"url":1907},[1909,1910,1911,1912,1913,1914],{"id":197,"slug":3878,"dossier":47,"summary":3879,"aliases":3880,"sourceIds":3884,"published":3885,"modified":3886,"checkedAt":7,"severity":3887,"references":3890,"versionKeys":3899,"packageCount":32,"repositoryCount":391},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3881,3882,3883],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[197,3883],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3888,3889],{"type":1554,"score":2450},{"type":1593,"score":1677},[3891,3893,3895,3897,3898],{"type":1702,"url":3892},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1561,"url":3894},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1601,"url":3896},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1566,"url":1567},{"type":1561,"url":1569},[1576,1577,1578,1579,1580],{"id":198,"slug":3901,"dossier":47,"summary":3902,"aliases":3903,"sourceIds":3906,"published":3907,"modified":3908,"checkedAt":7,"severity":3909,"references":3912,"versionKeys":3929,"packageCount":32,"repositoryCount":313},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3904,3905],"CVE-2025-27516","PYSEC-2026-1471",[198,3905],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3910],{"type":1554,"score":3911},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3913,3915,3917,3919,3921,3923,3925,3927],{"type":1558,"url":3914},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1561,"url":3916},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1601,"url":3918},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1566,"url":3920},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1558,"url":3922},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1558,"url":3924},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1566,"url":3926},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1561,"url":3928},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3930,3931],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":199,"slug":3933,"dossier":47,"summary":3934,"aliases":3935,"sourceIds":3938,"published":3939,"modified":3940,"checkedAt":7,"severity":3941,"references":3943,"versionKeys":3954,"packageCount":32,"repositoryCount":381},"ghsa-cw65-gx24-rc82-d2d30a51","virtualenv: Builtin creation follows linked environment directories",[3936,3937],"BIT-virtualenv-2026-113716","CVE-2026-113716",[199],"2026-10-21T21:35:56Z","2026-10-29T10:55:59.838026441Z",[3942],{"type":1593,"score":1976},[3944,3946,3948,3950,3952,3953],{"type":1558,"url":3945},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-cw65-gx24-rc82",{"type":1561,"url":3947},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113716",{"type":1558,"url":3949},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3429",{"type":1558,"url":3951},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F554d9f9d4f7758f5cf53f993031e29787f1f74c5",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":200,"slug":3956,"dossier":47,"summary":3957,"aliases":3958,"sourceIds":3960,"published":3961,"modified":3962,"checkedAt":7,"severity":3963,"references":3965,"versionKeys":3974,"packageCount":32,"repositoryCount":401},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3959],"CVE-2026-112915",[200],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3964],{"type":1593,"score":2616},[3966,3968,3970,3971,3972,3973],{"type":1558,"url":3967},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1561,"url":3969},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1558,"url":3625},{"type":1558,"url":3627},{"type":1566,"url":2379},{"type":1558,"url":2381},[2383,2384,2385,2386],{"id":201,"slug":3976,"dossier":47,"summary":3977,"aliases":3978,"sourceIds":3981,"published":3982,"modified":3983,"checkedAt":7,"severity":3984,"references":3986,"versionKeys":3995,"packageCount":32,"repositoryCount":381},"ghsa-cx28-75q4-x26q-bb017595","virtualenv: Pip seeding with download omits wheel digest verification",[3979,3980],"BIT-virtualenv-2026-113717","CVE-2026-113717",[201],"2026-10-23T22:26:04Z","2026-10-29T10:55:56.839709622Z",[3985],{"type":1554,"score":2101},[3987,3989,3991,3992,3993,3994],{"type":1558,"url":3988},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-cx28-75q4-x26q",{"type":1561,"url":3990},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113717",{"type":1558,"url":2108},{"type":1558,"url":2110},{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":202,"slug":3997,"dossier":47,"summary":3998,"aliases":3999,"sourceIds":4002,"published":4003,"modified":4004,"checkedAt":7,"severity":4005,"references":4008,"versionKeys":4019,"packageCount":32,"repositoryCount":371},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[4000,4001],"CVE-2026-49854","PYSEC-2026-3388",[202,4001],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[4006],{"type":1593,"score":4007},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[4009,4011,4012,4014,4015,4017],{"type":1558,"url":4010},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1566,"url":1905},{"type":1558,"url":4013},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1566,"url":1959},{"type":1561,"url":4016},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1561,"url":4018},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1909,1910,1911,1912,1913],{"id":203,"slug":4021,"dossier":47,"summary":4022,"aliases":4023,"sourceIds":4026,"published":4027,"modified":4028,"checkedAt":7,"severity":4029,"references":4031,"versionKeys":4040,"packageCount":32,"repositoryCount":1581},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[4024,4025],"BIT-pillow-2026-112406","CVE-2026-112406",[203],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[4030],{"type":1554,"score":2450},[4032,4034,4036,4038,4039],{"type":1558,"url":4033},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1561,"url":4035},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1558,"url":4037},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":204,"slug":4042,"dossier":47,"summary":4043,"aliases":4044,"sourceIds":4047,"published":4048,"modified":4049,"checkedAt":7,"severity":4050,"references":4053,"versionKeys":4064,"packageCount":32,"repositoryCount":381},"ghsa-fc2g-4w5p-6whm-f875e0d2","virtualenv: Seeded files retain permissions from an older cache",[4045,4046],"BIT-virtualenv-2026-113720","CVE-2026-113720",[204],"2026-10-23T22:23:11Z","2026-10-29T10:55:56.743073990Z",[4051],{"type":1554,"score":4052},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[4054,4056,4058,4060,4062,4063],{"type":1558,"url":4055},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-fc2g-4w5p-6whm",{"type":1561,"url":4057},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113720",{"type":1558,"url":4059},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3425",{"type":1558,"url":4061},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F35f0b33562790176dd186d0a3c517af3acc7a0e1",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":205,"slug":4066,"dossier":47,"summary":4067,"aliases":4068,"sourceIds":4071,"published":4072,"modified":4073,"checkedAt":7,"severity":4074,"references":4076,"versionKeys":4084,"packageCount":32,"repositoryCount":1581},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[4069,4070],"BIT-pillow-2026-112891","CVE-2026-112891",[205],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[4075],{"type":1554,"score":2742},[4077,4079,4081,4082,4083],{"type":1558,"url":4078},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1561,"url":4080},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1558,"url":2993},{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":206,"slug":4086,"dossier":47,"summary":4087,"aliases":4088,"sourceIds":4091,"published":4092,"modified":4093,"checkedAt":7,"severity":4094,"references":4096,"versionKeys":4107,"packageCount":32,"repositoryCount":313},"ghsa-ffq3-xpv3-j92q-22580948","Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions",[4089,4090],"CVE-2026-59928","PYSEC-2026-2216",[206,4090],"2026-07-08T17:17:28.600Z","2026-07-20T21:30:38.320453360Z",[4095],{"type":1593,"score":1677},[4097,4099,4101,4103,4104,4105],{"type":1702,"url":4098},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-ffq3-xpv3-j92q",{"type":1561,"url":4100},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59928",{"type":1601,"url":4102},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fcommit\u002F2b04d7ba341c16ac78fe82d3076bdd5c3de87c69",{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":4106},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2216.yaml",[1715,1716],{"id":207,"slug":4109,"dossier":47,"summary":4110,"aliases":4111,"sourceIds":4115,"published":4116,"modified":4117,"checkedAt":7,"severity":4118,"references":4121,"versionKeys":4135,"packageCount":32,"repositoryCount":2041},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[4112,4113,4114],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[207,4114],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[4119],{"type":1593,"score":4120},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[4122,4124,4126,4128,4130,4131,4132,4133],{"type":1558,"url":4123},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1561,"url":4125},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1558,"url":4127},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1558,"url":4129},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1566,"url":1567},{"type":1558,"url":2659},{"type":1566,"url":2661},{"type":1561,"url":4134},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":208,"slug":4137,"dossier":47,"summary":4138,"aliases":4139,"sourceIds":4141,"published":4142,"modified":4143,"checkedAt":7,"severity":4144,"references":4147,"versionKeys":4158,"packageCount":32,"repositoryCount":401},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[4140],"CVE-2026-112935",[208],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[4145],{"type":1593,"score":4146},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4148,4150,4152,4154,4156,4157],{"type":1558,"url":4149},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1561,"url":4151},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1558,"url":4153},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1558,"url":4155},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1566,"url":2379},{"type":1558,"url":2381},[2383,2384,2385,2386],{"id":209,"slug":4160,"dossier":47,"summary":4161,"aliases":4162,"sourceIds":4166,"published":4167,"modified":4168,"checkedAt":7,"severity":4169,"references":4172,"versionKeys":4183,"packageCount":32,"repositoryCount":351},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[4163,4164,4165],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[209,4165],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[4170,4171],{"type":1554,"score":1927},{"type":1593,"score":1629},[4173,4175,4177,4179,4181,4182],{"type":1561,"url":4174},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1561,"url":4176},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1935,"url":4178},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1601,"url":4180},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1566,"url":1567},{"type":1561,"url":1569},[1573,1574,1575,1576,1577,1578,1579,1580],{"id":210,"slug":4185,"dossier":47,"summary":4186,"aliases":4187,"sourceIds":4190,"published":4191,"modified":4192,"checkedAt":7,"severity":4193,"references":4196,"versionKeys":4207,"packageCount":32,"repositoryCount":1581},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[4188,4189],"BIT-pillow-2026-96778","CVE-2026-96778",[210],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[4194],{"type":1554,"score":4195},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4197,4199,4201,4203,4205,4206],{"type":1558,"url":4198},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1561,"url":4200},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1558,"url":4202},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1558,"url":4204},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":211,"slug":4209,"dossier":47,"summary":4210,"aliases":4211,"sourceIds":4214,"published":4215,"modified":4216,"checkedAt":7,"severity":4217,"references":4220,"versionKeys":4239,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[4212,4213],"CVE-2024-34062","PYSEC-2026-1976",[211,4213],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[4218],{"type":1593,"score":4219},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4221,4223,4225,4227,4229,4231,4233,4235,4237],{"type":1558,"url":4222},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1561,"url":4224},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1558,"url":4226},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1566,"url":4228},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1558,"url":4230},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1558,"url":4232},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1558,"url":4234},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1566,"url":4236},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1561,"url":4238},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[4240],"pypi:tqdm@4.66.2",{"id":212,"slug":4242,"dossier":47,"summary":4243,"aliases":4244,"sourceIds":4248,"published":4249,"modified":4250,"checkedAt":7,"severity":4251,"references":4254,"versionKeys":4265,"packageCount":32,"repositoryCount":1581},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[4245,4246,4247],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[212,4247],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[4252,4253],{"type":1554,"score":1927},{"type":1593,"score":1629},[4255,4257,4259,4261,4263,4264],{"type":1561,"url":4256},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1561,"url":4258},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1935,"url":4260},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1601,"url":4262},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":213,"slug":4267,"dossier":47,"summary":4268,"aliases":4269,"sourceIds":4272,"published":4273,"modified":4274,"checkedAt":7,"severity":4275,"references":4279,"versionKeys":4289,"packageCount":32,"repositoryCount":313},"ghsa-g97x-gvcm-x72h-ff087202","Mistune: XSS via unescaped class option in Admonition directive",[4270,4271],"CVE-2026-59926","PYSEC-2026-2214",[213,4271],"2026-07-08T17:17:28.323Z","2026-07-20T21:46:40.083797845Z",[4276,4278],{"type":1554,"score":4277},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:L\u002FSI:L\u002FSA:N",{"type":1593,"score":2398},[4280,4282,4284,4285,4286,4287],{"type":1561,"url":4281},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-g97x-gvcm-x72h",{"type":1561,"url":4283},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59926",{"type":1601,"url":2407},{"type":1566,"url":1709},{"type":1561,"url":3312},{"type":1558,"url":4288},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2214.yaml",[1715,1716],{"id":214,"slug":4291,"dossier":47,"summary":4292,"aliases":4293,"sourceIds":4296,"published":4297,"modified":4298,"checkedAt":7,"severity":4299,"references":4304,"versionKeys":4314,"packageCount":32,"repositoryCount":1581},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[4294,4295],"CVE-2026-25645","PYSEC-2026-2275",[214,4295],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[4300,4302],{"type":1593,"score":4301},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1593,"score":4303},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4305,4307,4309,4311,4312],{"type":1561,"url":4306},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1561,"url":4308},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1601,"url":4310},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1566,"url":3544},{"type":1561,"url":4313},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3556,3557,4315,4316],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":215,"slug":4318,"dossier":47,"summary":4319,"aliases":4320,"sourceIds":4323,"published":4324,"modified":4325,"checkedAt":7,"severity":4326,"references":4328,"versionKeys":4337,"packageCount":32,"repositoryCount":1581},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[4321,4322],"BIT-pillow-2026-112892","CVE-2026-112892",[215],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[4327],{"type":1554,"score":2450},[4329,4331,4333,4335,4336],{"type":1558,"url":4330},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1561,"url":4332},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1558,"url":4334},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":216,"slug":4339,"dossier":47,"summary":4340,"aliases":4341,"sourceIds":4344,"published":4345,"modified":4346,"checkedAt":7,"severity":4347,"references":4349,"versionKeys":4361,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[4342,4343],"CVE-2026-97688","PYSEC-2026-4176",[216,4343],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[4348],{"type":1554,"score":2742},[4350,4352,4354,4356,4357,4358,4359],{"type":1558,"url":4351},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1561,"url":4353},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1558,"url":4355},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1566,"url":1769},{"type":1558,"url":3242},{"type":1566,"url":1771},{"type":1561,"url":4360},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[3247,3248],{"id":217,"slug":4363,"dossier":47,"summary":4364,"aliases":4365,"sourceIds":4366,"published":4367,"modified":4368,"checkedAt":7,"severity":4369,"references":4371,"versionKeys":4377,"packageCount":32,"repositoryCount":313},"ghsa-gj48-438w-jh9v-02216692","Bleach clean() \u002F Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes",[],[217],"2026-06-16T14:07:49Z","2026-09-10T03:50:49.646625202Z",[4370],{"type":1593,"score":2398},[4372,4374,4375],{"type":1558,"url":4373},"https:\u002F\u002Fgithub.com\u002Fmozilla\u002Fbleach\u002Fsecurity\u002Fadvisories\u002FGHSA-gj48-438w-jh9v",{"type":1566,"url":3396},{"type":1558,"url":4376},"https:\u002F\u002Fgithub.com\u002Fmozilla\u002Fbleach\u002Freleases\u002Ftag\u002Fv6.4.0",[3398],{"id":218,"slug":4379,"dossier":47,"summary":4380,"aliases":4381,"sourceIds":4384,"published":4385,"modified":4386,"checkedAt":7,"severity":4387,"references":4389,"versionKeys":4402,"packageCount":32,"repositoryCount":391},"ghsa-gjv8-xp57-g29c-0bfb5cb1","Soup Sieve: Polynomial-time ReDoS (O(n²)) in the `IDENTIFIER` \u002F `VALUE` selector sub-patterns",[4382,4383],"CVE-2026-86000","PYSEC-2026-4170",[218,4383],"2026-09-17T20:32:58Z","2026-10-01T17:56:08.291385035Z",[4388],{"type":1593,"score":1894},[4390,4392,4394,4396,4397,4399,4400],{"type":1558,"url":4391},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-gjv8-xp57-g29c",{"type":1561,"url":4393},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-86000",{"type":1558,"url":4395},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002Fce44e4996e6632871c18cdd7a7fb641be8ef34ef",{"type":1566,"url":1732},{"type":1558,"url":4398},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Freleases\u002Ftag\u002F2.9",{"type":1566,"url":1734},{"type":1561,"url":4401},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gjv8-xp57-g29c",[1740,1741,1742,2183],{"id":219,"slug":4404,"dossier":47,"summary":4405,"aliases":4406,"sourceIds":4409,"published":4410,"modified":4411,"checkedAt":7,"severity":4412,"references":4414,"versionKeys":4425,"packageCount":32,"repositoryCount":351},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[4407,4408],"CVE-2025-66418","PYSEC-2026-1998",[219,4408],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[4413],{"type":1554,"score":1754},[4415,4417,4419,4421,4422,4423],{"type":1558,"url":4416},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1561,"url":4418},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1601,"url":4420},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1566,"url":1769},{"type":1566,"url":1771},{"type":1561,"url":4424},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1773,1774,1775,1776,1777],{"id":220,"slug":4427,"dossier":47,"summary":4428,"aliases":4429,"sourceIds":4432,"published":4433,"modified":4434,"checkedAt":7,"severity":4435,"references":4439,"versionKeys":4454,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[4430,4431],"CVE-2024-56201","PYSEC-2026-1472",[220,4431],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[4436,4438],{"type":1593,"score":4437},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1554,"score":3911},[4440,4442,4444,4446,4448,4449,4451,4452],{"type":1558,"url":4441},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1561,"url":4443},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1558,"url":4445},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1601,"url":4447},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1566,"url":3920},{"type":1558,"url":4450},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1566,"url":3926},{"type":1561,"url":4453},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3930],{"id":221,"slug":4456,"dossier":47,"summary":4457,"aliases":4458,"sourceIds":4461,"published":4462,"modified":4463,"checkedAt":7,"severity":4464,"references":4466,"versionKeys":4487,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[4459,4460],"CVE-2024-34064","PYSEC-2026-1474",[221,4460],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[4465],{"type":1593,"score":3041},[4467,4469,4471,4473,4474,4476,4478,4480,4482,4484,4485],{"type":1558,"url":4468},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1561,"url":4470},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1601,"url":4472},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1566,"url":3920},{"type":1558,"url":4475},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1558,"url":4477},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1558,"url":4479},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1558,"url":4481},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1558,"url":4483},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1566,"url":3926},{"type":1561,"url":4486},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3930],{"id":222,"slug":4489,"dossier":47,"summary":4490,"aliases":4491,"sourceIds":4493,"published":4494,"modified":4495,"checkedAt":7,"severity":4496,"references":4497,"versionKeys":4507,"packageCount":32,"repositoryCount":313},"ghsa-h7ww-273w-6cm8-3b54069e","Mistune: Path Traversal and XSS in Include directive",[4492],"CVE-2026-115355",[222],"2026-10-23T20:46:47Z","2026-10-23T21:00:06.308204078Z",[],[4498,4500,4502,4503,4504,4505],{"type":1558,"url":4499},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-h7ww-273w-6cm8",{"type":1561,"url":4501},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115355",{"type":1558,"url":3355},{"type":1566,"url":1709},{"type":1558,"url":1711},{"type":1558,"url":4506},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fmistune-before-3.3.0-path-traversal-and-xss-via-include-directive",[1715,1716],{"id":223,"slug":4509,"dossier":47,"summary":4510,"aliases":4511,"sourceIds":4514,"published":4515,"modified":4516,"checkedAt":7,"severity":4517,"references":4519,"versionKeys":4530,"packageCount":32,"repositoryCount":381},"ghsa-hhxq-47xx-j5xx-b7469e94","virtualenv: Seed replacement does not contain metadata deletion paths",[4512,4513],"BIT-virtualenv-2026-113719","CVE-2026-113719",[223],"2026-10-23T22:19:15Z","2026-10-29T10:56:02.747342068Z",[4518],{"type":1593,"score":1976},[4520,4522,4524,4526,4528,4529],{"type":1558,"url":4521},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-hhxq-47xx-j5xx",{"type":1561,"url":4523},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113719",{"type":1558,"url":4525},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3428",{"type":1558,"url":4527},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fe3cea6fa10a50fa29cf1fdddd772458fba076d5f",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":224,"slug":4532,"dossier":47,"summary":4533,"aliases":4534,"sourceIds":4537,"published":4538,"modified":4539,"checkedAt":7,"severity":4540,"references":4542,"versionKeys":4551,"packageCount":32,"repositoryCount":1581},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4535,4536],"BIT-pillow-2026-112893","CVE-2026-112893",[224],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4541],{"type":1554,"score":1555},[4543,4545,4547,4549,4550],{"type":1558,"url":4544},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1561,"url":4546},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1558,"url":4548},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":225,"slug":4553,"dossier":47,"summary":4554,"aliases":4555,"sourceIds":4557,"published":4558,"modified":4559,"checkedAt":7,"severity":4560,"references":4563,"versionKeys":4573,"packageCount":32,"repositoryCount":401},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4556],"CVE-2026-112936",[225],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4561],{"type":1593,"score":4562},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4564,4566,4568,4570,4571],{"type":1558,"url":4565},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1561,"url":4567},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1558,"url":4569},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1566,"url":2379},{"type":1558,"url":4572},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[2383,2384,2385,2386],{"id":226,"slug":4575,"dossier":47,"summary":4576,"aliases":4577,"sourceIds":4580,"published":4581,"modified":4582,"checkedAt":7,"severity":4583,"references":4585,"versionKeys":4597,"packageCount":32,"repositoryCount":391},"ghsa-j934-xhv5-fg8f-f3395fba","Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace\u002Fcomment trimming regex `RE_WS_END` (triggers on VALID selectors)",[4578,4579],"CVE-2026-85999","PYSEC-2026-4171",[226,4579],"2026-09-17T20:32:53Z","2026-10-01T17:56:03.541286563Z",[4584],{"type":1593,"score":1894},[4586,4588,4590,4592,4593,4594,4595],{"type":1558,"url":4587},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-j934-xhv5-fg8f",{"type":1561,"url":4589},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-85999",{"type":1558,"url":4591},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002Fcf198fcddc9230f06ed39f974eba0ce076b85cda",{"type":1566,"url":1732},{"type":1558,"url":4398},{"type":1566,"url":1734},{"type":1561,"url":4596},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-j934-xhv5-fg8f",[1740,1741,1742,2183],{"id":227,"slug":4599,"dossier":47,"summary":4600,"aliases":4601,"sourceIds":4604,"published":4605,"modified":4606,"checkedAt":7,"severity":4607,"references":4609,"versionKeys":4618,"packageCount":32,"repositoryCount":1581},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4602,4603],"BIT-pillow-2026-112894","CVE-2026-112894",[227],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4608],{"type":1554,"score":2450},[4610,4612,4614,4616,4617],{"type":1558,"url":4611},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1561,"url":4613},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1558,"url":4615},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":228,"slug":4620,"dossier":47,"summary":4621,"aliases":4622,"sourceIds":4625,"published":4626,"modified":4627,"checkedAt":7,"severity":4628,"references":4630,"versionKeys":4640,"packageCount":32,"repositoryCount":3796},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[4623,4624],"CVE-2025-67726","PYSEC-2025-267",[228,4624],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[4629],{"type":1593,"score":1677},[4631,4633,4635,4636,4638,4639],{"type":1561,"url":4632},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1561,"url":4634},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1601,"url":3789},{"type":1558,"url":4637},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1566,"url":1905},{"type":1561,"url":3794},[1909,1910,1911],{"id":229,"slug":4642,"dossier":47,"summary":4643,"aliases":4644,"sourceIds":4648,"published":4649,"modified":4650,"checkedAt":7,"severity":4651,"references":4653,"versionKeys":4667,"packageCount":32,"repositoryCount":2041},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4645,4646,4647],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[229,4647],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4652],{"type":1593,"score":1677},[4654,4656,4658,4660,4662,4663,4664,4665],{"type":1558,"url":4655},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1561,"url":4657},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1558,"url":4659},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1558,"url":4661},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1566,"url":1567},{"type":1558,"url":2659},{"type":1566,"url":2661},{"type":1561,"url":4666},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":230,"slug":4669,"dossier":47,"summary":4670,"aliases":4671,"sourceIds":4674,"published":4675,"modified":4676,"checkedAt":7,"severity":4677,"references":4680,"versionKeys":4693,"packageCount":32,"repositoryCount":421},"ghsa-jp4c-xjxw-mgf9-e780c8d6","pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere",[4672,4673],"CVE-2026-6357","PYSEC-2026-2876",[230,4673],"2026-04-27T15:30:52Z","2026-09-10T03:50:44.656580653Z",[4678],{"type":1554,"score":4679},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:H\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4681,4683,4685,4687,4688,4690,4691],{"type":1561,"url":4682},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-6357",{"type":1558,"url":4684},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F13923",{"type":1558,"url":4686},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fcommit\u002Fb369bfc96cc524e00c267e1693290e6599c36bad",{"type":1566,"url":2282},{"type":1558,"url":4689},"https:\u002F\u002Fichard26.github.io\u002Fblog\u002F2026\u002F04\u002Fwhats-new-in-pip-26.1\u002F#security-fixes",{"type":1566,"url":2290},{"type":1561,"url":4692},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jp4c-xjxw-mgf9",[2294,2295],{"id":231,"slug":4695,"dossier":47,"summary":4696,"aliases":4697,"sourceIds":4700,"published":4701,"modified":4702,"checkedAt":7,"severity":4703,"references":4708,"versionKeys":4721,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[4698,4699],"CVE-2024-5206","PYSEC-2024-110",[231,4699],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[4704,4706],{"type":1593,"score":4705},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1593,"score":4707},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4709,4711,4713,4715,4717,4719],{"type":1561,"url":4710},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1601,"url":4712},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1558,"url":4714},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1566,"url":4716},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1558,"url":4718},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1561,"url":4720},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[4722],"pypi:scikit-learn@1.3.2",{"id":232,"slug":4724,"dossier":47,"summary":4725,"aliases":4726,"sourceIds":4729,"published":4730,"modified":4731,"checkedAt":7,"severity":4732,"references":4735,"versionKeys":4743,"packageCount":32,"repositoryCount":421},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4727,4728],"CVE-2026-44432","PYSEC-2026-142",[232,4728],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4733,4734],{"type":1593,"score":1677},{"type":1554,"score":1754},[4736,4738,4740,4742],{"type":1561,"url":4737},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1561,"url":4739},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1558,"url":4741},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1566,"url":1769},[3247],{"id":233,"slug":4745,"dossier":47,"summary":4746,"aliases":4747,"sourceIds":4750,"published":4751,"modified":4752,"checkedAt":7,"severity":4753,"references":4756,"versionKeys":4769,"packageCount":32,"repositoryCount":2634},"ghsa-mf9w-mj56-hr94-a492e0f4","python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback",[4748,4749],"CVE-2026-28684","PYSEC-2026-2270",[233,4749],"2026-04-20T17:16:33.087Z","2026-09-10T03:51:02.363430883Z",[4754],{"type":1593,"score":4755},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[4757,4759,4761,4763,4765,4767],{"type":1601,"url":4758},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9w-mj56-hr94",{"type":1561,"url":4760},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28684",{"type":1601,"url":4762},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311",{"type":1558,"url":4764},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311.patch",{"type":1566,"url":4766},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv",{"type":1561,"url":4768},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Freleases\u002Ftag\u002Fv1.2.2",[4770,4771,4772,4773],"pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1",{"id":234,"slug":4775,"dossier":47,"summary":4776,"aliases":4777,"sourceIds":4780,"published":4781,"modified":4782,"checkedAt":7,"severity":4783,"references":4785,"versionKeys":4794,"packageCount":32,"repositoryCount":371},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[4778,4779],"CVE-2026-49855","PYSEC-2026-3389",[234,4779],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[4784],{"type":1593,"score":1677},[4786,4788,4789,4790,4792],{"type":1558,"url":4787},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1566,"url":1905},{"type":1566,"url":1959},{"type":1561,"url":4791},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1561,"url":4793},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1909,1910,1911,1912,1913],{"id":235,"slug":4796,"dossier":47,"summary":4797,"aliases":4798,"sourceIds":4800,"published":4801,"modified":4802,"checkedAt":7,"severity":4803,"references":4805,"versionKeys":4817,"packageCount":32,"repositoryCount":371},"ghsa-mmhr-3c5m-f64f-7eb4b3d2","Soup Sieve: Polynomial-time denial of service in the descendant combinator",[4799],"CVE-2026-126190",[235],"2026-11-13T00:49:46Z","2026-11-13T01:00:06.052455117Z",[4804],{"type":1593,"score":1677},[4806,4808,4810,4812,4814,4815],{"type":1558,"url":4807},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fsecurity\u002Fadvisories\u002FGHSA-mmhr-3c5m-f64f",{"type":1561,"url":4809},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126190",{"type":1558,"url":4811},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fpull\u002F351",{"type":1558,"url":4813},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Fcommit\u002Fff1a5ce7e5addc31626d7b6053511fecdb4f6320",{"type":1566,"url":1732},{"type":1558,"url":4816},"https:\u002F\u002Fgithub.com\u002Ffacelessuser\u002Fsoupsieve\u002Freleases\u002Ftag\u002F4.0",[1740,1741,1742,2183,2184,4818,4819],"pypi:soupsieve@3.0.3","pypi:soupsieve@3.0.4",{"id":236,"slug":4821,"dossier":47,"summary":4822,"aliases":4823,"sourceIds":4826,"published":4827,"modified":4828,"checkedAt":7,"severity":4829,"references":4831,"versionKeys":4844,"packageCount":32,"repositoryCount":66},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[4824,4825],"CVE-2026-82397","PYSEC-2026-3928",[236,4825],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[4830],{"type":1593,"score":1677},[4832,4834,4836,4837,4839,4840,4841,4842],{"type":1558,"url":4833},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1561,"url":4835},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1558,"url":3208},{"type":1558,"url":4838},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1566,"url":1905},{"type":1558,"url":3215},{"type":1566,"url":1959},{"type":1561,"url":4843},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1909,1910,1911,1912,1913,1914],{"id":237,"slug":4846,"dossier":47,"summary":4847,"aliases":4848,"sourceIds":4851,"published":4852,"modified":4853,"checkedAt":7,"severity":4854,"references":4860,"versionKeys":4887,"packageCount":32,"repositoryCount":32},"ghsa-mq26-g339-26xf-ed024c7e","Command Injection in pip when used with Mercurial",[4849,4850],"CVE-2023-5752","PYSEC-2023-228",[237,4850],"2023-10-25T18:17:00Z","2026-09-10T03:50:03.949904915Z",[4855,4856,4858],{"type":1593,"score":4303},{"type":1554,"score":4857},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":4859},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[4861,4863,4865,4867,4869,4870,4871,4873,4875,4877,4879,4881,4883,4885],{"type":1561,"url":4862},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2023-5752",{"type":1601,"url":4864},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F12306",{"type":1558,"url":4866},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fcommit\u002F389cb799d0da9a840749fcd14878928467ed49b4",{"type":1558,"url":4868},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpip\u002FPYSEC-2023-228.yaml",{"type":1566,"url":2282},{"type":1558,"url":2284},{"type":1558,"url":4872},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F622OZXWG72ISQPLM5Y57YCVIMWHD4C3U",{"type":1558,"url":4874},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F65UKKF5LBHEFDCUSPBHUN4IHYX7SRMHH",{"type":1558,"url":4876},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FFXUVMJM25PUAZRQZBF54OFVKTY3MINPW",{"type":1558,"url":4878},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FKFC2SPFG5FLCZBYY2K3T5MFW2D22NG6E",{"type":1558,"url":4880},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FYBSB3SUPQ3VIFYUMHPO3MEQI4BJAXKCZ",{"type":1558,"url":4882},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FF4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL",{"type":1561,"url":4884},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FF4PL35U6X4VVHZ5ILJU3PWUWN7H7LZXL\u002F",{"type":1561,"url":4886},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mq26-g339-26xf",[2294],{"id":238,"slug":4889,"dossier":47,"summary":4890,"aliases":4891,"sourceIds":4894,"published":4895,"modified":4896,"checkedAt":7,"severity":4897,"references":4899,"versionKeys":4910,"packageCount":32,"repositoryCount":1581},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[4892,4893],"BIT-pillow-2026-96640","CVE-2026-96640",[238],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[4898],{"type":1554,"score":1555},[4900,4902,4904,4906,4908,4909],{"type":1558,"url":4901},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1561,"url":4903},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1558,"url":4905},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1558,"url":4907},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":239,"slug":4912,"dossier":47,"summary":4913,"aliases":4914,"sourceIds":4917,"published":4918,"modified":4919,"checkedAt":7,"severity":4920,"references":4922,"versionKeys":4931,"packageCount":32,"repositoryCount":1581},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[4915,4916],"BIT-pillow-2026-112895","CVE-2026-112895",[239],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[4921],{"type":1554,"score":2450},[4923,4925,4927,4929,4930],{"type":1558,"url":4924},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1561,"url":4926},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1558,"url":4928},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":240,"slug":4933,"dossier":47,"summary":4934,"aliases":4935,"sourceIds":4939,"published":4940,"modified":4941,"checkedAt":7,"severity":4942,"references":4944,"versionKeys":4959,"packageCount":32,"repositoryCount":381},"ghsa-p58f-9548-mpm2-3c2c8280","virtualenv bash and fish activation scripts execute commands embedded in paths",[4936,4937,4938],"BIT-virtualenv-2026-102925","CVE-2026-102925","PYSEC-2026-4013",[240,4938],"2026-09-18T04:37:14Z","2026-10-06T15:25:40.633713827Z",[4943],{"type":1593,"score":2523},[4945,4947,4949,4951,4953,4955,4956,4958],{"type":1558,"url":4946},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-p58f-9548-mpm2",{"type":1561,"url":4948},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102925",{"type":1558,"url":4950},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3252",{"type":1601,"url":4952},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002F4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6",{"type":1558,"url":4954},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvirtualenv\u002FPYSEC-2026-4013.yaml",{"type":1566,"url":1875},{"type":1558,"url":4957},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.7.13",{"type":1566,"url":2485},[1879,1880,1881,1882,1883],{"id":241,"slug":4961,"dossier":47,"summary":4962,"aliases":4963,"sourceIds":4967,"published":4968,"modified":4969,"checkedAt":7,"severity":4970,"references":4972,"versionKeys":4982,"packageCount":32,"repositoryCount":1581},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[4964,4965,4966],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[241,4966],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[4971],{"type":1593,"score":1629},[4973,4975,4977,4979,4980,4981],{"type":1561,"url":4974},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1561,"url":4976},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1935,"url":4978},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1601,"url":2600},{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":242,"slug":4984,"dossier":47,"summary":4985,"aliases":4986,"sourceIds":4988,"published":4989,"modified":4990,"checkedAt":7,"severity":4991,"references":4993,"versionKeys":5005,"packageCount":32,"repositoryCount":66},"ghsa-pcg2-g6cj-q92c-613600e5","Tornado: Quadratic CPU usage when parsing HTTP headers with line folding",[4987],"CVE-2026-116577",[242],"2026-10-28T22:43:41Z","2026-10-28T23:00:04.070057045Z",[4992],{"type":1593,"score":1894},[4994,4996,4998,5000,5002,5003],{"type":1558,"url":4995},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pcg2-g6cj-q92c",{"type":1561,"url":4997},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116577",{"type":1558,"url":4999},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3765",{"type":1558,"url":5001},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F1b7a1dc9f340f52de929852e8125aa12f25297c9",{"type":1566,"url":1905},{"type":1558,"url":5004},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.0",[1909,1910,1911,1912,1913,1914],{"id":243,"slug":5007,"dossier":47,"summary":5008,"aliases":5009,"sourceIds":5013,"published":5014,"modified":5015,"checkedAt":7,"severity":5016,"references":5020,"versionKeys":5029,"packageCount":32,"repositoryCount":1581},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[5010,5011,5012],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[243,5012],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[5017,5018],{"type":1554,"score":3694},{"type":1593,"score":5019},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5021,5023,5025,5027,5028],{"type":1702,"url":5022},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1561,"url":5024},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1601,"url":5026},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":244,"slug":5031,"dossier":47,"summary":5032,"aliases":5033,"sourceIds":5037,"published":5038,"modified":5039,"checkedAt":7,"severity":5040,"references":5043,"versionKeys":5056,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[5034,5035,5036],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[244,5036],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[5041,5042],{"type":1593,"score":1894},{"type":1593,"score":1677},[5044,5046,5048,5050,5052,5054,5055],{"type":1702,"url":5045},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1561,"url":5047},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1601,"url":5049},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1601,"url":5051},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1558,"url":5053},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1566,"url":1567},{"type":1561,"url":2659},[1576,1577,1578,1579],{"id":245,"slug":5058,"dossier":47,"summary":5059,"aliases":5060,"sourceIds":5064,"published":5065,"modified":5066,"checkedAt":7,"severity":5067,"references":5069,"versionKeys":5080,"packageCount":32,"repositoryCount":2041},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[5061,5062,5063],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[245,5063],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[5068],{"type":1593,"score":1677},[5070,5072,5074,5076,5078,5079],{"type":1702,"url":5071},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1561,"url":5073},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1601,"url":5075},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1558,"url":5077},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1566,"url":1567},{"type":1561,"url":2039},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":246,"slug":5082,"dossier":47,"summary":5083,"aliases":5084,"sourceIds":5086,"published":5087,"modified":5088,"checkedAt":7,"severity":5089,"references":5092,"versionKeys":5102,"packageCount":32,"repositoryCount":421},"ghsa-pjvx-prjx-h659-d3998e6c","nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc",[5085],"CVE-2026-114140",[246],"2026-10-22T16:23:28Z","2026-10-22T16:30:41.002101482Z",[5090],{"type":1554,"score":5091},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:H\u002FSI:H\u002FSA:H",[5093,5095,5097,5099,5100],{"type":1558,"url":5094},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fsecurity\u002Fadvisories\u002FGHSA-pjvx-prjx-h659",{"type":1561,"url":5096},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114140",{"type":1558,"url":5098},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fcommit\u002Fce4bd99aec31d81d759fa8eeb8643179392ec66f",{"type":1566,"url":2132},{"type":1558,"url":5101},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Freleases\u002Ftag\u002Fv7.17.2",[2136,5103],"pypi:nbconvert@7.17.1",{"id":247,"slug":5105,"dossier":47,"summary":5106,"aliases":5107,"sourceIds":5110,"published":5111,"modified":5112,"checkedAt":7,"severity":5113,"references":5115,"versionKeys":5127,"packageCount":32,"repositoryCount":381},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[5108,5109],"CVE-2025-50181","PYSEC-2026-1999",[247,5109],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[5114],{"type":1593,"score":2075},[5116,5118,5120,5122,5123,5124,5125],{"type":1558,"url":5117},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1561,"url":5119},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1601,"url":5121},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1566,"url":1769},{"type":1558,"url":2085},{"type":1566,"url":1771},{"type":1561,"url":5126},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1773,1774,1775,1776],{"id":248,"slug":5129,"dossier":47,"summary":5130,"aliases":5131,"sourceIds":5134,"published":5135,"modified":5136,"checkedAt":7,"severity":5137,"references":5140,"versionKeys":5151,"packageCount":32,"repositoryCount":3796},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[5132,5133],"CVE-2025-67724","PYSEC-2025-265",[248,5133],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[5138,5139],{"type":1593,"score":3041},{"type":1593,"score":2398},[5141,5143,5145,5147,5149,5150],{"type":1561,"url":5142},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1561,"url":5144},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1601,"url":5146},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1558,"url":5148},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1566,"url":1905},{"type":1561,"url":3794},[1909,1910,1911],{"id":249,"slug":5153,"dossier":47,"summary":5154,"aliases":5155,"sourceIds":5157,"published":5158,"modified":5159,"checkedAt":7,"severity":5160,"references":5163,"versionKeys":5167,"packageCount":32,"repositoryCount":371},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[5156],"CVE-2026-91992",[249],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[5161],{"type":1593,"score":5162},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[5164,5166],{"type":1558,"url":5165},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1566,"url":1905},[1909,1910,1911,1912,1913],{"id":250,"slug":5169,"dossier":47,"summary":5170,"aliases":5171,"sourceIds":5173,"published":5174,"modified":5175,"checkedAt":7,"severity":5176,"references":5179,"versionKeys":5194,"packageCount":32,"repositoryCount":66},"ghsa-pw9p-v7r6-gx4p-86e36276","Tornado: Open redirect in RedirectHandler via protocol-relative URLs",[5172],"CVE-2026-116578",[250],"2026-10-28T22:43:45Z","2026-10-28T23:00:04.066537287Z",[5177],{"type":1554,"score":5178},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:L\u002FSA:N",[5180,5182,5184,5186,5188,5190,5192,5193],{"type":1558,"url":5181},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw9p-v7r6-gx4p",{"type":1561,"url":5183},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116578",{"type":1558,"url":5185},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3786",{"type":1558,"url":5187},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F940ea725bdd9bc68231d68a105eef17ea6e11233",{"type":1558,"url":5189},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fcc75ab0eb3af459c714895a49f682ad354f50117",{"type":1558,"url":5191},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fccb6a2e5482f17997efd4a74b8200d5b4babc035",{"type":1566,"url":1905},{"type":1558,"url":5004},[1909,1910,1911,1912,1913,1914],{"id":251,"slug":5196,"dossier":47,"summary":5197,"aliases":5198,"sourceIds":5202,"published":5203,"modified":5204,"checkedAt":7,"severity":5205,"references":5208,"versionKeys":5220,"packageCount":32,"repositoryCount":351},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[5199,5200,5201],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[251,5201],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[5206,5207],{"type":1554,"score":3809},{"type":1593,"score":2523},[5209,5210,5212,5214,5216,5218,5219],{"type":1558,"url":3813},{"type":1601,"url":5211},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1561,"url":5213},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1601,"url":5215},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1601,"url":5217},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1566,"url":1567},{"type":1561,"url":2632},[1571,1572,1573,1574,1575,1576,1577,1578],{"id":252,"slug":5222,"dossier":47,"summary":5223,"aliases":5224,"sourceIds":5227,"published":5228,"modified":5229,"checkedAt":7,"severity":5230,"references":5234,"versionKeys":5247,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[5225,5226],"CVE-2024-56326","PYSEC-2026-1475",[252,5226],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[5231,5233],{"type":1593,"score":5232},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1554,"score":3911},[5235,5237,5239,5241,5242,5243,5244,5245],{"type":1558,"url":5236},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1561,"url":5238},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1601,"url":5240},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1566,"url":3920},{"type":1558,"url":4450},{"type":1558,"url":3922},{"type":1566,"url":3926},{"type":1561,"url":5246},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3930],{"id":253,"slug":5249,"dossier":47,"summary":5250,"aliases":5251,"sourceIds":5254,"published":5255,"modified":5256,"checkedAt":7,"severity":5257,"references":5260,"versionKeys":5268,"packageCount":32,"repositoryCount":1581},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[5252,5253],"BIT-pillow-2026-112897","CVE-2026-112897",[253],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[5258],{"type":1554,"score":5259},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5261,5263,5265,5266,5267],{"type":1558,"url":5262},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1561,"url":5264},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1558,"url":3701},{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":254,"slug":5270,"dossier":47,"summary":5271,"aliases":5272,"sourceIds":5275,"published":5276,"modified":5277,"checkedAt":7,"severity":5278,"references":5281,"versionKeys":5287,"packageCount":32,"repositoryCount":1581},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[5273,5274],"CVE-2026-44431","PYSEC-2026-141",[254,5274],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[5279,5280],{"type":1593,"score":2716},{"type":1554,"score":3671},[5282,5284,5286],{"type":1561,"url":5283},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1561,"url":5285},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1566,"url":1769},[1773,1774,1775,1776,1777,3247],{"id":255,"slug":5289,"dossier":47,"summary":5290,"aliases":5291,"sourceIds":5294,"published":5295,"modified":5296,"checkedAt":7,"severity":5297,"references":5300,"versionKeys":5315,"packageCount":32,"repositoryCount":313},"ghsa-qcq2-496w-v96p-f873dd58","Mistune: Potential DoS via quadratic-time parsing in parse_link_text",[5292,5293],"CVE-2026-49851","PYSEC-2026-2652",[255,5293],"2026-07-09T23:52:27Z","2026-09-10T03:51:11.807497442Z",[5298,5299],{"type":1593,"score":1677},{"type":1554,"score":2450},[5301,5303,5305,5307,5309,5310,5312,5313],{"type":1558,"url":5302},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-qcq2-496w-v96p",{"type":1561,"url":5304},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49851",{"type":1558,"url":5306},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-49851",{"type":1558,"url":5308},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2492304",{"type":1566,"url":1709},{"type":1558,"url":5311},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-49851.json",{"type":1566,"url":3334},{"type":1561,"url":5314},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qcq2-496w-v96p",[1715,1716],{"id":256,"slug":5317,"dossier":47,"summary":5318,"aliases":5319,"sourceIds":5322,"published":5323,"modified":5324,"checkedAt":7,"severity":5325,"references":5327,"versionKeys":5337,"packageCount":32,"repositoryCount":313},"ghsa-qfrw-5rxm-mhh2-586619d0","Mistune renderers\u002Fhtml.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` execution",[5320,5321],"CVE-2026-59929","PYSEC-2026-2217",[256,5321],"2026-07-08T17:17:28.737Z","2026-07-20T21:46:41.246867209Z",[5326],{"type":1593,"score":2398},[5328,5330,5332,5333,5334,5335],{"type":1702,"url":5329},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-qfrw-5rxm-mhh2",{"type":1561,"url":5331},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59929",{"type":1601,"url":3266},{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":5336},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2217.yaml",[1715,1716],{"id":257,"slug":5339,"dossier":47,"summary":5340,"aliases":5341,"sourceIds":5344,"published":5345,"modified":5346,"checkedAt":7,"severity":5347,"references":5350,"versionKeys":5363,"packageCount":32,"repositoryCount":371},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[5342,5343],"CVE-2026-31958","PYSEC-2026-140",[257,5343],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[5348,5349],{"type":1593,"score":1677},{"type":1554,"score":2450},[5351,5353,5355,5357,5359,5360,5361],{"type":1561,"url":5352},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1561,"url":5354},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1558,"url":5356},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1558,"url":5358},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1566,"url":1905},{"type":1558,"url":3053},{"type":1558,"url":5362},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1909,1910,1911,1912],{"id":258,"slug":5365,"dossier":47,"summary":5366,"aliases":5367,"sourceIds":5370,"published":5371,"modified":5372,"checkedAt":7,"severity":5373,"references":5376,"versionKeys":5390,"packageCount":32,"repositoryCount":5391},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[5368,5369],"CVE-2026-22701","PYSEC-2026-1374",[258,5369],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[5374],{"type":1593,"score":5375},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5377,5379,5381,5383,5385,5386,5388],{"type":1558,"url":5378},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1561,"url":5380},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1558,"url":5382},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1558,"url":5384},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1566,"url":2379},{"type":1566,"url":5387},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1561,"url":5389},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2823,2824,2825,2826],14,{"id":259,"slug":5393,"dossier":47,"summary":5394,"aliases":5395,"sourceIds":5398,"published":5399,"modified":5400,"checkedAt":7,"severity":5401,"references":5404,"versionKeys":5415,"packageCount":32,"repositoryCount":381},"ghsa-qmx5-4p3x-wvqf-aef88856","virtualenv: Venv configuration readback can reinterpret path boundaries",[5396,5397],"BIT-virtualenv-2026-113715","CVE-2026-113715",[259],"2026-10-23T22:20:43Z","2026-10-29T10:55:39.718166145Z",[5402],{"type":1554,"score":5403},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[5405,5407,5409,5411,5413,5414],{"type":1558,"url":5406},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-qmx5-4p3x-wvqf",{"type":1561,"url":5408},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113715",{"type":1558,"url":5410},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3426",{"type":1558,"url":5412},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fb0008a58885ded9227faf8f910c6c402712c750a",{"type":1566,"url":1875},{"type":1558,"url":1877},[1879,1880,1881,1882,1883],{"id":260,"slug":5417,"dossier":47,"summary":5418,"aliases":5419,"sourceIds":5422,"published":5423,"modified":5424,"checkedAt":7,"severity":5425,"references":5429,"versionKeys":5445,"packageCount":32,"repositoryCount":411},"ghsa-qwm4-qh6w-59xr-db792663","pip would incorrectly handle doubly-encoded package URLs from indexes",[5420,5421],"CVE-2026-13346","PYSEC-2026-3721",[260,5421],"2026-07-29T19:16:44.267Z","2026-09-10T11:15:08.939447160Z",[5426,5428],{"type":1554,"score":5427},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:H\u002FUI:A\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":2125},[5430,5432,5434,5436,5438,5439,5441,5443],{"type":1561,"url":5431},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-13346",{"type":1601,"url":5433},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F14110",{"type":1558,"url":5435},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fcommit\u002F10dfb6b9005484578b386f64b9f36982e3dc6679",{"type":1558,"url":5437},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpip\u002FPYSEC-2026-3721.yaml",{"type":1566,"url":2282},{"type":1558,"url":5440},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FL2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX",{"type":1561,"url":5442},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FL2BNQGGVQCEV7DROOORQ7WFKKFF2OOQX\u002F",{"type":1561,"url":5444},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qwm4-qh6w-59xr",[2294,2295,5446],"pypi:pip@26.1.2",{"id":261,"slug":5448,"dossier":47,"summary":5449,"aliases":5450,"sourceIds":5452,"published":5453,"modified":5454,"checkedAt":7,"severity":5455,"references":5457,"versionKeys":5468,"packageCount":32,"repositoryCount":66},"ghsa-r4j5-9xpp-3985-880dec7e","Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks",[5451],"CVE-2026-115927",[261],"2026-10-28T22:43:50Z","2026-10-28T23:00:04.082411607Z",[5456],{"type":1593,"score":1894},[5458,5460,5462,5464,5466,5467],{"type":1558,"url":5459},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-r4j5-9xpp-3985",{"type":1561,"url":5461},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115927",{"type":1558,"url":5463},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3773",{"type":1558,"url":5465},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fceab33581489751a66fba8566ad6d5960d4b01c8",{"type":1566,"url":1905},{"type":1558,"url":5004},[1909,1910,1911,1912,1913,1914],{"id":262,"slug":5470,"dossier":47,"summary":5471,"aliases":5472,"sourceIds":5475,"published":5476,"modified":5477,"checkedAt":7,"severity":5478,"references":5480,"versionKeys":5490,"packageCount":32,"repositoryCount":313},"ghsa-r4rv-85jg-w4mf-c97959dd","Mistune: Arbitrary File Read via Include directive path traversal",[5473,5474],"CVE-2026-59924","PYSEC-2026-2212",[262,5474],"2026-07-08T17:17:28.050Z","2026-07-20T21:46:41.298212805Z",[5479],{"type":1593,"score":5162},[5481,5483,5485,5486,5487,5488],{"type":1702,"url":5482},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-r4rv-85jg-w4mf",{"type":1561,"url":5484},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59924",{"type":1601,"url":3355},{"type":1566,"url":1709},{"type":1561,"url":1711},{"type":1558,"url":5489},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fmistune\u002FPYSEC-2026-2212.yaml",[1715,1716],{"id":263,"slug":5492,"dossier":47,"summary":5493,"aliases":5494,"sourceIds":5498,"published":5499,"modified":5500,"checkedAt":7,"severity":5501,"references":5504,"versionKeys":5518,"packageCount":32,"repositoryCount":351},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[5495,5496,5497],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[263,5497],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[5502,5503],{"type":1593,"score":2616},{"type":1554,"score":2618},[5505,5507,5509,5511,5513,5514,5515,5516],{"type":1558,"url":5506},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1561,"url":5508},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1558,"url":5510},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1558,"url":5512},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1566,"url":1567},{"type":1558,"url":2632},{"type":1566,"url":2661},{"type":1561,"url":5517},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1571,1572,1573,1574,1575,1576,1577,1578],{"id":264,"slug":5520,"dossier":47,"summary":5521,"aliases":5522,"sourceIds":5525,"published":5526,"modified":5527,"checkedAt":7,"severity":5528,"references":5531,"versionKeys":5540,"packageCount":32,"repositoryCount":1581},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[5523,5524],"BIT-pillow-2026-112898","CVE-2026-112898",[264],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[5529],{"type":1554,"score":5530},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5532,5534,5536,5538,5539],{"type":1558,"url":5533},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1561,"url":5535},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1558,"url":5537},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":265,"slug":5542,"dossier":47,"summary":5543,"aliases":5544,"sourceIds":5546,"published":5547,"modified":5548,"checkedAt":7,"severity":5549,"references":5551,"versionKeys":5562,"packageCount":32,"repositoryCount":401},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[5545],"CVE-2026-112939",[265],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[5550],{"type":1593,"score":4146},[5552,5554,5556,5558,5560,5561],{"type":1558,"url":5553},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1561,"url":5555},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1558,"url":5557},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1558,"url":5559},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1566,"url":2379},{"type":1558,"url":2381},[2383,2384,2385,2386],{"id":266,"slug":5564,"dossier":47,"summary":5565,"aliases":5566,"sourceIds":5568,"published":5569,"modified":5570,"checkedAt":7,"severity":5571,"references":5574,"versionKeys":5583,"packageCount":32,"repositoryCount":401},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[5567],"CVE-2026-112940",[266],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[5572],{"type":1593,"score":5573},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5575,5577,5579,5580,5581,5582],{"type":1558,"url":5576},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1561,"url":5578},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1558,"url":3625},{"type":1558,"url":3627},{"type":1566,"url":2379},{"type":1558,"url":2381},[2383,2384,2385,2386],{"id":267,"slug":5585,"dossier":47,"summary":5586,"aliases":5587,"sourceIds":5590,"published":5591,"modified":5592,"checkedAt":7,"severity":5593,"references":5595,"versionKeys":5602,"packageCount":32,"repositoryCount":313},"ghsa-v87v-83h2-53w7-36afb5ef","Mistune Heading ID Attribute has Injection XSS",[5588,5589],"CVE-2026-44897","PYSEC-2026-2207",[267,5589],"2026-05-09T00:13:12Z","2026-09-10T03:50:47.725920177Z",[5594],{"type":1593,"score":2398},[5596,5598,5600,5601],{"type":1702,"url":5597},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-v87v-83h2-53w7",{"type":1561,"url":5599},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44897",{"type":1566,"url":1709},{"type":1561,"url":3312},[1715,1716],{"id":268,"slug":5604,"dossier":47,"summary":5605,"aliases":5606,"sourceIds":5610,"published":5611,"modified":5612,"checkedAt":7,"severity":5613,"references":5615,"versionKeys":5626,"packageCount":32,"repositoryCount":351},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[5607,5608,5609],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[268,5609],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[5614],{"type":1593,"score":2549},[5616,5618,5620,5622,5624,5625],{"type":1561,"url":5617},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1561,"url":5619},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1935,"url":5621},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1601,"url":5623},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1566,"url":1567},{"type":1561,"url":1569},[1573,1574,1575,1576,1577,1578,1579,1580],{"id":269,"slug":5628,"dossier":47,"summary":5629,"aliases":5630,"sourceIds":5633,"published":5634,"modified":5635,"checkedAt":7,"severity":5636,"references":5639,"versionKeys":5652,"packageCount":32,"repositoryCount":34},"ghsa-vfmq-68hx-4jfw-7287cb04","lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files",[5631,5632],"CVE-2026-41066","PYSEC-2026-87",[269,5632],"2026-04-21T20:38:44Z","2026-09-10T03:51:03.302383702Z",[5637],{"type":1593,"score":5638},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[5640,5642,5644,5646,5648,5650],{"type":1561,"url":5641},"https:\u002F\u002Fgithub.com\u002Flxml\u002Flxml\u002Fsecurity\u002Fadvisories\u002FGHSA-vfmq-68hx-4jfw",{"type":1561,"url":5643},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-41066",{"type":1935,"url":5645},"https:\u002F\u002Fbugs.launchpad.net\u002Flxml\u002F+bug\u002F2146291",{"type":1566,"url":5647},"https:\u002F\u002Fgithub.com\u002Flxml\u002Flxml",{"type":1558,"url":5649},"https:\u002F\u002Fgithub.com\u002Flxml\u002Flxml\u002Freleases\u002Ftag\u002Flxml-6.1.0",{"type":1558,"url":5651},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Flxml\u002FPYSEC-2026-87.yaml",[5653,5654,5655],"pypi:lxml@5.3.0","pypi:lxml@5.4.0","pypi:lxml@6.0.2",{"id":270,"slug":5657,"dossier":47,"summary":5658,"aliases":5659,"sourceIds":5663,"published":5664,"modified":5665,"checkedAt":7,"severity":5666,"references":5668,"versionKeys":5682,"packageCount":32,"repositoryCount":2041},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5660,5661,5662],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[270,5662],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5667],{"type":1554,"score":2450},[5669,5671,5673,5675,5677,5678,5679,5680],{"type":1558,"url":5670},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1561,"url":5672},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1558,"url":5674},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1558,"url":5676},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1566,"url":1567},{"type":1558,"url":2659},{"type":1566,"url":2661},{"type":1561,"url":5681},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":271,"slug":5684,"dossier":47,"summary":5685,"aliases":5686,"sourceIds":5688,"published":5689,"modified":5690,"checkedAt":7,"severity":5691,"references":5693,"versionKeys":5700,"packageCount":32,"repositoryCount":1581},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[5687],"CVE-2026-112899",[271],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[5692],{"type":1554,"score":2742},[5694,5696,5698,5699],{"type":1558,"url":5695},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1558,"url":5697},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":272,"slug":5702,"dossier":47,"summary":5703,"aliases":5704,"sourceIds":5707,"published":5708,"modified":5709,"checkedAt":7,"severity":5710,"references":5712,"versionKeys":5722,"packageCount":32,"repositoryCount":381},"ghsa-vxj4-q4g9-crj7-3e25d39d","virtualenv bash activate runs commands from an environment name with a backslash before $",[5705,5706],"BIT-virtualenv-2026-113725","CVE-2026-113725",[272],"2026-10-21T16:49:01Z","2026-10-29T10:55:53.696944055Z",[5711],{"type":1593,"score":2523},[5713,5715,5717,5719,5720],{"type":1558,"url":5714},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-vxj4-q4g9-crj7",{"type":1561,"url":5716},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113725",{"type":1558,"url":5718},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fc3104e02474b652832a9bbaae79f6e1696296932",{"type":1566,"url":1875},{"type":1558,"url":5721},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Freleases\u002Ftag\u002F21.14.7",[1879,1880,1881,1882,1883],{"id":273,"slug":5724,"dossier":91,"summary":5725,"aliases":5726,"sourceIds":5729,"published":5730,"modified":5731,"checkedAt":7,"severity":5732,"references":5734,"versionKeys":5746,"packageCount":32,"repositoryCount":2757},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[5727,5728],"CVE-2026-97689","PYSEC-2026-4177",[273,5728],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[5733],{"type":1554,"score":1754},[5735,5737,5739,5741,5742,5743,5744],{"type":1558,"url":5736},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1561,"url":5738},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1558,"url":5740},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1566,"url":1769},{"type":1558,"url":3242},{"type":1566,"url":1771},{"type":1561,"url":5745},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1773,1774,1775,1776,1777,3247,3248],{"id":274,"slug":5748,"dossier":47,"summary":5749,"aliases":5750,"sourceIds":5753,"published":5754,"modified":5755,"checkedAt":7,"severity":5756,"references":5759,"versionKeys":5776,"packageCount":32,"repositoryCount":5391},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[5751,5752],"CVE-2025-68146","PYSEC-2026-1375",[274,5752],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[5757],{"type":1593,"score":5758},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5760,5762,5764,5765,5767,5769,5771,5772,5774],{"type":1558,"url":5761},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1558,"url":5763},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1566,"url":2379},{"type":1558,"url":5766},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1558,"url":5768},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1558,"url":5770},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1566,"url":5387},{"type":1561,"url":5773},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1561,"url":5775},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2823,2824,2825,2826],{"id":275,"slug":5778,"dossier":47,"summary":5779,"aliases":5780,"sourceIds":5783,"published":5784,"modified":5785,"checkedAt":7,"severity":5786,"references":5789,"versionKeys":5798,"packageCount":32,"repositoryCount":1581},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[5781,5782],"BIT-pillow-2026-112900","CVE-2026-112900",[275],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[5787],{"type":1554,"score":5788},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[5790,5792,5794,5796,5797],{"type":1558,"url":5791},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1561,"url":5793},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1558,"url":5795},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":276,"slug":5800,"dossier":47,"summary":5801,"aliases":5802,"sourceIds":5805,"published":5806,"modified":5807,"checkedAt":7,"severity":5808,"references":5814,"versionKeys":5850,"packageCount":32,"repositoryCount":421},"ghsa-wf93-45jw-7689-98dc514d","pip: Path traversal in console_scripts\u002Fgui_scripts entry point names allows installing scripts outside of target directory",[5803,5804],"CVE-2026-8643","PYSEC-2026-196",[276,5804],"2026-06-01T17:17:35.770Z","2026-09-10T03:51:09.636289073Z",[5809,5811,5813],{"type":1593,"score":5810},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1554,"score":5812},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":4303},[5815,5817,5819,5821,5823,5825,5827,5829,5831,5833,5835,5837,5839,5841,5843,5845,5846,5848],{"type":1561,"url":5816},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-8643",{"type":1601,"url":5818},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fpip\u002Fpull\u002F14000",{"type":1558,"url":5820},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:33313",{"type":1558,"url":5822},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34776",{"type":1558,"url":5824},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34777",{"type":1558,"url":5826},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34778",{"type":1558,"url":5828},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34780",{"type":1558,"url":5830},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34891",{"type":1558,"url":5832},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:36193",{"type":1558,"url":5834},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:36315",{"type":1558,"url":5836},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1558,"url":5838},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37283",{"type":1558,"url":5840},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-8643",{"type":1558,"url":5842},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2460927",{"type":1558,"url":5844},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpip\u002FPYSEC-2026-196.yaml",{"type":1566,"url":2282},{"type":1561,"url":5847},"https:\u002F\u002Fmail.python.org\u002Farchives\u002Flist\u002Fsecurity-announce@python.org\u002Fthread\u002FYV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ\u002F",{"type":1561,"url":5849},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wf93-45jw-7689",[2294,2295],{"id":277,"slug":5852,"dossier":47,"summary":5853,"aliases":5854,"sourceIds":5858,"published":5859,"modified":5860,"checkedAt":7,"severity":5861,"references":5864,"versionKeys":5902,"packageCount":32,"repositoryCount":351},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[5855,5856,5857],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[277,5857],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[5862,5863],{"type":1593,"score":1677},{"type":1554,"score":2450},[5865,5867,5869,5871,5873,5874,5876,5878,5880,5882,5884,5886,5887,5889,5891,5893,5894,5896,5898,5900],{"type":1558,"url":5866},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1561,"url":5868},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1558,"url":5870},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1558,"url":5872},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1566,"url":1567},{"type":1558,"url":5875},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1558,"url":5877},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1558,"url":5879},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1561,"url":5881},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1561,"url":5883},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1561,"url":5885},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1561,"url":3836},{"type":1561,"url":5888},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1561,"url":5890},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1561,"url":5892},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1561,"url":3838},{"type":1561,"url":5895},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1561,"url":5897},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1561,"url":5899},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1561,"url":5901},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1571,1572,1573,1574,1575,1576,1577,1578],{"id":278,"slug":5904,"dossier":47,"summary":5905,"aliases":5906,"sourceIds":5910,"published":5911,"modified":5912,"checkedAt":7,"severity":5913,"references":5916,"versionKeys":5925,"packageCount":32,"repositoryCount":351},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[5907,5908,5909],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[278,5909],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[5914,5915],{"type":1593,"score":2616},{"type":1554,"score":2618},[5917,5919,5921,5923,5924],{"type":1561,"url":5918},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1561,"url":5920},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1558,"url":5922},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1566,"url":1567},{"type":1561,"url":2632},[1571,1572,1573,1574,1575,1576,1577,1578],{"id":279,"slug":5927,"dossier":47,"summary":5928,"aliases":5929,"sourceIds":5931,"published":5932,"modified":5933,"checkedAt":7,"severity":5934,"references":5935,"versionKeys":5944,"packageCount":32,"repositoryCount":1581},"ghsa-wqgw-9xfh-qf2g-351c6680","Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data",[5930],"CVE-2026-128066",[279],"2026-11-12T23:35:39Z","2026-11-12T23:45:03.298534910Z",[],[5936,5938,5940,5942,5943],{"type":1558,"url":5937},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wqgw-9xfh-qf2g",{"type":1558,"url":5939},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4908edaf7f416616784c7c03d8c1a60153710ffb",{"type":1558,"url":5941},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4b63dffd8a6d980fa0e21b40832fa6cbf033eacf",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":280,"slug":5946,"dossier":47,"summary":5947,"aliases":5948,"sourceIds":5950,"published":5951,"modified":5952,"checkedAt":7,"severity":5953,"references":5956,"versionKeys":5968,"packageCount":32,"repositoryCount":313},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[5949],"CVE-2026-91991",[280],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[5954],{"type":1554,"score":5955},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5957,5959,5960,5962,5964,5966,5967],{"type":1558,"url":5958},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1558,"url":3208},{"type":1558,"url":5961},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1558,"url":5963},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1558,"url":5965},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1566,"url":1905},{"type":1558,"url":3215},[1913,1914],{"id":281,"slug":5970,"dossier":47,"summary":5971,"aliases":5972,"sourceIds":5976,"published":3452,"modified":5977,"checkedAt":7,"severity":5978,"references":5981,"versionKeys":5995,"packageCount":32,"repositoryCount":381},"ghsa-x78j-v8h9-3j2q-0741325d","virtualenv: Command injection via --prompt in activate.bat (batch activator)",[5973,5974,5975],"BIT-virtualenv-2026-102937","CVE-2026-102937","PYSEC-2026-4014",[281,5975],"2026-10-06T15:26:00.196757436Z",[5979],{"type":1554,"score":5980},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[5982,5984,5986,5988,5990,5992,5993,5994],{"type":1558,"url":5983},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fsecurity\u002Fadvisories\u002FGHSA-x78j-v8h9-3j2q",{"type":1561,"url":5985},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-102937",{"type":1558,"url":5987},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fpull\u002F3250",{"type":1601,"url":5989},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fvirtualenv\u002Fcommit\u002Fd721ff140ce4afdc2a9b76751e4584e25d9fbea6",{"type":1558,"url":5991},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fvirtualenv\u002FPYSEC-2026-4014.yaml",{"type":1566,"url":1875},{"type":1558,"url":3470},{"type":1566,"url":2485},[1879,1880,1881,1882,1883],{"id":282,"slug":5997,"dossier":47,"summary":5998,"aliases":5999,"sourceIds":6001,"published":6002,"modified":6003,"checkedAt":7,"severity":6004,"references":6007,"versionKeys":6016,"packageCount":32,"repositoryCount":1581},"ghsa-xcvg-w56q-r89m-87c516ac","Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size",[6000],"CVE-2026-128067",[282],"2026-11-12T23:34:43Z","2026-11-12T23:45:03.322245161Z",[6005],{"type":1554,"score":6006},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6008,6010,6012,6014,6015],{"type":1558,"url":6009},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xcvg-w56q-r89m",{"type":1558,"url":6011},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F53318b50e8e9e85a57d033d4d879e1398d97aeb1",{"type":1558,"url":6013},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fec5f1cbcf67275641abaad5c065ffb64a0a804a9",{"type":1566,"url":1567},{"type":1558,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":283,"slug":6018,"dossier":47,"summary":6019,"aliases":6020,"sourceIds":6024,"published":6025,"modified":6026,"checkedAt":7,"severity":6027,"references":6029,"versionKeys":6043,"packageCount":32,"repositoryCount":411},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[6021,6022,6023],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[283,6023],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[6028],{"type":1593,"score":5573},[6030,6032,6034,6036,6038,6040,6041],{"type":1561,"url":6031},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1561,"url":6033},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1558,"url":6035},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1601,"url":6037},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1558,"url":6039},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1566,"url":1567},{"type":1558,"url":6042},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1574],{"id":284,"slug":6045,"dossier":47,"summary":6046,"aliases":6047,"sourceIds":6051,"published":6052,"modified":6053,"checkedAt":7,"severity":6054,"references":6057,"versionKeys":6066,"packageCount":32,"repositoryCount":1581},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[6048,6049,6050],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[284,6050],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[6055,6056],{"type":1554,"score":2742},{"type":1593,"score":1677},[6058,6060,6062,6064,6065],{"type":1601,"url":6059},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1561,"url":6061},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1601,"url":6063},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":285,"slug":6068,"dossier":47,"summary":6069,"aliases":6070,"sourceIds":6074,"published":6075,"modified":6076,"checkedAt":7,"severity":6077,"references":6080,"versionKeys":6091,"packageCount":32,"repositoryCount":2041},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[6071,6072,6073],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[285,6073],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[6078],{"type":1593,"score":6079},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[6081,6083,6085,6087,6089,6090],{"type":1702,"url":6082},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1561,"url":6084},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1601,"url":6086},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1601,"url":6088},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1566,"url":1567},{"type":1561,"url":2659},[1571,1572,1573,1574,1575,1576,1577,1578,1579],{"id":286,"slug":6093,"dossier":47,"summary":6094,"aliases":6095,"sourceIds":6098,"published":6099,"modified":6100,"checkedAt":7,"severity":6101,"references":6104,"versionKeys":6124,"packageCount":32,"repositoryCount":313},"ghsa-xm59-rqc7-hhvf-9413791b","nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows",[6096,6097],"CVE-2025-53000","PYSEC-2026-1691",[286,6097],"2025-12-18T22:03:08Z","2026-09-10T03:50:32.307876772Z",[6102],{"type":1554,"score":6103},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6105,6107,6109,6111,6113,6114,6116,6118,6120,6122],{"type":1558,"url":6106},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fsecurity\u002Fadvisories\u002FGHSA-xm59-rqc7-hhvf",{"type":1561,"url":6108},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-53000",{"type":1558,"url":6110},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fissues\u002F2258",{"type":1558,"url":6112},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fcommit\u002Fc9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71",{"type":1566,"url":2132},{"type":1558,"url":6115},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Fblob\u002F4f61702f5c7524d8a3c4ac0d5fc33a6ac2fa36a7\u002Fnbconvert\u002Fpreprocessors\u002Fsvg2pdf.py#L104",{"type":1558,"url":6117},"https:\u002F\u002Fgithub.com\u002Fjupyter\u002Fnbconvert\u002Freleases\u002Ftag\u002Fv7.17.0",{"type":1558,"url":6119},"https:\u002F\u002Fwww.imperva.com\u002Fblog\u002Fcode-execution-in-jupyter-notebook-exports",{"type":1566,"url":6121},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fnbconvert",{"type":1561,"url":6123},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xm59-rqc7-hhvf",[2136],{"id":287,"slug":6126,"dossier":47,"summary":6127,"aliases":6128,"sourceIds":6131,"published":6132,"modified":6133,"checkedAt":7,"severity":6134,"references":6139,"versionKeys":6154,"packageCount":32,"repositoryCount":1581},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[6129,6130],"CVE-2026-112902","PYSEC-2026-4363",[287,6130],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[6135,6137],{"type":1554,"score":6136},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1593,"score":6138},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[6140,6142,6144,6146,6148,6150,6152,6153],{"type":1601,"url":6141},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1561,"url":6143},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1558,"url":6145},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1601,"url":6147},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1601,"url":6149},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1558,"url":6151},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1566,"url":1567},{"type":1561,"url":1569},[1571,1572,1573,1574,1575,1576,1577,1578,1579,1580],{"id":288,"slug":6156,"dossier":47,"summary":307,"aliases":6157,"sourceIds":6160,"published":6161,"modified":6162,"checkedAt":7,"severity":6163,"references":6165,"versionKeys":6169,"packageCount":32,"repositoryCount":313},"pysec-2026-2208-4dad303d",[6158,6159],"CVE-2026-44898","GHSA-6269-cqxg-mhhv",[288],"2026-05-26T21:16:39.810Z","2026-07-13T07:15:28.986856174Z",[6164],{"type":1593,"score":2398},[6166,6167],{"type":1561,"url":3312},{"type":1702,"url":6168},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-6269-cqxg-mhhv",[1715,1716],{"id":289,"slug":6171,"dossier":47,"summary":307,"aliases":6172,"sourceIds":6175,"published":6176,"modified":6177,"checkedAt":7,"severity":6178,"references":6180,"versionKeys":6184,"packageCount":32,"repositoryCount":313},"pysec-2026-2209-f89c37e9",[6173,6174],"CVE-2026-44899","GHSA-ccfx-mfmx-2fx9",[289],"2026-05-26T21:16:39.953Z","2026-07-13T07:15:29.089597285Z",[6179],{"type":1593,"score":2398},[6181,6182],{"type":1561,"url":3312},{"type":1702,"url":6183},"https:\u002F\u002Fgithub.com\u002Flepture\u002Fmistune\u002Fsecurity\u002Fadvisories\u002FGHSA-ccfx-mfmx-2fx9",[1715,1716],1794724255093]