[{"data":1,"prerenderedAt":5850},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14325":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":77,"entity":78,"evidence":296,"related":299},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-15T06:22:58.222Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-15T06:19:38.732Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5086,5074,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":66,"licenseExpressionCount":67,"knownLicensePackageCount":68,"unknownLicensePackageCount":69,"advisoryCount":70,"matchedAdvisoryRepositoryCount":71,"topPackage":72},2871,51,9941,11,63,2832,39,1120,43,{"id":73,"slug":74,"label":75,"repositoryCount":33,"repositoryShare":76},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":101,"artifactResolvedComponentCount":101,"exactManifestPinCount":39,"packageCount":101,"ecosystems":102,"aiPackageCount":104,"licenseExpressionCount":42,"unknownLicensePackageCount":32,"advisoryIds":105,"advisoryCount":294,"providers":295},"opencode:14325","opencode-14325",14325,"URBAN.KI Sovia-app","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app","5a228fab9be01cd711aef443443722445aaa5009","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app\u002F-\u002Fcommit\u002F5a228fab9be01cd711aef443443722445aaa5009","2026-11-11T20:42:13.983Z","2026-11-11T20:42:03.000Z",{"complete":91,"entryCount":92,"truncated":47},true,57,[94],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},"uv-lock","23045eafdfb483ec149e375bcdcde05eebbacd50","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia-app\u002F-\u002Fblob\u002F5a228fab9be01cd711aef443443722445aaa5009\u002Fuv.lock","b74bb096d47b3a37759845db494e848a6612ed5aae81025097905744d143687b",194138,"parsed",75,[103],"pypi",2,[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293],"GHSA-22hg-r758-rrw9","GHSA-239g-whfq-7xj9","GHSA-23mf-xhv8-69c2","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-284h-m62q-gf8w","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3hv7-mjh2-fv65","GHSA-3j72-p6qg-6xp7","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4x4j-2g7c-83w6","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59cr-6r3x-644w","GHSA-5cjw-f85j-cv6r","GHSA-5p39-cfhj-2xmp","GHSA-5rjg-fvgr-3xxf","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69hj-f68j-2879","GHSA-6p8h-3wgx-97gf","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-74r2-7ff9-mjj2","GHSA-7545-fcxq-7j24","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-78g4-xqwv-q3g8","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-7p48-42j8-8846","GHSA-82r6-8w77-94w6","GHSA-83vg-56qc-22m7","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mcc-hrx5-hvxc","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cwqr-hh33-gh44","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f9j4-qggq-h239","GHSA-fc9g-5qg7-mf45","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fq56-3cx3-fjxp","GHSA-fx3j-rwgx-fr94","GHSA-g4qv-2jxx-769h","GHSA-g5vv-9gxw-82hx","GHSA-g7cr-3p24-7wf7","GHSA-g842-9rc4-69pw","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gq48-pqfc-9p58","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg86-v3jv-hrpm","GHSA-jhmp-mqwm-3gq8","GHSA-jjj6-mw9f-p565","GHSA-jm78-9fvv-mhgr","GHSA-m64x-33q8-m5h7","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mrfp-p49p-3hf2","GHSA-mv93-w799-cj2w","GHSA-p4wg-p73j-c528","GHSA-p538-c434-8v24","GHSA-p8hx-v2p6-rp84","GHSA-pcg2-g6cj-q92c","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pw9p-v7r6-gx4p","GHSA-pwv6-vv43-88gr","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-r4j5-9xpp-3985","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v4x8-3wr5-3wq8","GHSA-v87r-6q3f-2j67","GHSA-v9pv-5gc8-w2m6","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vqwp-45wm-r9r5","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-w8jc-g24h-crhw","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wqgw-9xfh-qf2g","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-xcvg-w56q-r89m","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xvh5-g6gv-559v","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2026-139",188,[],{"files":297,"occurrenceCount":101},[298],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},{"packages":300,"vulnerabilities":986},[301,312,322,333,343,353,364,374,385,394,404,413,423,432,441,450,459,468,477,486,495,504,513,522,531,540,549,558,567,576,585,594,603,612,621,630,639,648,657,667,676,685,694,702,711,720,729,738,747,756,765,774,782,791,799,809,818,827,836,845,854,863,872,881,890,900,909,918,927,936,945,954,961,969,978],{"id":302,"slug":303,"identity":304,"label":305,"aiRelevant":91,"provider":84,"advisoryCount":306,"licenseExpressions":307,"versions":309,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":311},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[308],"BSD-3-Clause",[310],"2.9.0",[56],{"id":313,"slug":314,"identity":315,"label":316,"aiRelevant":91,"provider":84,"advisoryCount":39,"licenseExpressions":317,"versions":319,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":321},"package:pypi:opencv-python","opencv-python-bfa06e24","pypi:opencv-python","OpenCV",[318],"Apache-2.0",[320],"4.12.0.88",[56],{"id":323,"slug":324,"identity":325,"label":326,"aiRelevant":47,"provider":84,"advisoryCount":67,"licenseExpressions":327,"versions":330,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":332},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",[328,329],"HPND","MIT-CMU",[331],"12.0.0",[56],{"id":334,"slug":335,"identity":336,"label":337,"aiRelevant":47,"provider":84,"advisoryCount":338,"licenseExpressions":339,"versions":340,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":342},"package:pypi:gitpython","gitpython-dcd13009","pypi:gitpython","gitpython",37,[308],[341],"3.1.45",[56],{"id":344,"slug":345,"identity":346,"label":347,"aiRelevant":47,"provider":84,"advisoryCount":348,"licenseExpressions":349,"versions":350,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":352},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",20,[318],[351],"6.5.2",[56],{"id":354,"slug":355,"identity":356,"label":357,"aiRelevant":47,"provider":84,"advisoryCount":66,"licenseExpressions":358,"versions":361,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":363},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",[359,360],"MIT","Unlicense",[362],"3.20.0",[56],{"id":365,"slug":366,"identity":367,"label":368,"aiRelevant":47,"provider":84,"advisoryCount":369,"licenseExpressions":370,"versions":371,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":373},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[359],[372],"2.5.0",[56],{"id":375,"slug":376,"identity":377,"label":378,"aiRelevant":47,"provider":84,"advisoryCount":379,"licenseExpressions":380,"versions":382,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":384},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[308,381],"non-standard",[383],"3.1.6",[56],{"id":386,"slug":387,"identity":388,"label":389,"aiRelevant":47,"provider":84,"advisoryCount":379,"licenseExpressions":390,"versions":391,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":393},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[359],[392],"80.9.0",[56],{"id":395,"slug":396,"identity":397,"label":398,"aiRelevant":47,"provider":84,"advisoryCount":399,"licenseExpressions":400,"versions":401,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":403},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[318],[402],"2.32.5",[56],{"id":405,"slug":406,"identity":407,"label":408,"aiRelevant":47,"provider":84,"advisoryCount":104,"licenseExpressions":409,"versions":410,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":412},"package:pypi:anyio","anyio-399e5280","pypi:anyio","anyio",[359],[411],"4.11.0",[56],{"id":414,"slug":415,"identity":416,"label":417,"aiRelevant":47,"provider":84,"advisoryCount":104,"licenseExpressions":418,"versions":420,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":422},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[419],"MPL-2.0",[421],"2025.10.5",[56],{"id":424,"slug":425,"identity":426,"label":427,"aiRelevant":47,"provider":84,"advisoryCount":104,"licenseExpressions":428,"versions":429,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":431},"package:pypi:protobuf","protobuf-6e30009a","pypi:protobuf","protobuf",[308],[430],"6.33.0",[56],{"id":433,"slug":434,"identity":435,"label":436,"aiRelevant":47,"provider":84,"advisoryCount":104,"licenseExpressions":437,"versions":438,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":440},"package:pypi:streamlit","streamlit-b61aa01e","pypi:streamlit","streamlit",[318],[439],"1.51.0",[56],{"id":442,"slug":443,"identity":444,"label":445,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":446,"versions":447,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":449},"package:pypi:duckdb","duckdb-8c0332c9","pypi:duckdb","duckdb",[359],[448],"1.4.1",[56],{"id":451,"slug":452,"identity":453,"label":454,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":455,"versions":456,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":458},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[308],[457],"2025.10.0",[56],{"id":460,"slug":461,"identity":462,"label":463,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":464,"versions":465,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":467},"package:pypi:h11","h11-48165ab1","pypi:h11","h11",[359],[466],"0.16.0",[56],{"id":469,"slug":470,"identity":471,"label":472,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":473,"versions":474,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":476},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[308,381],[475],"3.11",[56],{"id":478,"slug":479,"identity":480,"label":481,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":482,"versions":483,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":485},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[318,381],[484],"21.0.0",[56],{"id":487,"slug":488,"identity":489,"label":490,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":491,"versions":492,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":494},"package:pypi:altair","altair-01b7f976","pypi:altair","altair",[308],[493],"5.5.0",[56],{"id":496,"slug":497,"identity":498,"label":499,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":500,"versions":501,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":503},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[359],[502],"25.4.0",[56],{"id":505,"slug":506,"identity":507,"label":508,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":509,"versions":510,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":512},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[359],[511],"1.9.0",[56],{"id":514,"slug":515,"identity":516,"label":517,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":518,"versions":519,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":521},"package:pypi:branca","branca-e1a3550c","pypi:branca","branca",[359],[520],"0.8.2",[56],{"id":523,"slug":524,"identity":525,"label":526,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":527,"versions":528,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":530},"package:pypi:cachetools","cachetools-84fe6563","pypi:cachetools","cachetools",[359],[529],"6.2.1",[56],{"id":532,"slug":533,"identity":534,"label":535,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":536,"versions":537,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":539},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[359],[538],"3.4.4",[56],{"id":541,"slug":542,"identity":543,"label":544,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":545,"versions":546,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":548},"package:pypi:click","click-ef97f731","pypi:click","click",[308,381],[547],"8.3.0",[56],{"id":550,"slug":551,"identity":552,"label":553,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":554,"versions":555,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":557},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[381],[556],"0.4.6",[56],{"id":559,"slug":560,"identity":561,"label":562,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":563,"versions":564,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":566},"package:pypi:filepath","filepath-6e8545d1","pypi:filepath","filepath",[359],[565],"0.1",[56],{"id":568,"slug":569,"identity":570,"label":571,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":572,"versions":573,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":575},"package:pypi:folium","folium-6e89a148","pypi:folium","folium",[359],[574],"0.20.0",[56],{"id":577,"slug":578,"identity":579,"label":580,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":581,"versions":582,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":584},"package:pypi:gitdb","gitdb-dac4580b","pypi:gitdb","gitdb",[381],[583],"4.0.12",[56],{"id":586,"slug":587,"identity":588,"label":589,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":590,"versions":591,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":593},"package:pypi:httpcore","httpcore-ba6ae671","pypi:httpcore","httpcore",[308],[592],"1.0.9",[56],{"id":595,"slug":596,"identity":597,"label":598,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":599,"versions":600,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":602},"package:pypi:httpx","httpx-a512a166","pypi:httpx","httpx",[308],[601],"0.28.1",[56],{"id":604,"slug":605,"identity":606,"label":607,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":608,"versions":609,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":611},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[359],[610],"4.25.1",[56],{"id":613,"slug":614,"identity":615,"label":616,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":617,"versions":618,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":620},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[359],[619],"2025.9.1",[56],{"id":622,"slug":623,"identity":624,"label":625,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":626,"versions":627,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":629},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[308],[628],"3.0.3",[56],{"id":631,"slug":632,"identity":633,"label":634,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":635,"versions":636,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":638},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[308],[637],"1.3.0",[56],{"id":640,"slug":641,"identity":642,"label":643,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":644,"versions":645,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":647},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[359],[646],"2.11.0",[56],{"id":649,"slug":650,"identity":651,"label":652,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":653,"versions":654,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":656},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[308,381],[655],"3.5",[56],{"id":658,"slug":659,"identity":660,"label":661,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":662,"versions":664,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":666},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[663,381],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[665],"2.2.6",[56],{"id":668,"slug":669,"identity":670,"label":671,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":672,"versions":673,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":675},"package:pypi:nvidia-cublas-cu12","nvidia-cublas-cu12-1d052261","pypi:nvidia-cublas-cu12","nvidia-cublas-cu12",[381],[674],"12.8.4.1",[56],{"id":677,"slug":678,"identity":679,"label":680,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":681,"versions":682,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":684},"package:pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12-973480f1","pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12",[381],[683],"12.8.90",[56],{"id":686,"slug":687,"identity":688,"label":689,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":690,"versions":691,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":693},"package:pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12-e32b7f38","pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12",[381],[692],"12.8.93",[56],{"id":695,"slug":696,"identity":697,"label":698,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":699,"versions":700,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":701},"package:pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12-2b875d2a","pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12",[381],[683],[56],{"id":703,"slug":704,"identity":705,"label":706,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":707,"versions":708,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":710},"package:pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12-a21dce6d","pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12",[381],[709],"9.10.2.21",[56],{"id":712,"slug":713,"identity":714,"label":715,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":716,"versions":717,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":719},"package:pypi:nvidia-cufft-cu12","nvidia-cufft-cu12-21ff54dd","pypi:nvidia-cufft-cu12","nvidia-cufft-cu12",[381],[718],"11.3.3.83",[56],{"id":721,"slug":722,"identity":723,"label":724,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":725,"versions":726,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":728},"package:pypi:nvidia-cufile-cu12","nvidia-cufile-cu12-14048140","pypi:nvidia-cufile-cu12","nvidia-cufile-cu12",[381],[727],"1.13.1.3",[56],{"id":730,"slug":731,"identity":732,"label":733,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":734,"versions":735,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":737},"package:pypi:nvidia-curand-cu12","nvidia-curand-cu12-2fed778b","pypi:nvidia-curand-cu12","nvidia-curand-cu12",[381],[736],"10.3.9.90",[56],{"id":739,"slug":740,"identity":741,"label":742,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":743,"versions":744,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":746},"package:pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12-7db0a33a","pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12",[381],[745],"11.7.3.90",[56],{"id":748,"slug":749,"identity":750,"label":751,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":752,"versions":753,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":755},"package:pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12-d7e6a309","pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12",[381],[754],"12.5.8.93",[56],{"id":757,"slug":758,"identity":759,"label":760,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":761,"versions":762,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":764},"package:pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12-97587f50","pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12",[381],[763],"0.7.1",[56],{"id":766,"slug":767,"identity":768,"label":769,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":770,"versions":771,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":773},"package:pypi:nvidia-nccl-cu12","nvidia-nccl-cu12-90361558","pypi:nvidia-nccl-cu12","nvidia-nccl-cu12",[308],[772],"2.27.5",[56],{"id":775,"slug":776,"identity":777,"label":778,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":779,"versions":780,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":781},"package:pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12-6d08af75","pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12",[381],[692],[56],{"id":783,"slug":784,"identity":785,"label":786,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":787,"versions":788,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":790},"package:pypi:nvidia-nvshmem-cu12","nvidia-nvshmem-cu12-d7141303","pypi:nvidia-nvshmem-cu12","nvidia-nvshmem-cu12",[308,381],[789],"3.3.20",[56],{"id":792,"slug":793,"identity":794,"label":795,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":796,"versions":797,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":798},"package:pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12-9a2d0378","pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12",[318,381],[683],[56],{"id":800,"slug":801,"identity":802,"label":803,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":804,"versions":806,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":808},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[805,381],"Apache-2.0 OR BSD-2-Clause",[807],"25.0",[56],{"id":810,"slug":811,"identity":812,"label":813,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":814,"versions":815,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":817},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[308,381],[816],"2.3.3",[56],{"id":819,"slug":820,"identity":821,"label":822,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":823,"versions":824,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":826},"package:pypi:pydeck","pydeck-75380c92","pypi:pydeck","pydeck",[318],[825],"0.9.1",[56],{"id":828,"slug":829,"identity":830,"label":831,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":832,"versions":833,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":835},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[381],[834],"2.9.0.post0",[56],{"id":837,"slug":838,"identity":839,"label":840,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":841,"versions":842,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":844},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[359],[843],"2025.2",[56],{"id":846,"slug":847,"identity":848,"label":849,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":850,"versions":851,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":853},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[359],[852],"0.37.0",[56],{"id":855,"slug":856,"identity":857,"label":858,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":859,"versions":860,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":862},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[359],[861],"0.28.0",[56],{"id":864,"slug":865,"identity":866,"label":867,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":868,"versions":869,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":871},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[308],[870],"2.1.2",[56],{"id":873,"slug":874,"identity":875,"label":876,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":877,"versions":878,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":880},"package:pypi:six","six-3c3888bd","pypi:six","six",[359],[879],"1.17.0",[56],{"id":882,"slug":883,"identity":884,"label":885,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":886,"versions":887,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":889},"package:pypi:smmap","smmap-943fc5aa","pypi:smmap","smmap",[308],[888],"5.0.2",[56],{"id":891,"slug":892,"identity":893,"label":894,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":895,"versions":897,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":899},"package:pypi:sniffio","sniffio-83f32c9d","pypi:sniffio","sniffio",[896],"Apache-2.0 OR MIT",[898],"1.3.1",[56],{"id":901,"slug":902,"identity":903,"label":904,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":905,"versions":906,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":908},"package:pypi:streamlit-folium","streamlit-folium-e76fb4ea","pypi:streamlit-folium","streamlit-folium",[],[907],"0.25.3",[56],{"id":910,"slug":911,"identity":912,"label":913,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":914,"versions":915,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":917},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[308,359,381],[916],"1.14.0",[56],{"id":919,"slug":920,"identity":921,"label":922,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":923,"versions":924,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":926},"package:pypi:tenacity","tenacity-415454f8","pypi:tenacity","tenacity",[318],[925],"9.1.2",[56],{"id":928,"slug":929,"identity":930,"label":931,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":932,"versions":933,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":935},"package:pypi:toml","toml-490ac3c8","pypi:toml","toml",[359],[934],"0.10.2",[56],{"id":937,"slug":938,"identity":939,"label":940,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":941,"versions":942,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":944},"package:pypi:torchvision","torchvision-7f85cafa","pypi:torchvision","torchvision",[308],[943],"0.24.0",[56],{"id":946,"slug":947,"identity":948,"label":949,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":950,"versions":951,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":953},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[359],[952],"3.5.0",[56],{"id":73,"slug":74,"identity":955,"label":75,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":956,"versions":958,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":960},"pypi:typing-extensions",[957,381],"PSF-2.0",[959],"4.15.0",[56],{"id":962,"slug":963,"identity":964,"label":965,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":966,"versions":967,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":968},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[318],[843],[56],{"id":970,"slug":971,"identity":972,"label":973,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":974,"versions":975,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":977},"package:pypi:watchdog","watchdog-55ddb444","pypi:watchdog","watchdog",[318],[976],"6.0.0",[56],{"id":979,"slug":980,"identity":981,"label":982,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":983,"versions":984,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":985},"package:pypi:xyzservices","xyzservices-a1955a18","pypi:xyzservices","xyzservices",[308],[457],[56],[987,1026,1063,1085,1120,1144,1166,1190,1233,1260,1291,1327,1349,1392,1418,1445,1476,1502,1531,1561,1584,1611,1637,1659,1686,1715,1739,1763,1792,1816,1840,1868,1892,1914,1937,1976,2012,2036,2059,2080,2110,2133,2163,2213,2240,2268,2289,2315,2341,2377,2403,2424,2447,2479,2509,2533,2558,2598,2621,2650,2677,2701,2724,2761,2793,2815,2847,2866,2897,2920,2947,2975,3013,3039,3066,3093,3113,3143,3165,3197,3219,3244,3298,3323,3347,3379,3399,3423,3454,3475,3508,3528,3548,3576,3599,3622,3643,3668,3693,3717,3742,3769,3790,3814,3837,3865,3884,3918,3951,3978,4010,4031,4053,4074,4096,4123,4147,4167,4188,4209,4234,4257,4278,4299,4326,4349,4372,4396,4423,4447,4471,4496,4512,4539,4566,4592,4612,4631,4664,4690,4717,4739,4767,4790,4812,4834,4864,4884,4918,4948,4968,4988,5012,5040,5067,5096,5138,5156,5180,5210,5232,5252,5304,5327,5346,5373,5397,5419,5451,5472,5499,5522,5547,5568,5598,5620,5640,5657,5676,5693,5714,5730,5745,5762,5777,5794,5811,5828],{"id":106,"slug":988,"dossier":91,"summary":989,"aliases":990,"sourceIds":993,"published":994,"modified":995,"checkedAt":7,"severity":996,"references":1000,"versionKeys":1014,"packageCount":32,"repositoryCount":1025},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[991,992],"BIT-pillow-2026-112390","CVE-2026-112390",[106],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[997],{"type":998,"score":999},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1001,1004,1007,1009,1012],{"type":1002,"url":1003},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1005,"url":1006},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1002,"url":1008},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1010,"url":1011},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1002,"url":1013},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",19,{"id":107,"slug":1027,"dossier":47,"summary":1028,"aliases":1029,"sourceIds":1032,"published":1033,"modified":1034,"checkedAt":7,"severity":1035,"references":1041,"versionKeys":1059,"packageCount":32,"repositoryCount":34},"ghsa-239g-whfq-7xj9-ede3fcd6","GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution",[1030,1031],"CVE-2026-87817","PYSEC-2026-3982",[107,1031],"2026-09-09T12:17:16.830Z","2026-09-30T23:45:04.022111787Z",[1036,1039],{"type":1037,"score":1038},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":998,"score":1040},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1042,1045,1047,1049,1051,1053,1055,1057],{"type":1043,"url":1044},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-239g-whfq-7xj9",{"type":1005,"url":1046},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87817",{"type":1002,"url":1048},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2218",{"type":1002,"url":1050},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fc7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b",{"type":1010,"url":1052},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython",{"type":1002,"url":1054},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.60",{"type":1002,"url":1056},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3982.yaml",{"type":1005,"url":1058},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",[1060,1061,1062],"pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46",{"id":108,"slug":1064,"dossier":47,"summary":1065,"aliases":1066,"sourceIds":1068,"published":1069,"modified":1070,"checkedAt":7,"severity":1071,"references":1074,"versionKeys":1084,"packageCount":32,"repositoryCount":34},"ghsa-23mf-xhv8-69c2-0feffb42","GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)",[1067],"CVE-2026-110859",[108],"2026-10-27T15:28:03Z","2026-10-27T15:47:08.812491596Z",[1072],{"type":998,"score":1073},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1075,1077,1079,1081,1082],{"type":1002,"url":1076},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-23mf-xhv8-69c2",{"type":1002,"url":1078},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2233",{"type":1002,"url":1080},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8da65080849a56a2fc9f3e7817bbf0524e8397d5",{"type":1010,"url":1052},{"type":1002,"url":1083},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.0",[1060,1061,1062],{"id":109,"slug":1086,"dossier":47,"summary":1087,"aliases":1088,"sourceIds":1091,"published":1092,"modified":1093,"checkedAt":7,"severity":1094,"references":1097,"versionKeys":1118,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1089,1090],"CVE-2024-39689","PYSEC-2024-230",[109,1090],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1095],{"type":1037,"score":1096},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1098,1100,1102,1105,1107,1109,1112,1114,1116],{"type":1005,"url":1099},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1005,"url":1101},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1103,"url":1104},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1010,"url":1106},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1002,"url":1108},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1110,"url":1111},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1002,"url":1113},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1005,"url":1115},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1005,"url":1117},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1119],"pypi:certifi@2024.6.2",{"id":110,"slug":1121,"dossier":91,"summary":1122,"aliases":1123,"sourceIds":1126,"published":1127,"modified":1128,"checkedAt":7,"severity":1129,"references":1132,"versionKeys":1143,"packageCount":32,"repositoryCount":1025},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1124,1125],"BIT-pillow-2026-96638","CVE-2026-96638",[110],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1130],{"type":1037,"score":1131},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1133,1135,1137,1139,1141,1142],{"type":1002,"url":1134},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1005,"url":1136},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1002,"url":1138},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1002,"url":1140},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":111,"slug":1145,"dossier":91,"summary":1146,"aliases":1147,"sourceIds":1150,"published":1151,"modified":1152,"checkedAt":7,"severity":1153,"references":1156,"versionKeys":1165,"packageCount":32,"repositoryCount":1025},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1148,1149],"BIT-pillow-2026-112391","CVE-2026-112391",[111],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1154],{"type":998,"score":1155},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1157,1159,1161,1163,1164],{"type":1002,"url":1158},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1005,"url":1160},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1002,"url":1162},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":112,"slug":1167,"dossier":91,"summary":1168,"aliases":1169,"sourceIds":1173,"published":1174,"modified":1175,"checkedAt":7,"severity":1176,"references":1180,"versionKeys":1189,"packageCount":32,"repositoryCount":1025},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1170,1171,1172],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[112,1172],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1177,1178],{"type":998,"score":999},{"type":1037,"score":1179},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1181,1183,1185,1187,1188],{"type":1103,"url":1182},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1005,"url":1184},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1103,"url":1186},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":113,"slug":1191,"dossier":47,"summary":1192,"aliases":1193,"sourceIds":1196,"published":1197,"modified":1198,"checkedAt":7,"severity":1199,"references":1201,"versionKeys":1222,"packageCount":32,"repositoryCount":1232},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1194,1195],"CVE-2026-104851","PYSEC-2026-4217",[113,1195],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1200],{"type":1037,"score":1038},[1202,1204,1206,1208,1210,1212,1214,1216,1218,1220],{"type":1002,"url":1203},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1005,"url":1205},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1002,"url":1207},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1002,"url":1209},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1002,"url":1211},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1002,"url":1213},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1010,"url":1215},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1002,"url":1217},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1010,"url":1219},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1005,"url":1221},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1223,1224,1225,1226,1227,1228,1229,1230,1231],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",15,{"id":114,"slug":1234,"dossier":47,"summary":1235,"aliases":1236,"sourceIds":1239,"published":1240,"modified":1241,"checkedAt":7,"severity":1242,"references":1249,"versionKeys":1259,"packageCount":32,"repositoryCount":34},"ghsa-284h-m62q-gf8w-da9acb0c","GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE",[1237,1238],"CVE-2026-78676","PYSEC-2026-3786",[114,1238],"2026-08-25T02:16:52.030Z","2026-09-08T19:00:06.885837775Z",[1243,1245,1247],{"type":1037,"score":1244},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":998,"score":1246},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":998,"score":1248},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1250,1252,1254,1255,1257],{"type":1043,"url":1251},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-284h-m62q-gf8w",{"type":1005,"url":1253},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78676",{"type":1010,"url":1052},{"type":1002,"url":1256},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3786.yaml",{"type":1005,"url":1258},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-config-injection",[1060,1061,1062],{"id":115,"slug":1261,"dossier":47,"summary":1262,"aliases":1263,"sourceIds":1266,"published":1267,"modified":1268,"checkedAt":7,"severity":1269,"references":1272,"versionKeys":1290,"packageCount":32,"repositoryCount":34},"ghsa-2f96-g7mh-g2hx-dd7ec02d","GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist",[1264,1265],"CVE-2026-67325","PYSEC-2026-3836",[115,1265],"2026-07-21T19:43:43Z","2026-09-23T05:15:05.950374846Z",[1270],{"type":1037,"score":1271},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1273,1275,1277,1279,1281,1282,1284,1286,1288],{"type":1002,"url":1274},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",{"type":1005,"url":1276},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67325",{"type":1002,"url":1278},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2161",{"type":1002,"url":1280},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F56806080c1348749b07daa4a2024ce47b3cad285",{"type":1010,"url":1052},{"type":1002,"url":1283},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.51",{"type":1002,"url":1285},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-option-prefix-abbreviation",{"type":1010,"url":1287},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fgitpython",{"type":1005,"url":1289},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",[1060,1061,1062],{"id":116,"slug":1292,"dossier":47,"summary":1293,"aliases":1294,"sourceIds":1297,"published":1298,"modified":1299,"checkedAt":7,"severity":1300,"references":1303,"versionKeys":1320,"packageCount":32,"repositoryCount":1326},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1295,1296],"CVE-2025-66471","PYSEC-2026-1994",[116,1296],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1301],{"type":998,"score":1302},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1304,1306,1308,1310,1312,1314,1316,1318],{"type":1002,"url":1305},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1005,"url":1307},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1103,"url":1309},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1002,"url":1311},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1005,"url":1313},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1002,"url":1315},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1010,"url":1317},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1010,"url":1319},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1321,1322,1323,1324,1325],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":117,"slug":1328,"dossier":91,"summary":1329,"aliases":1330,"sourceIds":1333,"published":1334,"modified":1335,"checkedAt":7,"severity":1336,"references":1339,"versionKeys":1348,"packageCount":32,"repositoryCount":1025},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1331,1332],"BIT-pillow-2026-112393","CVE-2026-112393",[117],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1337],{"type":998,"score":1338},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1340,1342,1344,1346,1347],{"type":1002,"url":1341},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1005,"url":1343},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1002,"url":1345},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":118,"slug":1350,"dossier":47,"summary":1351,"aliases":1352,"sourceIds":1356,"published":1357,"modified":1358,"checkedAt":7,"severity":1359,"references":1366,"versionKeys":1388,"packageCount":32,"repositoryCount":399},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1353,1354,1355],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[118,1355],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1360,1362,1364],{"type":1037,"score":1361},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":998,"score":1363},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1037,"score":1365},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1367,1369,1372,1374,1376,1378,1380,1382,1384,1386],{"type":1005,"url":1368},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1370,"url":1371},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1370,"url":1373},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1002,"url":1375},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1010,"url":1377},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1002,"url":1379},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1370,"url":1381},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1005,"url":1383},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1005,"url":1385},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1005,"url":1387},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1389,1390,1391],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":119,"slug":1393,"dossier":47,"summary":1394,"aliases":1395,"sourceIds":1398,"published":1399,"modified":1400,"checkedAt":7,"severity":1401,"references":1404,"versionKeys":1417,"packageCount":32,"repositoryCount":1326},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1396,1397],"CVE-2026-21441","PYSEC-2026-1996",[119,1397],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1402,1403],{"type":1037,"score":1179},{"type":998,"score":1302},[1405,1407,1409,1411,1412,1414,1415],{"type":1002,"url":1406},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1005,"url":1408},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1103,"url":1410},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1010,"url":1317},{"type":1002,"url":1413},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1010,"url":1319},{"type":1005,"url":1416},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1321,1322,1323,1324,1325],{"id":120,"slug":1419,"dossier":47,"summary":1420,"aliases":1421,"sourceIds":1424,"published":1425,"modified":1426,"checkedAt":7,"severity":1427,"references":1432,"versionKeys":1444,"packageCount":32,"repositoryCount":34},"ghsa-3f7w-8rr8-f37f-9cab61a6","GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read",[1422,1423],"CVE-2026-73620","PYSEC-2026-3949",[120,1423],"2026-08-03T20:09:56Z","2026-09-10T13:10:44.075529324Z",[1428,1430],{"type":1037,"score":1429},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":998,"score":1431},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1433,1435,1437,1439,1440,1442],{"type":1043,"url":1434},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3f7w-8rr8-f37f",{"type":1002,"url":1436},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2193",{"type":1002,"url":1438},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F3af0c2516c5e18c829da30338614688f6b69b49c",{"type":1010,"url":1052},{"type":1002,"url":1441},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.57",{"type":1005,"url":1443},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-and-read",[1060,1061,1062],{"id":121,"slug":1446,"dossier":47,"summary":1447,"aliases":1448,"sourceIds":1450,"published":1451,"modified":1452,"checkedAt":7,"severity":1453,"references":1456,"versionKeys":1469,"packageCount":32,"repositoryCount":66},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[1449],"CVE-2026-103261",[121],"2026-09-30T23:49:25Z","2026-10-02T03:56:09.601689224Z",[1454],{"type":1037,"score":1455},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1457,1459,1461,1463,1465,1467],{"type":1002,"url":1458},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1002,"url":1460},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1002,"url":1462},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1002,"url":1464},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1010,"url":1466},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1002,"url":1468},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1470,1471,1472,1473,1474,1475],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7",{"id":122,"slug":1477,"dossier":91,"summary":1478,"aliases":1479,"sourceIds":1483,"published":1484,"modified":1485,"checkedAt":7,"severity":1486,"references":1490,"versionKeys":1501,"packageCount":32,"repositoryCount":1025},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1480,1481,1482],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[122,1482],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1487,1489],{"type":998,"score":1488},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":1131},[1491,1493,1495,1497,1499,1500],{"type":1005,"url":1492},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1005,"url":1494},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1370,"url":1496},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1103,"url":1498},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":123,"slug":1503,"dossier":47,"summary":1504,"aliases":1505,"sourceIds":1508,"published":1509,"modified":1510,"checkedAt":7,"severity":1511,"references":1516,"versionKeys":1530,"packageCount":32,"repositoryCount":34},"ghsa-3rp5-jjmw-4wv2-6d7352e6","GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)",[1506,1507],"CVE-2026-69097","PYSEC-2026-3981",[123,1507],"2026-07-24T16:22:02Z","2026-10-23T21:47:05Z",[1512,1514],{"type":1037,"score":1513},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1037,"score":1515},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1517,1519,1521,1523,1524,1526,1528],{"type":1043,"url":1518},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3rp5-jjmw-4wv2",{"type":1002,"url":1520},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2176",{"type":1002,"url":1522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed1b924f4e2d2ee7bab296df77b978af21853f1",{"type":1010,"url":1052},{"type":1002,"url":1525},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.53",{"type":1002,"url":1527},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3981.yaml",{"type":1005,"url":1529},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-submodule-names",[1060,1061,1062],{"id":124,"slug":1532,"dossier":47,"summary":1533,"aliases":1534,"sourceIds":1537,"published":1538,"modified":1539,"checkedAt":7,"severity":1540,"references":1543,"versionKeys":1560,"packageCount":32,"repositoryCount":34},"ghsa-3wxw-xv34-2frg-c013ae2d","GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)",[1535,1536],"CVE-2026-78679","PYSEC-2026-3837",[124,1536],"2026-09-08T19:42:22Z","2026-09-23T05:15:05.925079070Z",[1541],{"type":1037,"score":1542},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1544,1546,1548,1550,1552,1553,1555,1557,1558],{"type":1002,"url":1545},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",{"type":1005,"url":1547},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78679",{"type":1002,"url":1549},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2208",{"type":1002,"url":1551},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6",{"type":1010,"url":1052},{"type":1002,"url":1554},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.59",{"type":1002,"url":1556},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-tagreference-create",{"type":1010,"url":1287},{"type":1005,"url":1559},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",[1060,1061,1062],{"id":125,"slug":1562,"dossier":47,"summary":1563,"aliases":1564,"sourceIds":1567,"published":1568,"modified":1569,"checkedAt":7,"severity":1570,"references":1573,"versionKeys":1583,"packageCount":32,"repositoryCount":369},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1565,1566],"CVE-2026-49853","PYSEC-2026-3387",[125,1566],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1571],{"type":1037,"score":1572},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1574,1576,1577,1579,1581],{"type":1002,"url":1575},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1010,"url":1466},{"type":1010,"url":1578},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1005,"url":1580},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1005,"url":1582},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1470,1471,1472,1473,1474],{"id":126,"slug":1585,"dossier":91,"summary":1586,"aliases":1587,"sourceIds":1591,"published":1592,"modified":1593,"checkedAt":7,"severity":1594,"references":1599,"versionKeys":1610,"packageCount":32,"repositoryCount":1025},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[1588,1589,1590],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[126,1590],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[1595,1597],{"type":998,"score":1596},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":1598},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[1600,1602,1604,1606,1608,1609],{"type":1043,"url":1601},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1005,"url":1603},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1002,"url":1605},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1103,"url":1607},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":127,"slug":1612,"dossier":47,"summary":1613,"aliases":1614,"sourceIds":1618,"published":1619,"modified":1620,"checkedAt":7,"severity":1621,"references":1623,"versionKeys":1635,"packageCount":32,"repositoryCount":1636},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[1615,1616,1617],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[127,1617],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[1622],{"type":1037,"score":1179},[1624,1626,1628,1630,1632,1633],{"type":1043,"url":1625},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1005,"url":1627},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1103,"url":1629},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1002,"url":1631},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1010,"url":1011},{"type":1005,"url":1634},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1015,1016,1017,1018,1019,1020,1021,1022,1023],18,{"id":128,"slug":1638,"dossier":91,"summary":1639,"aliases":1640,"sourceIds":1643,"published":1644,"modified":1645,"checkedAt":7,"severity":1646,"references":1649,"versionKeys":1658,"packageCount":32,"repositoryCount":1025},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[1641,1642],"BIT-pillow-2026-112395","CVE-2026-112395",[128],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[1647],{"type":1037,"score":1648},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[1650,1652,1654,1656,1657],{"type":1002,"url":1651},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1005,"url":1653},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1002,"url":1655},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":129,"slug":1660,"dossier":47,"summary":1661,"aliases":1662,"sourceIds":1665,"published":1666,"modified":1667,"checkedAt":7,"severity":1668,"references":1671,"versionKeys":1684,"packageCount":32,"repositoryCount":1685},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[1663,1664],"CVE-2025-50182","PYSEC-2026-1997",[129,1664],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[1669],{"type":1037,"score":1670},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1672,1674,1676,1678,1679,1681,1682],{"type":1002,"url":1673},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1005,"url":1675},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1103,"url":1677},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1010,"url":1317},{"type":1002,"url":1680},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1010,"url":1319},{"type":1005,"url":1683},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1321,1322,1323,1324],8,{"id":130,"slug":1687,"dossier":47,"summary":1688,"aliases":1689,"sourceIds":1692,"published":1693,"modified":1694,"checkedAt":7,"severity":1695,"references":1697,"versionKeys":1714,"packageCount":32,"repositoryCount":34},"ghsa-4gmw-gg2m-w46p-58f27cb8","GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\u002Freset\u002Fmerge_tree enables arbitrary file overwrite",[1690,1691],"CVE-2026-76219","PYSEC-2026-3838",[130,1691],"2026-08-07T15:33:57Z","2026-09-10T12:25:42.767166279Z",[1696],{"type":1037,"score":1429},[1698,1700,1702,1704,1706,1707,1709,1711,1712],{"type":1002,"url":1699},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",{"type":1005,"url":1701},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76219",{"type":1002,"url":1703},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2204",{"type":1002,"url":1705},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9b5dcaf85da5946dbf69dcd53f9edba08f760b32",{"type":1010,"url":1052},{"type":1002,"url":1708},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.58",{"type":1002,"url":1710},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-read-tree",{"type":1010,"url":1287},{"type":1005,"url":1713},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",[1060,1061,1062],{"id":131,"slug":1716,"dossier":91,"summary":1717,"aliases":1718,"sourceIds":1722,"published":1723,"modified":1724,"checkedAt":7,"severity":1725,"references":1727,"versionKeys":1738,"packageCount":32,"repositoryCount":1025},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[1719,1720,1721],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[131,1721],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[1726],{"type":1037,"score":1131},[1728,1730,1732,1734,1736,1737],{"type":1005,"url":1729},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1005,"url":1731},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1370,"url":1733},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1103,"url":1735},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":132,"slug":1740,"dossier":47,"summary":1741,"aliases":1742,"sourceIds":1746,"published":1747,"modified":1748,"checkedAt":7,"severity":1749,"references":1753,"versionKeys":1762,"packageCount":32,"repositoryCount":66},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[1743,1744,1745],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[132,1745],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[1750,1752],{"type":1037,"score":1751},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1037,"score":1179},[1754,1756,1758,1760,1761],{"type":1043,"url":1755},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1005,"url":1757},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1103,"url":1759},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1010,"url":1011},{"type":1005,"url":1013},[1019,1020,1021,1022,1023,1024],{"id":133,"slug":1764,"dossier":47,"summary":1765,"aliases":1766,"sourceIds":1770,"published":1771,"modified":1772,"checkedAt":7,"severity":1773,"references":1776,"versionKeys":1791,"packageCount":32,"repositoryCount":1636},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[1767,1768,1769],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[133,1769],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[1774],{"type":1037,"score":1775},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[1777,1779,1781,1783,1785,1787,1789,1790],{"type":1043,"url":1778},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1005,"url":1780},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1103,"url":1782},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1103,"url":1784},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1103,"url":1786},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1002,"url":1788},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1010,"url":1011},{"type":1005,"url":1634},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":134,"slug":1793,"dossier":47,"summary":1794,"aliases":1795,"sourceIds":1798,"published":1799,"modified":1800,"checkedAt":7,"severity":1801,"references":1805,"versionKeys":1815,"packageCount":32,"repositoryCount":34},"ghsa-539m-9xh6-q6rr-c4575e3c","GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file \u002F --add-virtual-file, enabling arbitrary file read via Repo.archive()",[1796,1797],"CVE-2026-73619","PYSEC-2026-3948",[134,1797],"2026-08-03T20:14:28Z","2026-09-10T13:11:01.695990206Z",[1802,1803],{"type":1037,"score":1542},{"type":998,"score":1804},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1806,1808,1809,1811,1812,1813],{"type":1043,"url":1807},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-539m-9xh6-q6rr",{"type":1002,"url":1436},{"type":1002,"url":1810},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca",{"type":1010,"url":1052},{"type":1002,"url":1441},{"type":1005,"url":1814},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-archive",[1060,1061,1062],{"id":135,"slug":1817,"dossier":47,"summary":1818,"aliases":1819,"sourceIds":1823,"published":1824,"modified":1825,"checkedAt":7,"severity":1826,"references":1829,"versionKeys":1839,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[1820,1821,1822],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[135,1822],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[1827,1828],{"type":998,"score":1246},{"type":1037,"score":1244},[1830,1832,1834,1836,1838],{"type":1005,"url":1831},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1005,"url":1833},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1002,"url":1835},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1002,"url":1837},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1010,"url":1377},[1389],{"id":136,"slug":1841,"dossier":47,"summary":1842,"aliases":1843,"sourceIds":1845,"published":1846,"modified":1847,"checkedAt":7,"severity":1848,"references":1851,"versionKeys":1862,"packageCount":32,"repositoryCount":1867},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[1844],"CVE-2026-112907",[136],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[1849],{"type":1037,"score":1850},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1852,1854,1856,1858,1860],{"type":1002,"url":1853},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1002,"url":1855},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1002,"url":1857},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1010,"url":1859},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1002,"url":1861},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[1863,1864,1865,1866],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":137,"slug":1869,"dossier":91,"summary":1870,"aliases":1871,"sourceIds":1875,"published":1876,"modified":1877,"checkedAt":7,"severity":1878,"references":1882,"versionKeys":1891,"packageCount":32,"repositoryCount":1025},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[1872,1873,1874],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[137,1874],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[1879,1881],{"type":998,"score":1880},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":1179},[1883,1885,1887,1889,1890],{"type":1043,"url":1884},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1005,"url":1886},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1103,"url":1888},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":138,"slug":1893,"dossier":47,"summary":1894,"aliases":1895,"sourceIds":1897,"published":1898,"modified":1899,"checkedAt":7,"severity":1900,"references":1903,"versionKeys":1913,"packageCount":32,"repositoryCount":34},"ghsa-59cr-6r3x-644w-a8ec12fb","GitPython submodule update path traversal can write outside the repository",[1896],"CVE-2026-100689",[138],"2026-09-30T23:47:12Z","2026-10-01T00:00:05.754996881Z",[1901],{"type":998,"score":1902},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1904,1906,1908,1910,1911],{"type":1002,"url":1905},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-59cr-6r3x-644w",{"type":1002,"url":1907},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2225",{"type":1002,"url":1909},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed0ebc2f2e74d979cdc367a4864a7731fdcc093",{"type":1010,"url":1052},{"type":1002,"url":1912},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.62",[1060,1061,1062],{"id":139,"slug":1915,"dossier":47,"summary":1916,"aliases":1917,"sourceIds":1919,"published":1920,"modified":1921,"checkedAt":7,"severity":1922,"references":1925,"versionKeys":1935,"packageCount":32,"repositoryCount":42},"ghsa-5cjw-f85j-cv6r-1c54e04a","Tornado: Open redirect via triple-slash redirect paths",[1918],"CVE-2026-126347",[139],"2026-11-13T20:31:22Z","2026-11-13T20:45:03.690595670Z",[1923],{"type":1037,"score":1924},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[1926,1928,1930,1932,1933],{"type":1002,"url":1927},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-5cjw-f85j-cv6r",{"type":1005,"url":1929},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126347",{"type":1002,"url":1931},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fc503241622c0efe7c40110d89834ce8b7fead1e4",{"type":1010,"url":1466},{"type":1002,"url":1934},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.1",[1470,1471,1472,1473,1474,1475,1936],"pypi:tornado@6.6",{"id":140,"slug":1938,"dossier":47,"summary":1939,"aliases":1940,"sourceIds":1943,"published":1944,"modified":1945,"checkedAt":7,"severity":1946,"references":1949,"versionKeys":1966,"packageCount":32,"repositoryCount":1975},"ghsa-5p39-cfhj-2xmp-77a62550","AnyIO process-pool workers can block indefinitely on undrained stderr",[1941,1942],"CVE-2026-64847","PYSEC-2026-4024",[140,1942],"2026-09-18T17:17:10Z","2026-10-01T17:55:57.336188727Z",[1947],{"type":998,"score":1948},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1950,1952,1954,1956,1958,1960,1962,1964],{"type":1002,"url":1951},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1002,"url":1953},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1207",{"type":1002,"url":1955},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002Ff1b7301c8264b0d2e8d24a5788fd29e93dea4040",{"type":1010,"url":1957},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio",{"type":1002,"url":1959},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Freleases\u002Ftag\u002F4.14.2",{"type":1010,"url":1961},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fanyio",{"type":1005,"url":1963},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1005,"url":1965},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-64847",[1967,1968,1969,1970,1971,1972,1973,1974],"pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0",16,{"id":141,"slug":1977,"dossier":47,"summary":1978,"aliases":1979,"sourceIds":1983,"published":1984,"modified":1985,"checkedAt":7,"severity":1986,"references":1990,"versionKeys":2007,"packageCount":32,"repositoryCount":379},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[1980,1981,1982],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[141,1982],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[1987,1989],{"type":998,"score":1988},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1037,"score":1271},[1991,1993,1995,1997,1999,2001,2003,2005],{"type":1043,"url":1992},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1005,"url":1994},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1370,"url":1996},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1103,"url":1998},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1002,"url":2000},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1010,"url":2002},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1002,"url":2004},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1110,"url":2006},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2008,2009,2010,2011],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":142,"slug":2013,"dossier":91,"summary":2014,"aliases":2015,"sourceIds":2019,"published":2020,"modified":2021,"checkedAt":7,"severity":2022,"references":2026,"versionKeys":2035,"packageCount":32,"repositoryCount":1025},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2016,2017,2018],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[142,2018],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2023,2025],{"type":998,"score":2024},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":1244},[2027,2029,2031,2033,2034],{"type":1043,"url":2028},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1005,"url":2030},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1103,"url":2032},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":143,"slug":2037,"dossier":47,"summary":2038,"aliases":2039,"sourceIds":2043,"published":2044,"modified":2045,"checkedAt":7,"severity":2046,"references":2048,"versionKeys":2058,"packageCount":32,"repositoryCount":1636},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2040,2041,2042],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[143,2042],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2047],{"type":1037,"score":1179},[2049,2051,2053,2054,2056,2057],{"type":1043,"url":2050},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1005,"url":2052},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1103,"url":1629},{"type":1002,"url":2055},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1010,"url":1011},{"type":1005,"url":1634},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":144,"slug":2060,"dossier":91,"summary":2061,"aliases":2062,"sourceIds":2065,"published":2066,"modified":2067,"checkedAt":7,"severity":2068,"references":2070,"versionKeys":2079,"packageCount":32,"repositoryCount":1025},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2063,2064],"BIT-pillow-2026-112399","CVE-2026-112399",[144],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2069],{"type":998,"score":1880},[2071,2073,2075,2077,2078],{"type":1002,"url":2072},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1005,"url":2074},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1002,"url":2076},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":145,"slug":2081,"dossier":47,"summary":2082,"aliases":2083,"sourceIds":2087,"published":2088,"modified":2089,"checkedAt":7,"severity":2090,"references":2094,"versionKeys":2108,"packageCount":32,"repositoryCount":2109},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2084,2085,2086],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[145,2086],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2091,2092],{"type":1037,"score":1365},{"type":998,"score":2093},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2095,2097,2099,2101,2103,2105,2106],{"type":1005,"url":2096},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1005,"url":2098},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1002,"url":2100},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1002,"url":2102},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1002,"url":2104},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1010,"url":1011},{"type":1005,"url":2107},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1018,1019,1020,1021,1022],13,{"id":146,"slug":2111,"dossier":47,"summary":2112,"aliases":2113,"sourceIds":2116,"published":2117,"modified":2118,"checkedAt":7,"severity":2119,"references":2122,"versionKeys":2132,"packageCount":32,"repositoryCount":34},"ghsa-5xxx-qhh7-9287-87d91b3e","GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\u002F-S, enabling arbitrary file read via Repo.blame()",[2114,2115],"CVE-2026-78678","PYSEC-2026-3788",[146,2115],"2026-08-25T02:16:52.313Z","2026-09-08T19:00:06.904435463Z",[2120,2121],{"type":1037,"score":1542},{"type":998,"score":1804},[2123,2125,2127,2128,2130],{"type":1043,"url":2124},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-5xxx-qhh7-9287",{"type":1005,"url":2126},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78678",{"type":1010,"url":1052},{"type":1002,"url":2129},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3788.yaml",{"type":1005,"url":2131},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-blame",[1060,1061,1062],{"id":147,"slug":2134,"dossier":47,"summary":2135,"aliases":2136,"sourceIds":2140,"published":2141,"modified":2142,"checkedAt":7,"severity":2143,"references":2146,"versionKeys":2162,"packageCount":32,"repositoryCount":1636},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2137,2138,2139],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[147,2139],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2144],{"type":998,"score":2145},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2147,2149,2151,2153,2155,2156,2158,2160],{"type":1002,"url":2148},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1005,"url":2150},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1002,"url":2152},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1002,"url":2154},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1010,"url":1011},{"type":1002,"url":2157},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1010,"url":2159},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1005,"url":2161},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":148,"slug":2164,"dossier":47,"summary":2165,"aliases":2166,"sourceIds":2171,"published":2172,"modified":2173,"checkedAt":7,"severity":2174,"references":2176,"versionKeys":2204,"packageCount":32,"repositoryCount":2212},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2167,2168,2169,2170],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[148,2170],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2175],{"type":1037,"score":1038},[2177,2179,2181,2183,2185,2187,2189,2191,2193,2195,2196,2198,2200,2202],{"type":1005,"url":2178},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1005,"url":2180},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1370,"url":2182},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1005,"url":2184},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1002,"url":2186},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1370,"url":2188},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1005,"url":2190},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1002,"url":2192},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1002,"url":2194},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1010,"url":1377},{"type":1103,"url":2197},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1005,"url":2199},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1002,"url":2201},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1002,"url":2203},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1389,1390,1391,2205,2206,2207,2208,2209,2210,2211],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":149,"slug":2214,"dossier":47,"summary":2215,"aliases":2216,"sourceIds":2220,"published":2221,"modified":2222,"checkedAt":7,"severity":2223,"references":2228,"versionKeys":2239,"packageCount":32,"repositoryCount":1232},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2217,2218,2219],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[149,2219],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2224,2226],{"type":998,"score":2225},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":2227},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2229,2231,2233,2235,2237,2238],{"type":1005,"url":2230},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1005,"url":2232},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1370,"url":2234},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1103,"url":2236},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1010,"url":1011},{"type":1005,"url":1013},[1018,1019,1020,1021,1022,1023,1024],{"id":150,"slug":2241,"dossier":91,"summary":2242,"aliases":2243,"sourceIds":2246,"published":2247,"modified":2248,"checkedAt":7,"severity":2249,"references":2253,"versionKeys":2262,"packageCount":32,"repositoryCount":2267},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2244,2245],"CVE-2026-45409","PYSEC-2026-215",[150,2245],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2250,2251],{"type":1037,"score":1455},{"type":998,"score":2252},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2254,2256,2258,2260],{"type":1005,"url":2255},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1005,"url":2257},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1010,"url":2259},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1002,"url":2261},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2263,2264,2265,2266],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":151,"slug":2269,"dossier":91,"summary":2270,"aliases":2271,"sourceIds":2274,"published":2275,"modified":2276,"checkedAt":7,"severity":2277,"references":2279,"versionKeys":2288,"packageCount":32,"repositoryCount":1025},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2272,2273],"BIT-pillow-2026-112400","CVE-2026-112400",[151],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2278],{"type":998,"score":1880},[2280,2282,2284,2286,2287],{"type":1002,"url":2281},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1005,"url":2283},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1002,"url":2285},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":152,"slug":2290,"dossier":91,"summary":2291,"aliases":2292,"sourceIds":2294,"published":2295,"modified":2296,"checkedAt":7,"severity":2297,"references":2300,"versionKeys":2309,"packageCount":32,"repositoryCount":1025},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2293],"CVE-2026-112909",[152],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2298],{"type":1037,"score":2299},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2301,2303,2305,2306,2307,2308],{"type":1002,"url":2302},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1005,"url":2304},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1002,"url":1855},{"type":1002,"url":1857},{"type":1010,"url":1859},{"type":1002,"url":1861},[2310,2311,2312,2313,2314,1863,1864,1865,1866],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":153,"slug":2316,"dossier":47,"summary":2317,"aliases":2318,"sourceIds":2321,"published":2322,"modified":2323,"checkedAt":7,"severity":2324,"references":2328,"versionKeys":2340,"packageCount":32,"repositoryCount":34},"ghsa-6p8h-3wgx-97gf-635a010c","GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks",[2319,2320],"CVE-2026-73623","PYSEC-2026-3952",[153,2320],"2026-07-24T16:42:09Z","2026-09-10T13:11:03.995690741Z",[2325,2327],{"type":1037,"score":2326},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1037,"score":1271},[2329,2331,2333,2335,2336,2338],{"type":1043,"url":2330},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-6p8h-3wgx-97gf",{"type":1002,"url":2332},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2180",{"type":1002,"url":2334},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fffcb5359e87619f4fe4a70a4aff5f08c5580ba97",{"type":1010,"url":1052},{"type":1002,"url":2337},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.54",{"type":1005,"url":2339},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-template",[1060,1061,1062],{"id":154,"slug":2342,"dossier":91,"summary":2343,"aliases":2344,"sourceIds":2346,"published":2347,"modified":2348,"checkedAt":7,"severity":2349,"references":2352,"versionKeys":2364,"packageCount":32,"repositoryCount":2376},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2345],"PYSEC-2026-4320",[154,2345],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2350],{"type":998,"score":2351},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2353,2355,2357,2359,2360,2362],{"type":1002,"url":2354},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1002,"url":2356},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1002,"url":2358},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1010,"url":1106},{"type":1010,"url":2361},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1005,"url":2363},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2365,1119,2366,2367,2368,2369,2370,2371,2372,2373,2374,2375],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":155,"slug":2378,"dossier":47,"summary":2379,"aliases":2380,"sourceIds":2384,"published":2385,"modified":2386,"checkedAt":7,"severity":2387,"references":2389,"versionKeys":2402,"packageCount":32,"repositoryCount":1636},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2381,2382,2383],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[155,2383],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2388],{"type":1037,"score":1179},[2390,2392,2394,2396,2398,2400,2401],{"type":1043,"url":2391},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1005,"url":2393},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1103,"url":2395},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1103,"url":2397},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1002,"url":2399},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1010,"url":1011},{"type":1005,"url":2157},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":156,"slug":2404,"dossier":91,"summary":2405,"aliases":2406,"sourceIds":2409,"published":2410,"modified":2411,"checkedAt":7,"severity":2412,"references":2414,"versionKeys":2423,"packageCount":32,"repositoryCount":1025},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[2407,2408],"BIT-pillow-2026-112401","CVE-2026-112401",[156],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[2413],{"type":998,"score":2252},[2415,2417,2419,2421,2422],{"type":1002,"url":2416},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1005,"url":2418},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1002,"url":2420},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":157,"slug":2425,"dossier":47,"summary":2426,"aliases":2427,"sourceIds":2430,"published":2431,"modified":2432,"checkedAt":7,"severity":2433,"references":2438,"versionKeys":2446,"packageCount":32,"repositoryCount":34},"ghsa-7545-fcxq-7j24-84dd19fd","GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository",[2428,2429],"CVE-2026-44243","PYSEC-2026-2162",[157,2429],"2026-05-06T19:38:48Z","2026-09-10T03:50:45.903378498Z",[2434,2436],{"type":1037,"score":2435},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":998,"score":2437},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2439,2441,2443,2444],{"type":1043,"url":2440},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7545-fcxq-7j24",{"type":1005,"url":2442},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44243",{"type":1010,"url":1052},{"type":1103,"url":2445},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.48",[1060,1061,1062],{"id":158,"slug":2448,"dossier":47,"summary":2449,"aliases":2450,"sourceIds":2453,"published":2454,"modified":2455,"checkedAt":7,"severity":2456,"references":2463,"versionKeys":2478,"packageCount":32,"repositoryCount":34},"ghsa-7833-fr7j-v32q-fd003872","GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)",[2451,2452],"CVE-2026-78675","PYSEC-2026-3785",[158,2452],"2026-08-25T02:16:51.887Z","2026-09-23T05:15:05.931147061Z",[2457,2459,2461],{"type":1037,"score":2458},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":998,"score":2460},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":2462},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2464,2466,2468,2470,2472,2473,2474,2476],{"type":1043,"url":2465},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7833-fr7j-v32q",{"type":1005,"url":2467},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78675",{"type":1002,"url":2469},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2211",{"type":1002,"url":2471},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fef7568e3b317ce617eacda39b8b54dcdff8c3b5c",{"type":1010,"url":1052},{"type":1002,"url":1554},{"type":1002,"url":2475},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3785.yaml",{"type":1005,"url":2477},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-local-file-content-disclosure-via-gitmodules",[1060,1061,1062],{"id":159,"slug":2480,"dossier":47,"summary":2481,"aliases":2482,"sourceIds":2486,"published":2487,"modified":2488,"checkedAt":7,"severity":2489,"references":2496,"versionKeys":2508,"packageCount":32,"repositoryCount":369},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[2483,2484,2485],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[159,2484,2485],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[2490,2492,2494],{"type":1037,"score":2491},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1037,"score":2493},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1037,"score":2495},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2497,2499,2501,2502,2504,2506],{"type":1005,"url":2498},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1002,"url":2500},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1010,"url":1466},{"type":1002,"url":2503},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1005,"url":2505},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1005,"url":2507},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1470,1471,1472,1473],{"id":160,"slug":2510,"dossier":47,"summary":2511,"aliases":2512,"sourceIds":2513,"published":2514,"modified":2515,"checkedAt":7,"severity":2516,"references":2519,"versionKeys":2532,"packageCount":32,"repositoryCount":1326},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[160],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[2517],{"type":1037,"score":2518},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2520,2522,2524,2526,2528,2529,2530],{"type":1002,"url":2521},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1002,"url":2523},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1002,"url":2525},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1002,"url":2527},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1010,"url":1011},{"type":1002,"url":1013},{"type":1002,"url":2531},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1017,1018,1019,1020,1021,1022,1023,1024],{"id":161,"slug":2534,"dossier":47,"summary":2535,"aliases":2536,"sourceIds":2539,"published":2540,"modified":2541,"checkedAt":7,"severity":2542,"references":2544,"versionKeys":2557,"packageCount":32,"repositoryCount":104},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[2537,2538],"CVE-2025-47287","PYSEC-2026-1974",[161,2538],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[2543],{"type":1037,"score":1179},[2545,2547,2549,2551,2552,2554,2555],{"type":1002,"url":2546},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1005,"url":2548},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1002,"url":2550},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1010,"url":1466},{"type":1002,"url":2553},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1010,"url":1578},{"type":1005,"url":2556},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1470],{"id":162,"slug":2559,"dossier":47,"summary":2560,"aliases":2561,"sourceIds":2564,"published":2565,"modified":2566,"checkedAt":7,"severity":2567,"references":2570,"versionKeys":2587,"packageCount":32,"repositoryCount":2109},"ghsa-7gcm-g887-7qv7-55bb9ff1","protobuf affected by a JSON recursion depth bypass",[2562,2563],"CVE-2026-0994","PYSEC-2026-1805",[162,2563],"2026-01-23T15:31:35Z","2026-09-10T03:50:32.795512159Z",[2568],{"type":998,"score":2569},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:L",[2571,2573,2575,2577,2579,2581,2583,2585],{"type":1005,"url":2572},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0994",{"type":1002,"url":2574},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fissues\u002F25070",{"type":1002,"url":2576},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fpull\u002F25239",{"type":1002,"url":2578},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",{"type":1002,"url":2580},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002Fd2b001626d137c62dfee6c88c87324102531868b",{"type":1010,"url":2582},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf",{"type":1010,"url":2584},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fprotobuf",{"type":1005,"url":2586},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7gcm-g887-7qv7",[2588,2589,2590,2591,2592,2593,2594,2595,2596,2597],"pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4",{"id":163,"slug":2599,"dossier":91,"summary":2600,"aliases":2601,"sourceIds":2605,"published":2606,"modified":2607,"checkedAt":7,"severity":2608,"references":2611,"versionKeys":2620,"packageCount":32,"repositoryCount":1025},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[2602,2603,2604],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[163,2604],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[2609,2610],{"type":998,"score":1880},{"type":1037,"score":1179},[2612,2614,2616,2618,2619],{"type":1103,"url":2613},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1005,"url":2615},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1103,"url":2617},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":164,"slug":2622,"dossier":47,"summary":2623,"aliases":2624,"sourceIds":2627,"published":2628,"modified":2629,"checkedAt":7,"severity":2630,"references":2635,"versionKeys":2646,"packageCount":32,"repositoryCount":399},"ghsa-7p48-42j8-8846-584b0522","Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)",[2625,2626],"CVE-2026-33682","PYSEC-2026-2285",[164,2626],"2026-03-25T21:20:52Z","2026-07-13T07:26:25.253864212Z",[2631,2633],{"type":1037,"score":2632},"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1037,"score":2634},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[2636,2638,2640,2642,2644],{"type":1005,"url":2637},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fsecurity\u002Fadvisories\u002FGHSA-7p48-42j8-8846",{"type":1005,"url":2639},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33682",{"type":1103,"url":2641},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002F23692ca70b2f2ac720c72d1feb4f190c9d6eed76",{"type":1010,"url":2643},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit",{"type":1005,"url":2645},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Freleases\u002Ftag\u002F1.54.0",[2647,2648,2649],"pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0",{"id":165,"slug":2651,"dossier":47,"summary":2652,"aliases":2653,"sourceIds":2656,"published":2657,"modified":2658,"checkedAt":7,"severity":2659,"references":2662,"versionKeys":2676,"packageCount":32,"repositoryCount":1975},"ghsa-82r6-8w77-94w6-217253d8","AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing",[2654,2655],"CVE-2026-63374","PYSEC-2026-4025",[165,2655],"2026-09-18T17:17:18Z","2026-10-01T17:56:11.058322399Z",[2660],{"type":998,"score":2661},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2663,2665,2667,2669,2670,2671,2672,2674],{"type":1002,"url":2664},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1002,"url":2666},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1208",{"type":1002,"url":2668},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002F68f58915f82d9be8109ebbbd8f5d70577d43f2ce",{"type":1010,"url":1957},{"type":1002,"url":1959},{"type":1010,"url":1961},{"type":1005,"url":2673},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1005,"url":2675},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-63374",[1967,1968,1969,1970,1971,1972,1973,1974],{"id":166,"slug":2678,"dossier":47,"summary":2679,"aliases":2680,"sourceIds":2682,"published":2683,"modified":2684,"checkedAt":7,"severity":2685,"references":2688,"versionKeys":2700,"packageCount":32,"repositoryCount":34},"ghsa-83vg-56qc-22m7-6ad99a7a","GitPython validates a submodule's \".git\" path only after cloning into it (RCE)",[2681],"CVE-2026-114145",[166],"2026-10-22T16:41:14Z","2026-10-22T16:45:04.297463159Z",[2686],{"type":1037,"score":2687},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2689,2691,2693,2695,2697,2698],{"type":1002,"url":2690},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-83vg-56qc-22m7",{"type":1005,"url":2692},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114145",{"type":1002,"url":2694},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2264",{"type":1002,"url":2696},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F97eadb888d2f99567e3113f4e455be4ca128f697",{"type":1010,"url":1052},{"type":1002,"url":2699},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.1",[1060,1061,1062],{"id":167,"slug":2702,"dossier":47,"summary":2703,"aliases":2704,"sourceIds":2706,"published":2707,"modified":2708,"checkedAt":7,"severity":2709,"references":2711,"versionKeys":2723,"packageCount":32,"repositoryCount":66},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[2705],"CVE-2026-91990",[167],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[2710],{"type":998,"score":2252},[2712,2714,2716,2718,2720,2721],{"type":1002,"url":2713},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1002,"url":2715},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1002,"url":2717},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1002,"url":2719},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1010,"url":1466},{"type":1002,"url":2722},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1470,1471,1472,1473,1474,1475],{"id":168,"slug":2725,"dossier":47,"summary":2726,"aliases":2727,"sourceIds":2731,"published":2732,"modified":2733,"checkedAt":7,"severity":2734,"references":2738,"versionKeys":2760,"packageCount":32,"repositoryCount":1685},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[2728,2729,2730],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[168,2730],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[2735,2736],{"type":1037,"score":1361},{"type":998,"score":2737},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2739,2741,2743,2745,2747,2749,2750,2752,2754,2756,2758],{"type":1005,"url":2740},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1002,"url":2742},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1002,"url":2744},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1002,"url":2746},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1002,"url":2748},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1010,"url":1377},{"type":1002,"url":2751},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1002,"url":2753},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1002,"url":2755},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1010,"url":2757},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1005,"url":2759},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1389,1390,1391,2205,2206],{"id":169,"slug":2762,"dossier":91,"summary":2763,"aliases":2764,"sourceIds":2767,"published":2768,"modified":2769,"checkedAt":7,"severity":2770,"references":2773,"versionKeys":2790,"packageCount":32,"repositoryCount":2267},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[2765,2766],"CVE-2026-97687","PYSEC-2026-4175",[169,2766],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[2771],{"type":998,"score":2772},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2774,2776,2778,2780,2782,2784,2785,2787,2788],{"type":1002,"url":2775},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1005,"url":2777},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1002,"url":2779},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1002,"url":2781},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1002,"url":2783},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1010,"url":1317},{"type":1002,"url":2786},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1010,"url":1319},{"type":1005,"url":2789},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1321,1322,1323,1324,1325,2791,2792],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":170,"slug":2794,"dossier":47,"summary":2795,"aliases":2796,"sourceIds":2800,"published":2801,"modified":2802,"checkedAt":7,"severity":2803,"references":2806,"versionKeys":2814,"packageCount":32,"repositoryCount":1025},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[2797,2798,2799],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[170,2799],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[2804,2805],{"type":998,"score":2024},{"type":1037,"score":1244},[2807,2809,2811,2812,2813],{"type":1043,"url":2808},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1005,"url":2810},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1103,"url":2032},{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":171,"slug":2816,"dossier":47,"summary":2817,"aliases":2818,"sourceIds":2821,"published":2822,"modified":2823,"checkedAt":7,"severity":2824,"references":2831,"versionKeys":2846,"packageCount":32,"repositoryCount":34},"ghsa-8mcc-hrx5-hvxc-9da62a9f","GitPython: clone_from()\u002Fclone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination",[2819,2820],"CVE-2026-78677","PYSEC-2026-3787",[171,2820],"2026-08-25T02:16:52.173Z","2026-09-08T19:00:06.914140693Z",[2825,2827,2829],{"type":1037,"score":2826},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":998,"score":2828},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":998,"score":2830},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2832,2834,2836,2838,2840,2841,2842,2844],{"type":1043,"url":2833},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-8mcc-hrx5-hvxc",{"type":1005,"url":2835},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78677",{"type":1002,"url":2837},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2210",{"type":1002,"url":2839},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fb68afff45af0f49e79a3e2d2162018986b37ad5d",{"type":1010,"url":1052},{"type":1002,"url":1554},{"type":1002,"url":2843},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3787.yaml",{"type":1005,"url":2845},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-separate-git-dir",[1060,1061,1062],{"id":172,"slug":2848,"dossier":47,"summary":2849,"aliases":2850,"sourceIds":2852,"published":2853,"modified":2854,"checkedAt":7,"severity":2855,"references":2858,"versionKeys":2865,"packageCount":32,"repositoryCount":1025},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[2851],"CVE-2026-112910",[172],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[2856],{"type":1037,"score":2857},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2859,2861,2862,2863,2864],{"type":1002,"url":2860},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1002,"url":1855},{"type":1002,"url":1857},{"type":1010,"url":1859},{"type":1002,"url":1861},[2310,2311,2312,2313,2314,1863,1864,1865,1866],{"id":173,"slug":2867,"dossier":47,"summary":2868,"aliases":2869,"sourceIds":2872,"published":2873,"modified":2874,"checkedAt":7,"severity":2875,"references":2877,"versionKeys":2896,"packageCount":32,"repositoryCount":399},"ghsa-8qvm-5x2c-j2w7-8a075519","protobuf-python has a potential Denial of Service issue",[2870,2871],"CVE-2025-4565","PYSEC-2026-1806",[173,2871],"2025-06-16T16:02:58Z","2026-09-10T03:50:25.255076549Z",[2876],{"type":998,"score":999},[2878,2880,2882,2884,2886,2887,2889,2891,2893,2894],{"type":1002,"url":2879},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-735f-pc8j-v9w8",{"type":1002,"url":2881},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",{"type":1005,"url":2883},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-4565",{"type":1002,"url":2885},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F17838beda2943d08b8a9d4df5b68f5f04f26d901",{"type":1010,"url":2582},{"type":1002,"url":2888},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fdecoder_test.py#L87-L98",{"type":1002,"url":2890},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fmessage_test.py#L1436-L1478",{"type":1002,"url":2892},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Ftree\u002Fmain\u002Fpython#implementation-backends",{"type":1010,"url":2584},{"type":1005,"url":2895},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",[2588,2590,2591],{"id":174,"slug":2898,"dossier":47,"summary":2899,"aliases":2900,"sourceIds":2904,"published":2905,"modified":2906,"checkedAt":7,"severity":2907,"references":2909,"versionKeys":2919,"packageCount":32,"repositoryCount":1636},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[2901,2902,2903],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[174,2903],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[2908],{"type":1037,"score":1179},[2910,2912,2914,2915,2917,2918],{"type":1043,"url":2911},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1005,"url":2913},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1103,"url":1629},{"type":1002,"url":2916},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1010,"url":1011},{"type":1005,"url":1634},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":175,"slug":2921,"dossier":47,"summary":2922,"aliases":2923,"sourceIds":2926,"published":2927,"modified":2928,"checkedAt":7,"severity":2929,"references":2932,"versionKeys":2946,"packageCount":32,"repositoryCount":34},"ghsa-94p4-4cq8-9g67-9a288a09","GitPython: Environment-variable exfiltration via Repo.create_remote() \u002F Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)",[2924,2925],"CVE-2026-73622","PYSEC-2026-3951",[175,2925],"2026-07-24T21:45:16Z","2026-09-24T14:45:07.411775302Z",[2930,2931],{"type":1037,"score":2826},{"type":998,"score":2830},[2933,2935,2937,2939,2940,2942,2944],{"type":1043,"url":2934},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-94p4-4cq8-9g67",{"type":1002,"url":2936},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F863417457a0633db7ea5aed4fd01e0b291a41162",{"type":1103,"url":2938},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8ac5a30519b6f4af85398b9b9d7064ff4d452da2",{"type":1010,"url":1052},{"type":1002,"url":2941},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.55",{"type":1002,"url":2943},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3951.yaml",{"type":1005,"url":2945},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-remote-add",[1060,1061,1062],{"id":176,"slug":2948,"dossier":47,"summary":2949,"aliases":2950,"sourceIds":2953,"published":2954,"modified":2955,"checkedAt":7,"severity":2956,"references":2958,"versionKeys":2974,"packageCount":32,"repositoryCount":34},"ghsa-956x-8gvw-wg5v-f5d32b2d","GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \u002F `Repo.blame()`",[2951,2952],"CVE-2026-67323","PYSEC-2026-3839",[176,2952],"2026-07-21T20:10:06Z","2026-09-10T12:25:39.217544351Z",[2957],{"type":1037,"score":2458},[2959,2961,2963,2965,2967,2968,2969,2971,2972],{"type":1002,"url":2960},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",{"type":1005,"url":2962},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67323",{"type":1002,"url":2964},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2163",{"type":1002,"url":2966},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F701ce32fe5ba8cb622c0e0342a376a6beb47d738",{"type":1010,"url":1052},{"type":1002,"url":1283},{"type":1002,"url":2970},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-unguarded-git-options",{"type":1010,"url":1287},{"type":1005,"url":2973},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",[1060,1061,1062],{"id":177,"slug":2976,"dossier":47,"summary":2977,"aliases":2978,"sourceIds":2981,"published":2982,"modified":2983,"checkedAt":7,"severity":2984,"references":2987,"versionKeys":3010,"packageCount":32,"repositoryCount":1685},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[2979,2980],"CVE-2024-47081","PYSEC-2026-1872",[177,2980],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[2985],{"type":1037,"score":2986},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2988,2990,2992,2994,2996,2998,3000,3002,3004,3006,3008],{"type":1002,"url":2989},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1005,"url":2991},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1002,"url":2993},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1103,"url":2995},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1005,"url":2997},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1010,"url":2999},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1002,"url":3001},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1002,"url":3003},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1010,"url":3005},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1002,"url":3007},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1002,"url":3009},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3011,3012],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":178,"slug":3014,"dossier":47,"summary":3015,"aliases":3016,"sourceIds":3020,"published":3021,"modified":3022,"checkedAt":7,"severity":3023,"references":3025,"versionKeys":3038,"packageCount":32,"repositoryCount":1636},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3017,3018,3019],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[178,3019],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3024],{"type":1037,"score":1179},[3026,3028,3030,3032,3034,3036,3037],{"type":1043,"url":3027},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1005,"url":3029},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1103,"url":3031},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1103,"url":3033},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1002,"url":3035},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1010,"url":1011},{"type":1005,"url":2157},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":179,"slug":3040,"dossier":47,"summary":3041,"aliases":3042,"sourceIds":3045,"published":3046,"modified":3047,"checkedAt":7,"severity":3048,"references":3050,"versionKeys":3065,"packageCount":32,"repositoryCount":34},"ghsa-9rj7-rf2p-w77r-996a0359","GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks",[3043,3044],"CVE-2026-76218","PYSEC-2026-3840",[179,3044],"2026-08-07T15:36:43Z","2026-09-10T12:25:55.324487522Z",[3049],{"type":1037,"score":2326},[3051,3053,3055,3056,3058,3059,3060,3062,3063],{"type":1002,"url":3052},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",{"type":1005,"url":3054},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76218",{"type":1002,"url":1703},{"type":1002,"url":3057},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fd9ddb55bdc66",{"type":1010,"url":1052},{"type":1002,"url":1708},{"type":1002,"url":3061},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-repo-init",{"type":1010,"url":1287},{"type":1005,"url":3064},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",[1060,1061,1062],{"id":180,"slug":3067,"dossier":47,"summary":3068,"aliases":3069,"sourceIds":3073,"published":3074,"modified":3075,"checkedAt":7,"severity":3076,"references":3081,"versionKeys":3092,"packageCount":32,"repositoryCount":1025},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3070,3071,3072],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[180,3072],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3077,3079],{"type":998,"score":3078},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":3080},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3082,3084,3086,3088,3090,3091],{"type":1005,"url":3083},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1005,"url":3085},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1370,"url":3087},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1103,"url":3089},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":181,"slug":3094,"dossier":47,"summary":3095,"aliases":3096,"sourceIds":3098,"published":3099,"modified":3100,"checkedAt":7,"severity":3101,"references":3103,"versionKeys":3112,"packageCount":32,"repositoryCount":1867},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3097],"CVE-2026-112913",[181],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3102],{"type":1037,"score":1361},[3104,3106,3108,3110,3111],{"type":1002,"url":3105},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1002,"url":3107},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1002,"url":3109},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1010,"url":1859},{"type":1002,"url":1861},[1863,1864,1865,1866],{"id":182,"slug":3114,"dossier":47,"summary":3115,"aliases":3116,"sourceIds":3119,"published":3120,"modified":3121,"checkedAt":7,"severity":3122,"references":3125,"versionKeys":3142,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3117,3118],"CVE-2024-35195","PYSEC-2026-1873",[182,3118],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3123],{"type":1037,"score":3124},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3126,3128,3130,3132,3134,3135,3137,3139,3140],{"type":1002,"url":3127},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1005,"url":3129},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1002,"url":3131},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1103,"url":3133},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1010,"url":2999},{"type":1002,"url":3136},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1002,"url":3138},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1010,"url":3005},{"type":1005,"url":3141},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3011],{"id":183,"slug":3144,"dossier":47,"summary":3145,"aliases":3146,"sourceIds":3148,"published":3149,"modified":3150,"checkedAt":7,"severity":3151,"references":3154,"versionKeys":3164,"packageCount":32,"repositoryCount":66},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[3147],"CVE-2026-103263",[183],"2026-09-30T23:48:55Z","2026-10-02T03:56:10.964622908Z",[3152],{"type":998,"score":3153},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3155,3157,3158,3160,3162,3163],{"type":1002,"url":3156},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1002,"url":1460},{"type":1002,"url":3159},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1002,"url":3161},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1010,"url":1466},{"type":1002,"url":1468},[1470,1471,1472,1473,1474,1475],{"id":184,"slug":3166,"dossier":47,"summary":3167,"aliases":3168,"sourceIds":3172,"published":3173,"modified":3174,"checkedAt":7,"severity":3175,"references":3180,"versionKeys":3196,"packageCount":32,"repositoryCount":104},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3169,3170,3171],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[184],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3176,3178],{"type":1037,"score":3177},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":998,"score":3179},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3181,3183,3185,3187,3188,3190,3192,3194],{"type":1005,"url":3182},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1002,"url":3184},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1002,"url":3186},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1010,"url":1377},{"type":1002,"url":3189},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1002,"url":3191},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1002,"url":3193},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1002,"url":3195},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1389,1390],{"id":185,"slug":3198,"dossier":47,"summary":3199,"aliases":3200,"sourceIds":3203,"published":3204,"modified":3205,"checkedAt":7,"severity":3206,"references":3209,"versionKeys":3218,"packageCount":32,"repositoryCount":1025},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3201,3202],"BIT-pillow-2026-112404","CVE-2026-112404",[185],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3207],{"type":998,"score":3208},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3210,3212,3214,3216,3217],{"type":1002,"url":3211},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1005,"url":3213},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1002,"url":3215},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":186,"slug":3220,"dossier":47,"summary":3221,"aliases":3222,"sourceIds":3225,"published":3226,"modified":3227,"checkedAt":7,"severity":3228,"references":3230,"versionKeys":3242,"packageCount":32,"repositoryCount":3243},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[3223,3224],"CVE-2025-67725","PYSEC-2025-266",[186,3224],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[3229],{"type":1037,"score":1179},[3231,3233,3235,3237,3239,3240],{"type":1005,"url":3232},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1005,"url":3234},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1103,"url":3236},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1002,"url":3238},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1010,"url":1466},{"type":1005,"url":3241},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1470,1471,1472],9,{"id":187,"slug":3245,"dossier":47,"summary":3246,"aliases":3247,"sourceIds":3251,"published":3252,"modified":3253,"checkedAt":7,"severity":3254,"references":3257,"versionKeys":3297,"packageCount":32,"repositoryCount":1975},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3248,3249,3250],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[187,3250],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3255,3256],{"type":998,"score":2460},{"type":1037,"score":1179},[3258,3260,3262,3264,3266,3268,3269,3271,3273,3275,3277,3279,3281,3283,3285,3287,3289,3291,3293,3295],{"type":1002,"url":3259},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1005,"url":3261},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1002,"url":3263},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1002,"url":3265},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1002,"url":3267},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1010,"url":1011},{"type":1002,"url":3270},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1002,"url":3272},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1002,"url":3274},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1005,"url":3276},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1005,"url":3278},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1005,"url":3280},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1005,"url":3282},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1005,"url":3284},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1005,"url":3286},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1005,"url":3288},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1005,"url":3290},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1005,"url":3292},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1005,"url":3294},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1005,"url":3296},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1015,1016,1017,1018,1019,1020,1021],{"id":188,"slug":3299,"dossier":47,"summary":3300,"aliases":3301,"sourceIds":3303,"published":3304,"modified":3305,"checkedAt":7,"severity":3306,"references":3308,"versionKeys":3322,"packageCount":32,"repositoryCount":66},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[3302],"CVE-2026-103262",[188],"2026-09-30T23:49:13Z","2026-10-02T03:56:11.819291984Z",[3307],{"type":1037,"score":1179},[3309,3311,3312,3314,3316,3318,3320,3321],{"type":1002,"url":3310},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1002,"url":1460},{"type":1002,"url":3313},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1002,"url":3315},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1002,"url":3317},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1002,"url":3319},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1010,"url":1466},{"type":1002,"url":1468},[1470,1471,1472,1473,1474,1475],{"id":189,"slug":3324,"dossier":47,"summary":3325,"aliases":3326,"sourceIds":3330,"published":3331,"modified":3332,"checkedAt":7,"severity":3333,"references":3336,"versionKeys":3345,"packageCount":32,"repositoryCount":3346},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3327,3328,3329],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[189,3329],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3334,3335],{"type":998,"score":1880},{"type":1037,"score":1179},[3337,3339,3341,3343,3344],{"type":1043,"url":3338},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1005,"url":3340},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1103,"url":3342},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1010,"url":1011},{"type":1005,"url":1013},[1020,1021,1022,1023,1024],7,{"id":190,"slug":3348,"dossier":47,"summary":3349,"aliases":3350,"sourceIds":3353,"published":3354,"modified":3355,"checkedAt":7,"severity":3356,"references":3359,"versionKeys":3376,"packageCount":32,"repositoryCount":104},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3351,3352],"CVE-2025-27516","PYSEC-2026-1471",[190,3352],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3357],{"type":998,"score":3358},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3360,3362,3364,3366,3368,3370,3372,3374],{"type":1002,"url":3361},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1005,"url":3363},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1103,"url":3365},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1010,"url":3367},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1002,"url":3369},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1002,"url":3371},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1010,"url":3373},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1005,"url":3375},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3377,3378],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":191,"slug":3380,"dossier":47,"summary":3381,"aliases":3382,"sourceIds":3384,"published":3385,"modified":3386,"checkedAt":7,"severity":3387,"references":3389,"versionKeys":3398,"packageCount":32,"repositoryCount":1867},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3383],"CVE-2026-112915",[191],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3388],{"type":1037,"score":1365},[3390,3392,3394,3395,3396,3397],{"type":1002,"url":3391},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1005,"url":3393},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1002,"url":3107},{"type":1002,"url":3109},{"type":1010,"url":1859},{"type":1002,"url":1861},[1863,1864,1865,1866],{"id":192,"slug":3400,"dossier":47,"summary":3401,"aliases":3402,"sourceIds":3405,"published":3406,"modified":3407,"checkedAt":7,"severity":3408,"references":3411,"versionKeys":3422,"packageCount":32,"repositoryCount":369},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[3403,3404],"CVE-2026-49854","PYSEC-2026-3388",[192,3404],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[3409],{"type":1037,"score":3410},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[3412,3414,3415,3417,3418,3420],{"type":1002,"url":3413},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1010,"url":1466},{"type":1002,"url":3416},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1010,"url":1578},{"type":1005,"url":3419},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1005,"url":3421},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1470,1471,1472,1473,1474],{"id":193,"slug":3424,"dossier":47,"summary":3425,"aliases":3426,"sourceIds":3430,"published":3431,"modified":3432,"checkedAt":7,"severity":3433,"references":3437,"versionKeys":3453,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3427,3428,3429],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[193,3429],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3434,3435],{"type":1037,"score":1038},{"type":998,"score":3436},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3438,3440,3442,3444,3445,3447,3449,3451],{"type":1005,"url":3439},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1002,"url":3441},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1002,"url":3443},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1010,"url":2002},{"type":1002,"url":3446},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1002,"url":3448},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1010,"url":3450},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1005,"url":3452},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2008],{"id":194,"slug":3455,"dossier":47,"summary":3456,"aliases":3457,"sourceIds":3460,"published":3461,"modified":3462,"checkedAt":7,"severity":3463,"references":3465,"versionKeys":3474,"packageCount":32,"repositoryCount":1025},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[3458,3459],"BIT-pillow-2026-112406","CVE-2026-112406",[194],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[3464],{"type":998,"score":1880},[3466,3468,3470,3472,3473],{"type":1002,"url":3467},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1005,"url":3469},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1002,"url":3471},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":195,"slug":3476,"dossier":47,"summary":3477,"aliases":3478,"sourceIds":3482,"published":3483,"modified":3484,"checkedAt":7,"severity":3485,"references":3489,"versionKeys":3507,"packageCount":32,"repositoryCount":104},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[3479,3480,3481],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[195],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[3486,3487],{"type":1037,"score":2857},{"type":998,"score":3488},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3490,3492,3494,3496,3498,3500,3501,3503,3505],{"type":1005,"url":3491},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1002,"url":3493},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1002,"url":3495},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1002,"url":3497},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1002,"url":3499},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1010,"url":1377},{"type":1002,"url":3502},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1002,"url":3504},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1002,"url":3506},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1389,1390],{"id":196,"slug":3509,"dossier":47,"summary":3510,"aliases":3511,"sourceIds":3513,"published":3514,"modified":3515,"checkedAt":7,"severity":3516,"references":3518,"versionKeys":3527,"packageCount":32,"repositoryCount":34},"ghsa-f9j4-qggq-h239-968ed9a4","GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution",[3512],"CVE-2026-110858",[196],"2026-10-27T15:26:50Z","2026-10-27T15:47:24.258288646Z",[3517],{"type":1037,"score":2518},[3519,3521,3523,3525,3526],{"type":1002,"url":3520},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-f9j4-qggq-h239",{"type":1002,"url":3522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2247",{"type":1002,"url":3524},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F790bb3164948625ffb043d2a162425d55923fe9a",{"type":1010,"url":1052},{"type":1002,"url":1083},[1060,1061,1062],{"id":197,"slug":3529,"dossier":47,"summary":3530,"aliases":3531,"sourceIds":3534,"published":3535,"modified":3536,"checkedAt":7,"severity":3537,"references":3539,"versionKeys":3547,"packageCount":32,"repositoryCount":1025},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[3532,3533],"BIT-pillow-2026-112891","CVE-2026-112891",[197],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[3538],{"type":998,"score":2252},[3540,3542,3544,3545,3546],{"type":1002,"url":3541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1005,"url":3543},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1002,"url":2420},{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":198,"slug":3549,"dossier":47,"summary":3550,"aliases":3551,"sourceIds":3555,"published":3556,"modified":3557,"checkedAt":7,"severity":3558,"references":3561,"versionKeys":3575,"packageCount":32,"repositoryCount":1636},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[3552,3553,3554],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[198,3554],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[3559],{"type":1037,"score":3560},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[3562,3564,3566,3568,3570,3571,3572,3573],{"type":1002,"url":3563},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1005,"url":3565},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1002,"url":3567},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1002,"url":3569},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1010,"url":1011},{"type":1002,"url":2157},{"type":1010,"url":2159},{"type":1005,"url":3574},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":199,"slug":3577,"dossier":47,"summary":3578,"aliases":3579,"sourceIds":3582,"published":3583,"modified":3584,"checkedAt":7,"severity":3585,"references":3588,"versionKeys":3598,"packageCount":32,"repositoryCount":34},"ghsa-fjr4-x663-mwxc-324b7aa5","GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)",[3580,3581],"CVE-2026-73624","PYSEC-2026-3995",[199,3581],"2026-07-24T16:41:20Z","2026-09-29T09:10:55.738617943Z",[3586,3587],{"type":1037,"score":1429},{"type":998,"score":1431},[3589,3591,3592,3594,3595,3596],{"type":1043,"url":3590},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fjr4-x663-mwxc",{"type":1002,"url":2332},{"type":1002,"url":3593},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1d51b891d7f236044a6aa17498ec682b63dad6e6",{"type":1010,"url":1052},{"type":1002,"url":2337},{"type":1005,"url":3597},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-diff",[1060,1061,1062],{"id":200,"slug":3600,"dossier":47,"summary":3601,"aliases":3602,"sourceIds":3604,"published":3605,"modified":3606,"checkedAt":7,"severity":3607,"references":3610,"versionKeys":3621,"packageCount":32,"repositoryCount":1867},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[3603],"CVE-2026-112935",[200],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[3608],{"type":1037,"score":3609},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[3611,3613,3615,3617,3619,3620],{"type":1002,"url":3612},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1005,"url":3614},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1002,"url":3616},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1002,"url":3618},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1010,"url":1859},{"type":1002,"url":1861},[1863,1864,1865,1866],{"id":201,"slug":3623,"dossier":47,"summary":3624,"aliases":3625,"sourceIds":3627,"published":3628,"modified":3629,"checkedAt":7,"severity":3630,"references":3633,"versionKeys":3642,"packageCount":32,"repositoryCount":34},"ghsa-fx3j-rwgx-fr94-14d75c26","GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name",[3626],"CVE-2026-110855",[201],"2026-10-27T15:26:32Z","2026-10-27T15:47:24.291028301Z",[3631],{"type":1037,"score":3632},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3634,3636,3638,3640,3641],{"type":1002,"url":3635},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fx3j-rwgx-fr94",{"type":1002,"url":3637},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2255",{"type":1002,"url":3639},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9349ff58ee00c9fb14d515c8e693f33b2144b238",{"type":1010,"url":1052},{"type":1002,"url":1083},[1060,1061,1062],{"id":202,"slug":3644,"dossier":47,"summary":3645,"aliases":3646,"sourceIds":3650,"published":3651,"modified":3652,"checkedAt":7,"severity":3653,"references":3656,"versionKeys":3667,"packageCount":32,"repositoryCount":1326},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[3647,3648,3649],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[202,3649],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[3654,3655],{"type":998,"score":1488},{"type":1037,"score":1131},[3657,3659,3661,3663,3665,3666],{"type":1005,"url":3658},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1005,"url":3660},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1370,"url":3662},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1103,"url":3664},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1010,"url":1011},{"type":1005,"url":1013},[1017,1018,1019,1020,1021,1022,1023,1024],{"id":203,"slug":3669,"dossier":47,"summary":3670,"aliases":3671,"sourceIds":3674,"published":3675,"modified":3676,"checkedAt":7,"severity":3677,"references":3679,"versionKeys":3692,"packageCount":32,"repositoryCount":34},"ghsa-g5vv-9gxw-82hx-203070a6","GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author\u002Fcommitter field parsing",[3672,3673],"CVE-2026-87819","PYSEC-2026-3984",[203,3673],"2026-09-09T12:17:17.120Z","2026-09-30T23:45:04.037560336Z",[3678],{"type":1037,"score":1179},[3680,3682,3684,3686,3687,3688,3690],{"type":1043,"url":3681},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-g5vv-9gxw-82hx",{"type":1002,"url":3683},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2215",{"type":1002,"url":3685},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F751473a5f3221d6f989291cbebcc404353fd3ba8",{"type":1010,"url":1052},{"type":1002,"url":1054},{"type":1002,"url":3689},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3984.yaml",{"type":1005,"url":3691},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-denial-of-service-via-redos",[1060,1061,1062],{"id":204,"slug":3694,"dossier":47,"summary":3695,"aliases":3696,"sourceIds":3699,"published":3700,"modified":3701,"checkedAt":7,"severity":3702,"references":3705,"versionKeys":3716,"packageCount":32,"repositoryCount":1025},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[3697,3698],"BIT-pillow-2026-96778","CVE-2026-96778",[204],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[3703],{"type":998,"score":3704},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3706,3708,3710,3712,3714,3715],{"type":1002,"url":3707},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1005,"url":3709},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1002,"url":3711},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1002,"url":3713},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":205,"slug":3718,"dossier":47,"summary":3719,"aliases":3720,"sourceIds":3724,"published":3725,"modified":3726,"checkedAt":7,"severity":3727,"references":3730,"versionKeys":3741,"packageCount":32,"repositoryCount":1025},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[3721,3722,3723],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[205,3723],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[3728,3729],{"type":998,"score":1488},{"type":1037,"score":1131},[3731,3733,3735,3737,3739,3740],{"type":1005,"url":3732},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1005,"url":3734},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1370,"url":3736},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1103,"url":3738},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":206,"slug":3743,"dossier":47,"summary":3744,"aliases":3745,"sourceIds":3748,"published":3749,"modified":3750,"checkedAt":7,"severity":3751,"references":3756,"versionKeys":3766,"packageCount":32,"repositoryCount":1025},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[3746,3747],"CVE-2026-25645","PYSEC-2026-2275",[206,3747],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[3752,3754],{"type":1037,"score":3753},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1037,"score":3755},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[3757,3759,3761,3763,3764],{"type":1005,"url":3758},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1005,"url":3760},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1103,"url":3762},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1010,"url":2999},{"type":1005,"url":3765},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3011,3012,3767,3768],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":207,"slug":3770,"dossier":47,"summary":3771,"aliases":3772,"sourceIds":3775,"published":3776,"modified":3777,"checkedAt":7,"severity":3778,"references":3780,"versionKeys":3789,"packageCount":32,"repositoryCount":1025},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[3773,3774],"BIT-pillow-2026-112892","CVE-2026-112892",[207],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[3779],{"type":998,"score":1880},[3781,3783,3785,3787,3788],{"type":1002,"url":3782},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1005,"url":3784},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1002,"url":3786},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":208,"slug":3791,"dossier":47,"summary":3792,"aliases":3793,"sourceIds":3796,"published":3797,"modified":3798,"checkedAt":7,"severity":3799,"references":3801,"versionKeys":3813,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[3794,3795],"CVE-2026-97688","PYSEC-2026-4176",[208,3795],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[3800],{"type":998,"score":2252},[3802,3804,3806,3808,3809,3810,3811],{"type":1002,"url":3803},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1005,"url":3805},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1002,"url":3807},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1010,"url":1317},{"type":1002,"url":2786},{"type":1010,"url":1319},{"type":1005,"url":3812},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[2791,2792],{"id":209,"slug":3815,"dossier":47,"summary":3816,"aliases":3817,"sourceIds":3820,"published":3821,"modified":3822,"checkedAt":7,"severity":3823,"references":3825,"versionKeys":3836,"packageCount":32,"repositoryCount":1326},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[3818,3819],"CVE-2025-66418","PYSEC-2026-1998",[209,3819],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[3824],{"type":998,"score":1302},[3826,3828,3830,3832,3833,3834],{"type":1002,"url":3827},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1005,"url":3829},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1103,"url":3831},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1010,"url":1317},{"type":1010,"url":1319},{"type":1005,"url":3835},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1321,1322,1323,1324,1325],{"id":210,"slug":3838,"dossier":47,"summary":3839,"aliases":3840,"sourceIds":3843,"published":3844,"modified":3845,"checkedAt":7,"severity":3846,"references":3849,"versionKeys":3864,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[3841,3842],"CVE-2024-56201","PYSEC-2026-1472",[210,3842],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[3847,3848],{"type":1037,"score":1271},{"type":998,"score":3358},[3850,3852,3854,3856,3858,3859,3861,3862],{"type":1002,"url":3851},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1005,"url":3853},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1002,"url":3855},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1103,"url":3857},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1010,"url":3367},{"type":1002,"url":3860},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1010,"url":3373},{"type":1005,"url":3863},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3377],{"id":211,"slug":3866,"dossier":47,"summary":3867,"aliases":3868,"sourceIds":3870,"published":3871,"modified":3872,"checkedAt":7,"severity":3873,"references":3874,"versionKeys":3883,"packageCount":32,"repositoryCount":34},"ghsa-gq48-pqfc-9p58-0aa8d93f","GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree",[3869],"CVE-2026-110860",[211],"2026-10-27T15:26:57Z","2026-10-27T15:47:24.379897252Z",[],[3875,3877,3879,3881,3882],{"type":1002,"url":3876},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-gq48-pqfc-9p58",{"type":1002,"url":3878},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2232",{"type":1002,"url":3880},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F24b6f95d4b90ab1483fb601c736ac6e7c059cd61",{"type":1010,"url":1052},{"type":1002,"url":1083},[1060,1061,1062],{"id":212,"slug":3885,"dossier":47,"summary":3886,"aliases":3887,"sourceIds":3891,"published":3892,"modified":3893,"checkedAt":7,"severity":3894,"references":3897,"versionKeys":3909,"packageCount":32,"repositoryCount":1025},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[3888,3889,3890],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[212,3890],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[3895],{"type":1037,"score":3896},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[3898,3900,3902,3904,3906,3907],{"type":1043,"url":3899},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1005,"url":3901},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1103,"url":3903},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1002,"url":3905},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1010,"url":2002},{"type":1005,"url":3908},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2008,2009,2010,2011,3910,3911,3912,3913,3914,3915,3916,3917],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":213,"slug":3919,"dossier":47,"summary":3920,"aliases":3921,"sourceIds":3924,"published":3925,"modified":3926,"checkedAt":7,"severity":3927,"references":3929,"versionKeys":3950,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[3922,3923],"CVE-2024-34064","PYSEC-2026-1474",[213,3923],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[3928],{"type":1037,"score":2491},[3930,3932,3934,3936,3937,3939,3941,3943,3945,3947,3948],{"type":1002,"url":3931},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1005,"url":3933},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1103,"url":3935},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1010,"url":3367},{"type":1002,"url":3938},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1002,"url":3940},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1002,"url":3942},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1002,"url":3944},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1002,"url":3946},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1010,"url":3373},{"type":1005,"url":3949},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3377],{"id":214,"slug":3952,"dossier":47,"summary":3953,"aliases":3954,"sourceIds":3957,"published":3958,"modified":3959,"checkedAt":7,"severity":3960,"references":3962,"versionKeys":3977,"packageCount":32,"repositoryCount":34},"ghsa-hh9p-6wh2-4mfc-8e33cff1","GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",[3955,3956],"CVE-2026-76217","PYSEC-2026-3841",[214,3956],"2026-08-07T15:43:56Z","2026-09-10T12:26:07.095223621Z",[3961],{"type":1037,"score":1542},[3963,3965,3967,3968,3970,3971,3972,3974,3975],{"type":1002,"url":3964},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",{"type":1005,"url":3966},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76217",{"type":1002,"url":1703},{"type":1002,"url":3969},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Ff2550b65bf60ca087190981e2c7b6865e201f40c",{"type":1010,"url":1052},{"type":1002,"url":1708},{"type":1002,"url":3973},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-pathspec-from-file",{"type":1010,"url":1287},{"type":1005,"url":3976},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",[1060,1061,1062],{"id":215,"slug":3979,"dossier":47,"summary":3980,"aliases":3981,"sourceIds":3984,"published":3985,"modified":3986,"checkedAt":7,"severity":3987,"references":3992,"versionKeys":4009,"packageCount":32,"repositoryCount":34},"ghsa-hmq2-w58f-27jc-f0b0fe70","GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython",[3982,3983],"CVE-2026-76222","PYSEC-2026-3784",[215,3983],"2026-08-07T15:45:39Z","2026-09-08T21:00:05.149418166Z",[3988,3990],{"type":1037,"score":3989},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",{"type":998,"score":3991},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3993,3995,3997,3999,4001,4003,4004,4005,4007],{"type":1043,"url":3994},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hmq2-w58f-27jc",{"type":1005,"url":3996},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76222",{"type":1002,"url":3998},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2202",{"type":1002,"url":4000},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F4299c990e1ca21896f9485277caf7bb0ae5b404c",{"type":1002,"url":4002},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe4b8e7d026ca6abb4cf604f8e77093432ce23c06",{"type":1010,"url":1052},{"type":1002,"url":1708},{"type":1002,"url":4006},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3784.yaml",{"type":1005,"url":4008},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-gitmodules-submodule-name",[1060,1061,1062],{"id":216,"slug":4011,"dossier":47,"summary":4012,"aliases":4013,"sourceIds":4016,"published":4017,"modified":4018,"checkedAt":7,"severity":4019,"references":4021,"versionKeys":4030,"packageCount":32,"repositoryCount":1025},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4014,4015],"BIT-pillow-2026-112893","CVE-2026-112893",[216],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4020],{"type":998,"score":999},[4022,4024,4026,4028,4029],{"type":1002,"url":4023},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1005,"url":4025},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1002,"url":4027},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":217,"slug":4032,"dossier":47,"summary":4033,"aliases":4034,"sourceIds":4036,"published":4037,"modified":4038,"checkedAt":7,"severity":4039,"references":4042,"versionKeys":4052,"packageCount":32,"repositoryCount":1867},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4035],"CVE-2026-112936",[217],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4040],{"type":1037,"score":4041},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4043,4045,4047,4049,4050],{"type":1002,"url":4044},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1005,"url":4046},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1002,"url":4048},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1010,"url":1859},{"type":1002,"url":4051},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[1863,1864,1865,1866],{"id":218,"slug":4054,"dossier":47,"summary":4055,"aliases":4056,"sourceIds":4059,"published":4060,"modified":4061,"checkedAt":7,"severity":4062,"references":4064,"versionKeys":4073,"packageCount":32,"repositoryCount":1025},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4057,4058],"BIT-pillow-2026-112894","CVE-2026-112894",[218],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4063],{"type":998,"score":1880},[4065,4067,4069,4071,4072],{"type":1002,"url":4066},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1005,"url":4068},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1002,"url":4070},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":219,"slug":4075,"dossier":47,"summary":4076,"aliases":4077,"sourceIds":4080,"published":4081,"modified":4082,"checkedAt":7,"severity":4083,"references":4085,"versionKeys":4095,"packageCount":32,"repositoryCount":3243},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[4078,4079],"CVE-2025-67726","PYSEC-2025-267",[219,4079],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[4084],{"type":1037,"score":1179},[4086,4088,4090,4091,4093,4094],{"type":1005,"url":4087},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1005,"url":4089},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1103,"url":3236},{"type":1002,"url":4092},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1010,"url":1466},{"type":1005,"url":3241},[1470,1471,1472],{"id":220,"slug":4097,"dossier":47,"summary":4098,"aliases":4099,"sourceIds":4103,"published":4104,"modified":4105,"checkedAt":7,"severity":4106,"references":4108,"versionKeys":4122,"packageCount":32,"repositoryCount":1636},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4100,4101,4102],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[220,4102],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4107],{"type":1037,"score":1179},[4109,4111,4113,4115,4117,4118,4119,4120],{"type":1002,"url":4110},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1005,"url":4112},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1002,"url":4114},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1002,"url":4116},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1010,"url":1011},{"type":1002,"url":2157},{"type":1010,"url":2159},{"type":1005,"url":4121},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":221,"slug":4124,"dossier":47,"summary":4125,"aliases":4126,"sourceIds":4129,"published":4130,"modified":4131,"checkedAt":7,"severity":4132,"references":4136,"versionKeys":4146,"packageCount":32,"repositoryCount":34},"ghsa-jm78-9fvv-mhgr-2c167ddc","GitPython: git-config OPTION-name injection via =\u002F#\u002Fwhitespace bypasses name validator, enabling forged core.sshCommand\u002FhooksPath (RCE)",[4127,4128],"CVE-2026-76221","PYSEC-2026-3783",[221,4128],"2026-08-07T15:46:35Z","2026-09-10T03:51:14.296736368Z",[4133,4134],{"type":1037,"score":1271},{"type":998,"score":4135},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4137,4139,4140,4142,4143,4144],{"type":1043,"url":4138},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-jm78-9fvv-mhgr",{"type":1002,"url":1703},{"type":1002,"url":4141},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fa495ccd3b547ccd60b2187215823b72a9c0188bf",{"type":1010,"url":1052},{"type":1002,"url":1708},{"type":1005,"url":4145},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-option-name",[1060,1061,1062],{"id":222,"slug":4148,"dossier":47,"summary":4149,"aliases":4150,"sourceIds":4152,"published":4153,"modified":4154,"checkedAt":7,"severity":4155,"references":4157,"versionKeys":4166,"packageCount":32,"repositoryCount":34},"ghsa-m64x-33q8-m5h7-491ad59c","GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines",[4151],"CVE-2026-110856",[222],"2026-10-27T15:26:24Z","2026-10-27T15:47:24.576766638Z",[4156],{"type":998,"score":1880},[4158,4160,4162,4164,4165],{"type":1002,"url":4159},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-m64x-33q8-m5h7",{"type":1002,"url":4161},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2253",{"type":1002,"url":4163},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8290c98d35465a38090cdcc1b17be69967092a15",{"type":1010,"url":1052},{"type":1002,"url":1083},[1060,1061,1062],{"id":223,"slug":4168,"dossier":47,"summary":4169,"aliases":4170,"sourceIds":4173,"published":4174,"modified":4175,"checkedAt":7,"severity":4176,"references":4179,"versionKeys":4187,"packageCount":32,"repositoryCount":399},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4171,4172],"CVE-2026-44432","PYSEC-2026-142",[223,4172],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4177,4178],{"type":1037,"score":1179},{"type":998,"score":1302},[4180,4182,4184,4186],{"type":1005,"url":4181},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1005,"url":4183},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1002,"url":4185},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1010,"url":1317},[2791],{"id":224,"slug":4189,"dossier":47,"summary":4190,"aliases":4191,"sourceIds":4194,"published":4195,"modified":4196,"checkedAt":7,"severity":4197,"references":4199,"versionKeys":4208,"packageCount":32,"repositoryCount":369},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[4192,4193],"CVE-2026-49855","PYSEC-2026-3389",[224,4193],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[4198],{"type":1037,"score":1179},[4200,4202,4203,4204,4206],{"type":1002,"url":4201},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1010,"url":1466},{"type":1010,"url":1578},{"type":1005,"url":4205},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1005,"url":4207},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1470,1471,1472,1473,1474],{"id":225,"slug":4210,"dossier":47,"summary":4211,"aliases":4212,"sourceIds":4215,"published":4216,"modified":4217,"checkedAt":7,"severity":4218,"references":4220,"versionKeys":4233,"packageCount":32,"repositoryCount":66},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[4213,4214],"CVE-2026-82397","PYSEC-2026-3928",[225,4214],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[4219],{"type":1037,"score":1179},[4221,4223,4225,4226,4228,4229,4230,4231],{"type":1002,"url":4222},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1005,"url":4224},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1002,"url":2715},{"type":1002,"url":4227},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1010,"url":1466},{"type":1002,"url":2722},{"type":1010,"url":1578},{"type":1005,"url":4232},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1470,1471,1472,1473,1474,1475],{"id":226,"slug":4235,"dossier":47,"summary":4236,"aliases":4237,"sourceIds":4240,"published":4241,"modified":4242,"checkedAt":7,"severity":4243,"references":4245,"versionKeys":4256,"packageCount":32,"repositoryCount":1025},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[4238,4239],"BIT-pillow-2026-96640","CVE-2026-96640",[226],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[4244],{"type":998,"score":999},[4246,4248,4250,4252,4254,4255],{"type":1002,"url":4247},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1005,"url":4249},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1002,"url":4251},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1002,"url":4253},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":227,"slug":4258,"dossier":47,"summary":4259,"aliases":4260,"sourceIds":4263,"published":4264,"modified":4265,"checkedAt":7,"severity":4266,"references":4269,"versionKeys":4277,"packageCount":32,"repositoryCount":34},"ghsa-mv93-w799-cj2w-4413137a","GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath",[4261,4262],"CVE-2026-67326","PYSEC-2026-3980",[227,4262],"2026-05-08T23:19:02Z","2026-09-17T09:10:55.928803360Z",[4267,4268],{"type":1037,"score":1513},{"type":1037,"score":2462},[4270,4272,4274,4275],{"type":1043,"url":4271},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-mv93-w799-cj2w",{"type":1005,"url":4273},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1010,"url":1052},{"type":1005,"url":4276},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-newline-injection-via-config-writer-section",[1060,1061,1062],{"id":228,"slug":4279,"dossier":47,"summary":4280,"aliases":4281,"sourceIds":4284,"published":4285,"modified":4286,"checkedAt":7,"severity":4287,"references":4289,"versionKeys":4298,"packageCount":32,"repositoryCount":1025},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[4282,4283],"BIT-pillow-2026-112895","CVE-2026-112895",[228],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[4288],{"type":998,"score":1880},[4290,4292,4294,4296,4297],{"type":1002,"url":4291},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1005,"url":4293},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1002,"url":4295},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":229,"slug":4300,"dossier":47,"summary":4301,"aliases":4302,"sourceIds":4305,"published":4306,"modified":4307,"checkedAt":7,"severity":4308,"references":4313,"versionKeys":4325,"packageCount":32,"repositoryCount":34},"ghsa-p538-c434-8v24-c303e516","GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count",[4303,4304],"CVE-2026-73621","PYSEC-2026-3950",[229,4304],"2026-08-03T20:23:17Z","2026-09-10T13:10:55.177009469Z",[4309,4311],{"type":1037,"score":4310},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":998,"score":4312},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4314,4316,4318,4320,4321,4323],{"type":1043,"url":4315},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-p538-c434-8v24",{"type":1002,"url":4317},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2184",{"type":1002,"url":4319},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F38553b6fddc7f6a667cdb45a6762343a08fc72b2",{"type":1010,"url":1052},{"type":1002,"url":4322},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.56",{"type":1005,"url":4324},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-truncation-via-commit-count",[1060,1061,1062],{"id":230,"slug":4327,"dossier":47,"summary":4328,"aliases":4329,"sourceIds":4333,"published":4334,"modified":4335,"checkedAt":7,"severity":4336,"references":4338,"versionKeys":4348,"packageCount":32,"repositoryCount":1025},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[4330,4331,4332],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[230,4332],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[4337],{"type":1037,"score":1131},[4339,4341,4343,4345,4346,4347],{"type":1005,"url":4340},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1005,"url":4342},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1370,"url":4344},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1103,"url":2076},{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":231,"slug":4350,"dossier":47,"summary":4351,"aliases":4352,"sourceIds":4354,"published":4355,"modified":4356,"checkedAt":7,"severity":4357,"references":4359,"versionKeys":4371,"packageCount":32,"repositoryCount":66},"ghsa-pcg2-g6cj-q92c-613600e5","Tornado: Quadratic CPU usage when parsing HTTP headers with line folding",[4353],"CVE-2026-116577",[231],"2026-10-28T22:43:41Z","2026-10-28T23:00:04.070057045Z",[4358],{"type":1037,"score":1455},[4360,4362,4364,4366,4368,4369],{"type":1002,"url":4361},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pcg2-g6cj-q92c",{"type":1005,"url":4363},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116577",{"type":1002,"url":4365},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3765",{"type":1002,"url":4367},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F1b7a1dc9f340f52de929852e8125aa12f25297c9",{"type":1010,"url":1466},{"type":1002,"url":4370},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.0",[1470,1471,1472,1473,1474,1475],{"id":232,"slug":4373,"dossier":47,"summary":4374,"aliases":4375,"sourceIds":4379,"published":4380,"modified":4381,"checkedAt":7,"severity":4382,"references":4386,"versionKeys":4395,"packageCount":32,"repositoryCount":1025},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[4376,4377,4378],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[232,4378],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[4383,4384],{"type":998,"score":3208},{"type":1037,"score":4385},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[4387,4389,4391,4393,4394],{"type":1043,"url":4388},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1005,"url":4390},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1103,"url":4392},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":233,"slug":4397,"dossier":47,"summary":4398,"aliases":4399,"sourceIds":4403,"published":4404,"modified":4405,"checkedAt":7,"severity":4406,"references":4409,"versionKeys":4422,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[4400,4401,4402],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[233,4402],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[4407,4408],{"type":1037,"score":1455},{"type":1037,"score":1179},[4410,4412,4414,4416,4418,4420,4421],{"type":1043,"url":4411},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1005,"url":4413},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1103,"url":4415},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1103,"url":4417},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1002,"url":4419},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1010,"url":1011},{"type":1005,"url":2157},[1020,1021,1022,1023],{"id":234,"slug":4424,"dossier":47,"summary":4425,"aliases":4426,"sourceIds":4430,"published":4431,"modified":4432,"checkedAt":7,"severity":4433,"references":4435,"versionKeys":4446,"packageCount":32,"repositoryCount":1636},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[4427,4428,4429],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[234,4429],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[4434],{"type":1037,"score":1179},[4436,4438,4440,4442,4444,4445],{"type":1043,"url":4437},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1005,"url":4439},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1103,"url":4441},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1002,"url":4443},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1010,"url":1011},{"type":1005,"url":1634},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":235,"slug":4448,"dossier":47,"summary":4449,"aliases":4450,"sourceIds":4453,"published":4454,"modified":4455,"checkedAt":7,"severity":4456,"references":4458,"versionKeys":4470,"packageCount":32,"repositoryCount":1685},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[4451,4452],"CVE-2025-50181","PYSEC-2026-1999",[235,4452],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[4457],{"type":1037,"score":1670},[4459,4461,4463,4465,4466,4467,4468],{"type":1002,"url":4460},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1005,"url":4462},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1103,"url":4464},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1010,"url":1317},{"type":1002,"url":1680},{"type":1010,"url":1319},{"type":1005,"url":4469},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1321,1322,1323,1324],{"id":236,"slug":4472,"dossier":47,"summary":4473,"aliases":4474,"sourceIds":4477,"published":4478,"modified":4479,"checkedAt":7,"severity":4480,"references":4484,"versionKeys":4495,"packageCount":32,"repositoryCount":3243},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[4475,4476],"CVE-2025-67724","PYSEC-2025-265",[236,4476],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[4481,4482],{"type":1037,"score":2491},{"type":1037,"score":4483},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[4485,4487,4489,4491,4493,4494],{"type":1005,"url":4486},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1005,"url":4488},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1103,"url":4490},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1002,"url":4492},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1010,"url":1466},{"type":1005,"url":3241},[1470,1471,1472],{"id":237,"slug":4497,"dossier":47,"summary":4498,"aliases":4499,"sourceIds":4501,"published":4502,"modified":4503,"checkedAt":7,"severity":4504,"references":4507,"versionKeys":4511,"packageCount":32,"repositoryCount":369},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[4500],"CVE-2026-91992",[237],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[4505],{"type":1037,"score":4506},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4508,4510],{"type":1002,"url":4509},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1010,"url":1466},[1470,1471,1472,1473,1474],{"id":238,"slug":4513,"dossier":47,"summary":4514,"aliases":4515,"sourceIds":4517,"published":4518,"modified":4519,"checkedAt":7,"severity":4520,"references":4523,"versionKeys":4538,"packageCount":32,"repositoryCount":66},"ghsa-pw9p-v7r6-gx4p-86e36276","Tornado: Open redirect in RedirectHandler via protocol-relative URLs",[4516],"CVE-2026-116578",[238],"2026-10-28T22:43:45Z","2026-10-28T23:00:04.066537287Z",[4521],{"type":998,"score":4522},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:L\u002FSA:N",[4524,4526,4528,4530,4532,4534,4536,4537],{"type":1002,"url":4525},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw9p-v7r6-gx4p",{"type":1005,"url":4527},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116578",{"type":1002,"url":4529},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3786",{"type":1002,"url":4531},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F940ea725bdd9bc68231d68a105eef17ea6e11233",{"type":1002,"url":4533},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fcc75ab0eb3af459c714895a49f682ad354f50117",{"type":1002,"url":4535},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fccb6a2e5482f17997efd4a74b8200d5b4babc035",{"type":1010,"url":1466},{"type":1002,"url":4370},[1470,1471,1472,1473,1474,1475],{"id":239,"slug":4540,"dossier":47,"summary":4541,"aliases":4542,"sourceIds":4546,"published":4547,"modified":4548,"checkedAt":7,"severity":4549,"references":4553,"versionKeys":4565,"packageCount":32,"repositoryCount":1326},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[4543,4544,4545],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[239,4545],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[4550,4551],{"type":998,"score":2460},{"type":1037,"score":4552},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[4554,4555,4557,4559,4561,4563,4564],{"type":1002,"url":3259},{"type":1103,"url":4556},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1005,"url":4558},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1103,"url":4560},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1103,"url":4562},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1010,"url":1011},{"type":1005,"url":2107},[1015,1016,1017,1018,1019,1020,1021,1022],{"id":240,"slug":4567,"dossier":47,"summary":4568,"aliases":4569,"sourceIds":4572,"published":4573,"modified":4574,"checkedAt":7,"severity":4575,"references":4578,"versionKeys":4591,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[4570,4571],"CVE-2024-56326","PYSEC-2026-1475",[240,4571],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[4576,4577],{"type":1037,"score":2462},{"type":998,"score":3358},[4579,4581,4583,4585,4586,4587,4588,4589],{"type":1002,"url":4580},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1005,"url":4582},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1103,"url":4584},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1010,"url":3367},{"type":1002,"url":3860},{"type":1002,"url":3369},{"type":1010,"url":3373},{"type":1005,"url":4590},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3377],{"id":241,"slug":4593,"dossier":47,"summary":4594,"aliases":4595,"sourceIds":4598,"published":4599,"modified":4600,"checkedAt":7,"severity":4601,"references":4603,"versionKeys":4611,"packageCount":32,"repositoryCount":1025},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[4596,4597],"BIT-pillow-2026-112897","CVE-2026-112897",[241],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[4602],{"type":998,"score":2828},[4604,4606,4608,4609,4610],{"type":1002,"url":4605},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1005,"url":4607},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1002,"url":3215},{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":242,"slug":4613,"dossier":47,"summary":4614,"aliases":4615,"sourceIds":4618,"published":4619,"modified":4620,"checkedAt":7,"severity":4621,"references":4624,"versionKeys":4630,"packageCount":32,"repositoryCount":1025},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[4616,4617],"CVE-2026-44431","PYSEC-2026-141",[242,4617],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[4622,4623],{"type":1037,"score":2227},{"type":998,"score":3153},[4625,4627,4629],{"type":1005,"url":4626},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1005,"url":4628},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1010,"url":1317},[1321,1322,1323,1324,1325,2791],{"id":243,"slug":4632,"dossier":47,"summary":4633,"aliases":4634,"sourceIds":4638,"published":4639,"modified":4640,"checkedAt":7,"severity":4641,"references":4645,"versionKeys":4663,"packageCount":32,"repositoryCount":2212},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[4635,4636,4637],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[243],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[4642,4643],{"type":1037,"score":2857},{"type":998,"score":4644},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[4646,4648,4650,4652,4654,4656,4657,4659,4661],{"type":1005,"url":4647},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1002,"url":4649},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1002,"url":4651},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1002,"url":4653},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1002,"url":4655},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1010,"url":1377},{"type":1002,"url":4658},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1002,"url":4660},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1002,"url":4662},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1389,1390,1391,2205,2206,2207,2208,2209,2210,2211],{"id":244,"slug":4665,"dossier":47,"summary":4666,"aliases":4667,"sourceIds":4670,"published":4671,"modified":4672,"checkedAt":7,"severity":4673,"references":4676,"versionKeys":4689,"packageCount":32,"repositoryCount":369},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[4668,4669],"CVE-2026-31958","PYSEC-2026-140",[244,4669],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[4674,4675],{"type":1037,"score":1179},{"type":998,"score":1880},[4677,4679,4681,4683,4685,4686,4687],{"type":1005,"url":4678},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1005,"url":4680},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1002,"url":4682},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1002,"url":4684},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1010,"url":1466},{"type":1002,"url":2503},{"type":1002,"url":4688},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1470,1471,1472,1473],{"id":245,"slug":4691,"dossier":47,"summary":4692,"aliases":4693,"sourceIds":4696,"published":4697,"modified":4698,"checkedAt":7,"severity":4699,"references":4702,"versionKeys":4716,"packageCount":32,"repositoryCount":2212},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[4694,4695],"CVE-2026-22701","PYSEC-2026-1374",[245,4695],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[4700],{"type":1037,"score":4701},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[4703,4705,4707,4709,4711,4712,4714],{"type":1002,"url":4704},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1005,"url":4706},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1002,"url":4708},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1002,"url":4710},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1010,"url":1859},{"type":1010,"url":4713},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1005,"url":4715},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2310,2311,2312,2313],{"id":246,"slug":4718,"dossier":47,"summary":4719,"aliases":4720,"sourceIds":4722,"published":4723,"modified":4724,"checkedAt":7,"severity":4725,"references":4727,"versionKeys":4738,"packageCount":32,"repositoryCount":66},"ghsa-r4j5-9xpp-3985-880dec7e","Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks",[4721],"CVE-2026-115927",[246],"2026-10-28T22:43:50Z","2026-10-28T23:00:04.082411607Z",[4726],{"type":1037,"score":1455},[4728,4730,4732,4734,4736,4737],{"type":1002,"url":4729},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-r4j5-9xpp-3985",{"type":1005,"url":4731},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115927",{"type":1002,"url":4733},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3773",{"type":1002,"url":4735},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fceab33581489751a66fba8566ad6d5960d4b01c8",{"type":1010,"url":1466},{"type":1002,"url":4370},[1470,1471,1472,1473,1474,1475],{"id":247,"slug":4740,"dossier":47,"summary":4741,"aliases":4742,"sourceIds":4746,"published":4747,"modified":4748,"checkedAt":7,"severity":4749,"references":4752,"versionKeys":4766,"packageCount":32,"repositoryCount":1326},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[4743,4744,4745],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[247,4745],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[4750,4751],{"type":1037,"score":1365},{"type":998,"score":2093},[4753,4755,4757,4759,4761,4762,4763,4764],{"type":1002,"url":4754},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1005,"url":4756},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1002,"url":4758},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1002,"url":4760},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1010,"url":1011},{"type":1002,"url":2107},{"type":1010,"url":2159},{"type":1005,"url":4765},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1015,1016,1017,1018,1019,1020,1021,1022],{"id":248,"slug":4768,"dossier":47,"summary":4769,"aliases":4770,"sourceIds":4773,"published":4774,"modified":4775,"checkedAt":7,"severity":4776,"references":4779,"versionKeys":4789,"packageCount":32,"repositoryCount":34},"ghsa-r9mr-m37c-5fr3-d43000fc","GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution",[4771,4772],"CVE-2026-73625","PYSEC-2026-3953",[248,4772],"2026-07-24T16:42:57Z","2026-09-10T13:10:47.448946391Z",[4777,4778],{"type":1037,"score":1271},{"type":998,"score":4135},[4780,4782,4783,4785,4786,4787],{"type":1043,"url":4781},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-r9mr-m37c-5fr3",{"type":1002,"url":2332},{"type":1002,"url":4784},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe8d0fbf774d1f6baa3b481adfe48bd262e43b453",{"type":1010,"url":1052},{"type":1002,"url":2337},{"type":1005,"url":4788},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-kwarg-value-smuggling",[1060,1061,1062],{"id":249,"slug":4791,"dossier":47,"summary":4792,"aliases":4793,"sourceIds":4796,"published":4797,"modified":4798,"checkedAt":7,"severity":4799,"references":4802,"versionKeys":4811,"packageCount":32,"repositoryCount":1025},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[4794,4795],"BIT-pillow-2026-112898","CVE-2026-112898",[249],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[4800],{"type":998,"score":4801},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4803,4805,4807,4809,4810],{"type":1002,"url":4804},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1005,"url":4806},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1002,"url":4808},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":250,"slug":4813,"dossier":47,"summary":4814,"aliases":4815,"sourceIds":4817,"published":4818,"modified":4819,"checkedAt":7,"severity":4820,"references":4822,"versionKeys":4833,"packageCount":32,"repositoryCount":1867},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[4816],"CVE-2026-112939",[250],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[4821],{"type":1037,"score":3609},[4823,4825,4827,4829,4831,4832],{"type":1002,"url":4824},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1005,"url":4826},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1002,"url":4828},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1002,"url":4830},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1010,"url":1859},{"type":1002,"url":1861},[1863,1864,1865,1866],{"id":251,"slug":4835,"dossier":47,"summary":4836,"aliases":4837,"sourceIds":4840,"published":4841,"modified":4842,"checkedAt":7,"severity":4843,"references":4846,"versionKeys":4859,"packageCount":32,"repositoryCount":2109},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[4838,4839],"CVE-2026-25087","PYSEC-2026-113",[251,4839],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[4844],{"type":1037,"score":4845},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[4847,4849,4851,4853,4855,4857],{"type":1005,"url":4848},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1103,"url":4850},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1010,"url":4852},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1002,"url":4854},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1005,"url":4856},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1005,"url":4858},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[4860,4861,4862,4863],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":252,"slug":4865,"dossier":47,"summary":4866,"aliases":4867,"sourceIds":4870,"published":4871,"modified":4872,"checkedAt":7,"severity":4873,"references":4875,"versionKeys":4883,"packageCount":32,"repositoryCount":34},"ghsa-rpm5-65cw-6hj4-6c97dd77","GitPython has Command Injection via Git options bypass",[4868,4869],"CVE-2026-42215","PYSEC-2026-2160",[252,4869],"2026-04-25T23:42:16Z","2026-09-10T03:51:03.167884784Z",[4874],{"type":1037,"score":1271},[4876,4878,4880,4881],{"type":1043,"url":4877},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1005,"url":4879},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42215",{"type":1010,"url":1052},{"type":1103,"url":4882},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.47",[1060,1061,1062],{"id":253,"slug":4885,"dossier":47,"summary":4886,"aliases":4887,"sourceIds":4891,"published":3483,"modified":4892,"checkedAt":7,"severity":4893,"references":4896,"versionKeys":4914,"packageCount":32,"repositoryCount":1326},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[4888,4889,4890],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[253],"2026-09-10T03:49:48.419046410Z",[4894,4895],{"type":1037,"score":2857},{"type":998,"score":4644},[4897,4899,4901,4903,4905,4907,4908,4910,4912],{"type":1005,"url":4898},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1002,"url":4900},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1002,"url":4902},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1002,"url":4904},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1002,"url":4906},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1010,"url":1377},{"type":1002,"url":4909},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1002,"url":4911},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1002,"url":4913},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[4915,4916,4917,1389,1390,1391,2205,2206,2207,2208,2209,2210,2211],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":254,"slug":4919,"dossier":47,"summary":4920,"aliases":4921,"sourceIds":4924,"published":4925,"modified":4926,"checkedAt":7,"severity":4927,"references":4929,"versionKeys":4947,"packageCount":32,"repositoryCount":34},"ghsa-rwj8-pgh3-r573-0bf779f8","GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL",[4922,4923],"CVE-2026-67322","PYSEC-2026-3842",[254,4923],"2026-07-21T22:06:09Z","2026-09-24T18:28:17.149390188Z",[4928],{"type":1037,"score":2826},[4930,4932,4934,4936,4937,4939,4940,4942,4944,4945],{"type":1002,"url":4931},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1005,"url":4933},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67322",{"type":1002,"url":4935},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2172",{"type":1002,"url":2938},{"type":1005,"url":4938},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1010,"url":1052},{"type":1002,"url":4941},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.52",{"type":1002,"url":4943},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3842.yaml",{"type":1010,"url":1287},{"type":1002,"url":4946},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-clone-from",[1060,1061,1062],{"id":255,"slug":4949,"dossier":47,"summary":4950,"aliases":4951,"sourceIds":4953,"published":4954,"modified":4955,"checkedAt":7,"severity":4956,"references":4958,"versionKeys":4967,"packageCount":32,"repositoryCount":1867},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[4952],"CVE-2026-112940",[255],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[4957],{"type":1037,"score":2435},[4959,4961,4963,4964,4965,4966],{"type":1002,"url":4960},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1005,"url":4962},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1002,"url":3107},{"type":1002,"url":3109},{"type":1010,"url":1859},{"type":1002,"url":1861},[1863,1864,1865,1866],{"id":256,"slug":4969,"dossier":47,"summary":4970,"aliases":4971,"sourceIds":4974,"published":4975,"modified":4976,"checkedAt":7,"severity":4977,"references":4979,"versionKeys":4987,"packageCount":32,"repositoryCount":34},"ghsa-v87r-6q3f-2j67-81913ca6","GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath",[4972,4973],"CVE-2026-44244","PYSEC-2026-2163",[256,4973],"2026-05-06T21:58:00Z","2026-09-10T03:50:47.691444343Z",[4978],{"type":1037,"score":2462},[4980,4982,4984,4985],{"type":1043,"url":4981},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-v87r-6q3f-2j67",{"type":1005,"url":4983},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44244",{"type":1010,"url":1052},{"type":1103,"url":4986},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.49",[1060,1061,1062],{"id":257,"slug":4989,"dossier":47,"summary":4990,"aliases":4991,"sourceIds":4995,"published":4996,"modified":4997,"checkedAt":7,"severity":4998,"references":5000,"versionKeys":5011,"packageCount":32,"repositoryCount":1326},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[4992,4993,4994],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[257,4994],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[4999],{"type":1037,"score":1244},[5001,5003,5005,5007,5009,5010],{"type":1005,"url":5002},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1005,"url":5004},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1370,"url":5006},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1103,"url":5008},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1010,"url":1011},{"type":1005,"url":1013},[1017,1018,1019,1020,1021,1022,1023,1024],{"id":258,"slug":5013,"dossier":47,"summary":5014,"aliases":5015,"sourceIds":5019,"published":3483,"modified":5020,"checkedAt":7,"severity":5021,"references":5024,"versionKeys":5039,"packageCount":32,"repositoryCount":66},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[5016,5017,5018],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[258],"2026-06-10T17:41:15.774477397Z",[5022,5023],{"type":1037,"score":2857},{"type":998,"score":3488},[5025,5027,5028,5029,5030,5032,5033,5035,5037],{"type":1005,"url":5026},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1002,"url":3493},{"type":1002,"url":3495},{"type":1002,"url":3497},{"type":1002,"url":5031},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1010,"url":1377},{"type":1002,"url":5034},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1002,"url":5036},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1002,"url":5038},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1389,1390,1391,2205,2206,2207,2208],{"id":259,"slug":5041,"dossier":47,"summary":5042,"aliases":5043,"sourceIds":5047,"published":5048,"modified":5049,"checkedAt":7,"severity":5050,"references":5052,"versionKeys":5066,"packageCount":32,"repositoryCount":1636},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5044,5045,5046],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[259,5046],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5051],{"type":998,"score":1880},[5053,5055,5057,5059,5061,5062,5063,5064],{"type":1002,"url":5054},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1005,"url":5056},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1002,"url":5058},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1002,"url":5060},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1010,"url":1011},{"type":1002,"url":2157},{"type":1010,"url":2159},{"type":1005,"url":5065},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":260,"slug":5068,"dossier":47,"summary":5069,"aliases":5070,"sourceIds":5073,"published":5074,"modified":5075,"checkedAt":7,"severity":5076,"references":5079,"versionKeys":5094,"packageCount":32,"repositoryCount":399},"ghsa-vqfr-h8mv-ghfj-49515033","h11 accepts some malformed Chunked-Encoding bodies",[5071,5072],"CVE-2025-43859","PYSEC-2026-348",[260,5072],"2025-04-24T16:07:56Z","2026-10-27T16:45:03.535584040Z",[5077],{"type":1037,"score":5078},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[5080,5082,5084,5086,5088,5090,5092],{"type":1002,"url":5081},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fsecurity\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",{"type":1005,"url":5083},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-43859",{"type":1002,"url":5085},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fcommit\u002F114803a29ce50116dc47951c690ad4892b1a36ed",{"type":1002,"url":5087},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fh11\u002FPYSEC-2026-348.yaml",{"type":1010,"url":5089},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11",{"type":1010,"url":5091},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fh11",{"type":1005,"url":5093},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",[5095],"pypi:h11@0.14.0",{"id":261,"slug":5097,"dossier":47,"summary":5098,"aliases":5099,"sourceIds":5102,"published":5103,"modified":5104,"checkedAt":7,"severity":5105,"references":5111,"versionKeys":5137,"packageCount":32,"repositoryCount":399},"ghsa-vqwp-45wm-r9r5-eaa960a2","Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission",[5100,5101],"CVE-2026-10804","PYSEC-2026-212",[261,5101],"2026-06-04T12:16:24.620Z","2026-07-23T15:00:23.893493649Z",[5106,5108,5110],{"type":1037,"score":5107},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":998,"score":5109},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1037,"score":3609},[5112,5114,5116,5118,5120,5122,5124,5125,5127,5129,5131,5133,5135],{"type":1005,"url":5113},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10804",{"type":1103,"url":5115},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fissues\u002F14622",{"type":1103,"url":5117},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F14635",{"type":1002,"url":5119},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F15397",{"type":1002,"url":5121},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002Ffec0f584dae9261abed16cad35b32922104bb933",{"type":1002,"url":5123},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstreamlit\u002FPYSEC-2026-212.yaml",{"type":1010,"url":2643},{"type":1005,"url":5126},"https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-10804",{"type":1005,"url":5128},"https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F831508",{"type":1005,"url":5130},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253",{"type":1370,"url":5132},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253\u002Fcti",{"type":1002,"url":5134},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002F",{"type":1005,"url":5136},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqwp-45wm-r9r5",[2647,2648,2649],{"id":262,"slug":5139,"dossier":47,"summary":5140,"aliases":5141,"sourceIds":5143,"published":5144,"modified":5145,"checkedAt":7,"severity":5146,"references":5148,"versionKeys":5155,"packageCount":32,"repositoryCount":1025},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[5142],"CVE-2026-112899",[262],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[5147],{"type":998,"score":2252},[5149,5151,5153,5154],{"type":1002,"url":5150},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1002,"url":5152},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":263,"slug":5157,"dossier":91,"summary":5158,"aliases":5159,"sourceIds":5162,"published":5163,"modified":5164,"checkedAt":7,"severity":5165,"references":5167,"versionKeys":5179,"packageCount":32,"repositoryCount":2267},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[5160,5161],"CVE-2026-97689","PYSEC-2026-4177",[263,5161],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[5166],{"type":998,"score":1302},[5168,5170,5172,5174,5175,5176,5177],{"type":1002,"url":5169},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1005,"url":5171},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1002,"url":5173},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1010,"url":1317},{"type":1002,"url":2786},{"type":1010,"url":1319},{"type":1005,"url":5178},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1321,1322,1323,1324,1325,2791,2792],{"id":264,"slug":5181,"dossier":47,"summary":5182,"aliases":5183,"sourceIds":5186,"published":5187,"modified":5188,"checkedAt":7,"severity":5189,"references":5192,"versionKeys":5209,"packageCount":32,"repositoryCount":2212},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[5184,5185],"CVE-2025-68146","PYSEC-2026-1375",[264,5185],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[5190],{"type":1037,"score":5191},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5193,5195,5197,5198,5200,5202,5204,5205,5207],{"type":1002,"url":5194},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1002,"url":5196},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1010,"url":1859},{"type":1002,"url":5199},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1002,"url":5201},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1002,"url":5203},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1010,"url":4713},{"type":1005,"url":5206},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1005,"url":5208},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2310,2311,2312,2313],{"id":265,"slug":5211,"dossier":47,"summary":5212,"aliases":5213,"sourceIds":5216,"published":5217,"modified":5218,"checkedAt":7,"severity":5219,"references":5222,"versionKeys":5231,"packageCount":32,"repositoryCount":1025},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[5214,5215],"BIT-pillow-2026-112900","CVE-2026-112900",[265],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[5220],{"type":998,"score":5221},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[5223,5225,5227,5229,5230],{"type":1002,"url":5224},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1005,"url":5226},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1002,"url":5228},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":266,"slug":5233,"dossier":47,"summary":5234,"aliases":5235,"sourceIds":5237,"published":5238,"modified":5239,"checkedAt":7,"severity":5240,"references":5242,"versionKeys":5251,"packageCount":32,"repositoryCount":34},"ghsa-w8jc-g24h-crhw-5553514f","GitPython command wrappers omit unsafe protocol and option checks",[5236],"CVE-2026-110857",[266],"2026-10-27T15:26:43Z","2026-10-27T15:47:24.947223105Z",[5241],{"type":1037,"score":2687},[5243,5245,5247,5249,5250],{"type":1002,"url":5244},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-w8jc-g24h-crhw",{"type":1002,"url":5246},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2251",{"type":1002,"url":5248},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9ad28cc4c7176d22cd6181d69805058a719dd03b",{"type":1010,"url":1052},{"type":1002,"url":1083},[1060,1061,1062],{"id":267,"slug":5253,"dossier":47,"summary":5254,"aliases":5255,"sourceIds":5259,"published":5260,"modified":5261,"checkedAt":7,"severity":5262,"references":5265,"versionKeys":5303,"packageCount":32,"repositoryCount":1326},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[5256,5257,5258],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[267,5258],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[5263,5264],{"type":1037,"score":1179},{"type":998,"score":1880},[5266,5268,5270,5272,5274,5275,5277,5279,5281,5283,5285,5287,5288,5290,5292,5294,5295,5297,5299,5301],{"type":1002,"url":5267},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1005,"url":5269},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1002,"url":5271},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1002,"url":5273},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1010,"url":1011},{"type":1002,"url":5276},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1002,"url":5278},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1002,"url":5280},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1005,"url":5282},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1005,"url":5284},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1005,"url":5286},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1005,"url":3282},{"type":1005,"url":5289},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1005,"url":5291},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1005,"url":5293},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1005,"url":3284},{"type":1005,"url":5296},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1005,"url":5298},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1005,"url":5300},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1005,"url":5302},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1015,1016,1017,1018,1019,1020,1021,1022],{"id":268,"slug":5305,"dossier":47,"summary":5306,"aliases":5307,"sourceIds":5311,"published":5312,"modified":5313,"checkedAt":7,"severity":5314,"references":5317,"versionKeys":5326,"packageCount":32,"repositoryCount":1326},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[5308,5309,5310],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[268,5310],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[5315,5316],{"type":1037,"score":1365},{"type":998,"score":2093},[5318,5320,5322,5324,5325],{"type":1005,"url":5319},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1005,"url":5321},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1002,"url":5323},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1010,"url":1011},{"type":1005,"url":2107},[1015,1016,1017,1018,1019,1020,1021,1022],{"id":269,"slug":5328,"dossier":47,"summary":5329,"aliases":5330,"sourceIds":5332,"published":5333,"modified":5334,"checkedAt":7,"severity":5335,"references":5336,"versionKeys":5345,"packageCount":32,"repositoryCount":1025},"ghsa-wqgw-9xfh-qf2g-351c6680","Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data",[5331],"CVE-2026-128066",[269],"2026-11-12T23:35:39Z","2026-11-12T23:45:03.298534910Z",[],[5337,5339,5341,5343,5344],{"type":1002,"url":5338},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wqgw-9xfh-qf2g",{"type":1002,"url":5340},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4908edaf7f416616784c7c03d8c1a60153710ffb",{"type":1002,"url":5342},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4b63dffd8a6d980fa0e21b40832fa6cbf033eacf",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":270,"slug":5347,"dossier":47,"summary":5348,"aliases":5349,"sourceIds":5352,"published":5353,"modified":5354,"checkedAt":7,"severity":5355,"references":5357,"versionKeys":5372,"packageCount":32,"repositoryCount":34},"ghsa-wvpp-8hx9-p66j-188b3951","GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution",[5350,5351],"CVE-2026-76220","PYSEC-2026-3843",[270,5351],"2026-08-07T15:49:07Z","2026-09-10T12:26:01.792035310Z",[5356],{"type":1037,"score":1271},[5358,5360,5362,5363,5365,5366,5367,5369,5370],{"type":1002,"url":5359},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",{"type":1005,"url":5361},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76220",{"type":1002,"url":1703},{"type":1002,"url":5364},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F96a888f4d782cb2f80452148e48e60ce4af6d541",{"type":1010,"url":1052},{"type":1002,"url":1708},{"type":1002,"url":5368},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-execution-via-split-single-char-options",{"type":1010,"url":1287},{"type":1005,"url":5371},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",[1060,1061,1062],{"id":271,"slug":5374,"dossier":47,"summary":5375,"aliases":5376,"sourceIds":5378,"published":5379,"modified":5380,"checkedAt":7,"severity":5381,"references":5384,"versionKeys":5396,"packageCount":32,"repositoryCount":104},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[5377],"CVE-2026-91991",[271],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[5382],{"type":998,"score":5383},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5385,5387,5388,5390,5392,5394,5395],{"type":1002,"url":5386},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1002,"url":2715},{"type":1002,"url":5389},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1002,"url":5391},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1002,"url":5393},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1010,"url":1466},{"type":1002,"url":2722},[1474,1475],{"id":272,"slug":5398,"dossier":47,"summary":5399,"aliases":5400,"sourceIds":5403,"published":5404,"modified":5405,"checkedAt":7,"severity":5406,"references":5409,"versionKeys":5418,"packageCount":32,"repositoryCount":34},"ghsa-x2qx-6953-8485-107f8fe2","GitPython: Unsafe option check validates multi_options before shlex.split transformation",[5401,5402],"CVE-2026-42284","PYSEC-2026-2161",[272,5402],"2026-04-25T23:41:49Z","2026-09-10T03:51:03.787491179Z",[5407,5408],{"type":1037,"score":2518},{"type":1037,"score":1244},[5410,5412,5414,5415,5416],{"type":1043,"url":5411},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-x2qx-6953-8485",{"type":1005,"url":5413},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42284",{"type":1010,"url":1052},{"type":1103,"url":4882},{"type":1002,"url":5417},"https:\u002F\u002Fwww.tenable.com\u002Fcve\u002FCVE-2026-32686",[1060,1061,1062],{"id":273,"slug":5420,"dossier":47,"summary":5421,"aliases":5422,"sourceIds":5426,"published":5427,"modified":5428,"checkedAt":7,"severity":5429,"references":5434,"versionKeys":5450,"packageCount":32,"repositoryCount":104},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[5423,5424,5425],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[273],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[5430,5432],{"type":1037,"score":5431},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":998,"score":5433},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5435,5437,5439,5441,5443,5444,5446,5448],{"type":1005,"url":5436},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1002,"url":5438},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1002,"url":5440},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1002,"url":5442},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1010,"url":1377},{"type":1002,"url":5445},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1002,"url":5447},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1002,"url":5449},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1389,1390],{"id":274,"slug":5452,"dossier":47,"summary":5453,"aliases":5454,"sourceIds":5456,"published":5457,"modified":5458,"checkedAt":7,"severity":5459,"references":5462,"versionKeys":5471,"packageCount":32,"repositoryCount":1025},"ghsa-xcvg-w56q-r89m-87c516ac","Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size",[5455],"CVE-2026-128067",[274],"2026-11-12T23:34:43Z","2026-11-12T23:45:03.322245161Z",[5460],{"type":998,"score":5461},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[5463,5465,5467,5469,5470],{"type":1002,"url":5464},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xcvg-w56q-r89m",{"type":1002,"url":5466},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F53318b50e8e9e85a57d033d4d879e1398d97aeb1",{"type":1002,"url":5468},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fec5f1cbcf67275641abaad5c065ffb64a0a804a9",{"type":1010,"url":1011},{"type":1002,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":275,"slug":5473,"dossier":47,"summary":5474,"aliases":5475,"sourceIds":5479,"published":5480,"modified":5481,"checkedAt":7,"severity":5482,"references":5484,"versionKeys":5498,"packageCount":32,"repositoryCount":379},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[5476,5477,5478],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[275,5478],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[5483],{"type":1037,"score":2435},[5485,5487,5489,5491,5493,5495,5496],{"type":1005,"url":5486},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1005,"url":5488},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1002,"url":5490},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1103,"url":5492},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1002,"url":5494},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1010,"url":1011},{"type":1002,"url":5497},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1018],{"id":276,"slug":5500,"dossier":47,"summary":5501,"aliases":5502,"sourceIds":5506,"published":5507,"modified":5508,"checkedAt":7,"severity":5509,"references":5512,"versionKeys":5521,"packageCount":32,"repositoryCount":1025},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[5503,5504,5505],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[276,5505],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[5510,5511],{"type":998,"score":2252},{"type":1037,"score":1179},[5513,5515,5517,5519,5520],{"type":1103,"url":5514},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1005,"url":5516},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1103,"url":5518},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":277,"slug":5523,"dossier":47,"summary":5524,"aliases":5525,"sourceIds":5529,"published":5530,"modified":5531,"checkedAt":7,"severity":5532,"references":5535,"versionKeys":5546,"packageCount":32,"repositoryCount":1636},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[5526,5527,5528],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[277,5528],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[5533],{"type":1037,"score":5534},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5536,5538,5540,5542,5544,5545],{"type":1043,"url":5537},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1005,"url":5539},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1103,"url":5541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1103,"url":5543},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1010,"url":1011},{"type":1005,"url":2157},[1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":278,"slug":5548,"dossier":47,"summary":5549,"aliases":5550,"sourceIds":5551,"published":5552,"modified":5553,"checkedAt":7,"severity":5554,"references":5557,"versionKeys":5567,"packageCount":32,"repositoryCount":1025},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[278],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[5555],{"type":998,"score":5556},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[5558,5560,5562,5564,5565],{"type":1002,"url":5559},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1002,"url":5561},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1002,"url":5563},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1010,"url":2002},{"type":1002,"url":5566},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[2008,2009,2010,2011,3910,3911,3912,3913,3914,3915,3916,3917],{"id":279,"slug":5569,"dossier":47,"summary":5570,"aliases":5571,"sourceIds":5574,"published":5575,"modified":5576,"checkedAt":7,"severity":5577,"references":5582,"versionKeys":5597,"packageCount":32,"repositoryCount":1025},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[5572,5573],"CVE-2026-112902","PYSEC-2026-4363",[279,5573],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[5578,5580],{"type":998,"score":5579},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1037,"score":5581},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5583,5585,5587,5589,5591,5593,5595,5596],{"type":1103,"url":5584},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1005,"url":5586},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1002,"url":5588},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1103,"url":5590},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1103,"url":5592},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1002,"url":5594},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1010,"url":1011},{"type":1005,"url":1013},[1015,1016,1017,1018,1019,1020,1021,1022,1023,1024],{"id":280,"slug":5599,"dossier":47,"summary":84,"aliases":5600,"sourceIds":5603,"published":5604,"modified":5605,"checkedAt":7,"severity":5606,"references":5609,"versionKeys":5618,"packageCount":32,"repositoryCount":32},"pysec-2025-112-653e8a7c",[5601,5602],"CVE-2025-64429","GHSA-vmp8-hg63-v2hp",[280],"2025-11-12T22:15:49.813Z","2026-05-20T09:18:59.601738Z",[5607],{"type":1037,"score":5608},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[5610,5612,5614,5616],{"type":1002,"url":5611},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fblob\u002F029a5b87ff5b1cd22f7f9717d48cd8830d00807c\u002Fsrc\u002Fcommon\u002Frandom_engine.cpp#L20",{"type":1005,"url":5613},"https:\u002F\u002Fduckdb.org\u002F2025\u002F09\u002F16\u002Fannouncing-duckdb-140.html",{"type":1005,"url":5615},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fsecurity\u002Fadvisories\u002FGHSA-vmp8-hg63-v2hp",{"type":1103,"url":5617},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fpull\u002F17275",[5619],"pypi:duckdb@1.4.1",{"id":281,"slug":5621,"dossier":47,"summary":84,"aliases":5622,"sourceIds":5625,"published":5626,"modified":5627,"checkedAt":7,"severity":5628,"references":5630,"versionKeys":5639,"packageCount":32,"repositoryCount":104},"pysec-2025-198-62b25ed4",[5623,5624],"BIT-pytorch-2025-46148","CVE-2025-46148",[281],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[5629],{"type":1037,"score":2227},[5631,5633,5635,5637],{"type":1005,"url":5632},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1005,"url":5634},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1370,"url":5636},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1103,"url":5638},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1389,1390],{"id":282,"slug":5641,"dossier":47,"summary":84,"aliases":5642,"sourceIds":5645,"published":5646,"modified":5647,"checkedAt":7,"severity":5648,"references":5650,"versionKeys":5656,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[5643,5644],"BIT-pytorch-2025-46149","CVE-2025-46149",[282],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[5649],{"type":1037,"score":2227},[5651,5652,5654],{"type":1005,"url":5632},{"type":1370,"url":5653},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1103,"url":5655},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1390],{"id":283,"slug":5658,"dossier":47,"summary":84,"aliases":5659,"sourceIds":5662,"published":5663,"modified":5664,"checkedAt":7,"severity":5665,"references":5667,"versionKeys":5675,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[5660,5661],"BIT-pytorch-2025-46150","CVE-2025-46150",[283],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[5666],{"type":1037,"score":2227},[5668,5669,5671,5673],{"type":1005,"url":5632},{"type":1370,"url":5670},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1370,"url":5672},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1103,"url":5674},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1390],{"id":284,"slug":5677,"dossier":47,"summary":84,"aliases":5678,"sourceIds":5681,"published":5682,"modified":5683,"checkedAt":7,"severity":5684,"references":5686,"versionKeys":5692,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[5679,5680],"BIT-pytorch-2025-46152","CVE-2025-46152",[284],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[5685],{"type":1037,"score":1455},[5687,5688,5690],{"type":1005,"url":5632},{"type":1370,"url":5689},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1103,"url":5691},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1390],{"id":285,"slug":5694,"dossier":47,"summary":84,"aliases":5695,"sourceIds":5698,"published":5699,"modified":5700,"checkedAt":7,"severity":5701,"references":5703,"versionKeys":5713,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[5696,5697],"BIT-pytorch-2025-46153","CVE-2025-46153",[285],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[5702],{"type":1037,"score":2227},[5704,5706,5707,5709,5711],{"type":1002,"url":5705},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1005,"url":5632},{"type":1005,"url":5708},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1370,"url":5710},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1103,"url":5712},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1390],{"id":286,"slug":5715,"dossier":47,"summary":84,"aliases":5716,"sourceIds":5719,"published":5720,"modified":5721,"checkedAt":7,"severity":5722,"references":5724,"versionKeys":5729,"packageCount":32,"repositoryCount":3243},"pysec-2025-203-2febb201",[5717,5718],"BIT-pytorch-2025-55551","CVE-2025-55551",[286],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[5723],{"type":1037,"score":1179},[5725,5727],{"type":1005,"url":5726},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1370,"url":5728},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1389,1390,1391,2205,2206,2207],{"id":287,"slug":5731,"dossier":47,"summary":84,"aliases":5732,"sourceIds":5735,"published":5736,"modified":5737,"checkedAt":7,"severity":5738,"references":5740,"versionKeys":5744,"packageCount":32,"repositoryCount":3243},"pysec-2025-204-cdae47da",[5733,5734],"BIT-pytorch-2025-55552","CVE-2025-55552",[287],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[5739],{"type":1037,"score":1179},[5741,5742],{"type":1005,"url":5726},{"type":1370,"url":5743},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1389,1390,1391,2205,2206,2207],{"id":288,"slug":5746,"dossier":47,"summary":84,"aliases":5747,"sourceIds":5750,"published":5751,"modified":5752,"checkedAt":7,"severity":5753,"references":5755,"versionKeys":5761,"packageCount":32,"repositoryCount":399},"pysec-2025-205-fd5e58fd",[5748,5749],"BIT-pytorch-2025-55553","CVE-2025-55553",[288],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[5754],{"type":1037,"score":1179},[5756,5757,5759],{"type":1005,"url":5726},{"type":1370,"url":5758},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1103,"url":5760},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1389,1390,1391],{"id":289,"slug":5763,"dossier":47,"summary":84,"aliases":5764,"sourceIds":5767,"published":5768,"modified":5769,"checkedAt":7,"severity":5770,"references":5772,"versionKeys":5776,"packageCount":32,"repositoryCount":3243},"pysec-2025-206-58322476",[5765,5766],"BIT-pytorch-2025-55554","CVE-2025-55554",[289],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[5771],{"type":1037,"score":1455},[5773,5774],{"type":1005,"url":5726},{"type":1370,"url":5775},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1389,1390,1391,2205,2206,2207],{"id":290,"slug":5778,"dossier":47,"summary":84,"aliases":5779,"sourceIds":5782,"published":5783,"modified":5784,"checkedAt":7,"severity":5785,"references":5787,"versionKeys":5793,"packageCount":32,"repositoryCount":399},"pysec-2025-207-2abef3fc",[5780,5781],"BIT-pytorch-2025-55557","CVE-2025-55557",[290],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[5786],{"type":1037,"score":1179},[5788,5789,5791],{"type":1005,"url":5726},{"type":1370,"url":5790},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1103,"url":5792},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1389,1390,1391],{"id":291,"slug":5795,"dossier":47,"summary":84,"aliases":5796,"sourceIds":5799,"published":5800,"modified":5801,"checkedAt":7,"severity":5802,"references":5804,"versionKeys":5810,"packageCount":32,"repositoryCount":399},"pysec-2025-208-6e93fe9d",[5797,5798],"BIT-pytorch-2025-55558","CVE-2025-55558",[291],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[5803],{"type":1037,"score":1179},[5805,5806,5808],{"type":1005,"url":5726},{"type":1370,"url":5807},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1103,"url":5809},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1389,1390,1391],{"id":292,"slug":5812,"dossier":47,"summary":84,"aliases":5813,"sourceIds":5816,"published":5817,"modified":5818,"checkedAt":7,"severity":5819,"references":5821,"versionKeys":5827,"packageCount":32,"repositoryCount":399},"pysec-2025-209-e6f352b0",[5814,5815],"BIT-pytorch-2025-55560","CVE-2025-55560",[292],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[5820],{"type":1037,"score":1179},[5822,5823,5825],{"type":1005,"url":5726},{"type":1370,"url":5824},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1103,"url":5826},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1389,1390,1391],{"id":293,"slug":5829,"dossier":47,"summary":84,"aliases":5830,"sourceIds":5833,"published":5834,"modified":5835,"checkedAt":7,"severity":5836,"references":5838,"versionKeys":5849,"packageCount":32,"repositoryCount":1232},"pysec-2026-139-96951ff6",[5831,5832],"BIT-pytorch-2026-4538","CVE-2026-4538",[293],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[5837],{"type":1037,"score":2462},[5839,5841,5843,5845,5847],{"type":1002,"url":5840},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1005,"url":5842},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1005,"url":5844},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1370,"url":5846},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1103,"url":5848},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[4915,1389,1390,1391,2205,2206,2207,2208,2209,2210,2211],1794724256063]