[{"data":1,"prerenderedAt":6941},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14326":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":77,"entity":78,"evidence":326,"related":329},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-15T06:22:58.222Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-15T06:19:38.732Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5086,5074,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":66,"licenseExpressionCount":67,"knownLicensePackageCount":68,"unknownLicensePackageCount":69,"advisoryCount":70,"matchedAdvisoryRepositoryCount":71,"topPackage":72},2871,51,9941,11,63,2832,39,1120,43,{"id":73,"slug":74,"label":75,"repositoryCount":33,"repositoryShare":76},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":101,"artifactResolvedComponentCount":101,"exactManifestPinCount":39,"packageCount":101,"ecosystems":102,"aiPackageCount":34,"licenseExpressionCount":104,"unknownLicensePackageCount":32,"advisoryIds":105,"advisoryCount":324,"providers":325},"opencode:14326","opencode-14326",14326,"URBAN.KI Sovia","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia","f6e6627775fc285c9e233cb46571c0caeac39c5d","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia\u002F-\u002Fcommit\u002Ff6e6627775fc285c9e233cb46571c0caeac39c5d","2026-11-11T20:41:25.822Z","2026-11-11T20:41:10.000Z",{"complete":91,"entryCount":92,"truncated":47},true,70,[94],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},"uv-lock","ddc57ad0a634363d7ebefcbde0786b734f6f5f81","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-sovia\u002F-\u002Fblob\u002Ff6e6627775fc285c9e233cb46571c0caeac39c5d\u002Fuv.lock","d444dfad7ad27a1821923a1fc11b3ae40b7e686a1c28dd4b750c45fa1cfa35b8",270188,"parsed",111,[103],"pypi",15,[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323],"GHSA-22hg-r758-rrw9","GHSA-239g-whfq-7xj9","GHSA-23mf-xhv8-69c2","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-284h-m62q-gf8w","GHSA-29pf-2h5f-8g72","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3hv7-mjh2-fv65","GHSA-3j72-p6qg-6xp7","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59cr-6r3x-644w","GHSA-59p9-h35m-wg4g","GHSA-5cjw-f85j-cv6r","GHSA-5rjg-fvgr-3xxf","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-6497-prx7-gpmq","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69hj-f68j-2879","GHSA-69w3-r845-3855","GHSA-6p8h-3wgx-97gf","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-74r2-7ff9-mjj2","GHSA-7545-fcxq-7j24","GHSA-768j-98cg-p3fv","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-78g4-xqwv-q3g8","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7mwm-ghpf-9vrm","GHSA-7p48-42j8-8846","GHSA-83vg-56qc-22m7","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mcc-hrx5-hvxc","GHSA-8mx5-7m5m-r77g","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cwqr-hh33-gh44","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f9j4-qggq-h239","GHSA-fc9g-5qg7-mf45","GHSA-fgcw-684q-jj6r","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fpwr-67px-3qhx","GHSA-fq56-3cx3-fjxp","GHSA-fx3j-rwgx-fr94","GHSA-g4qv-2jxx-769h","GHSA-g5vv-9gxw-82hx","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gq48-pqfc-9p58","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-hxxf-235m-72v3","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg86-v3jv-hrpm","GHSA-jhmp-mqwm-3gq8","GHSA-jhr6-gm9c-rqjv","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jm78-9fvv-mhgr","GHSA-jw8x-6495-233v","GHSA-m64x-33q8-m5h7","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mrfp-p49p-3hf2","GHSA-mv93-w799-cj2w","GHSA-p4wg-p73j-c528","GHSA-p538-c434-8v24","GHSA-p8hx-v2p6-rp84","GHSA-pcg2-g6cj-q92c","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pw9p-v7r6-gx4p","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r4j5-9xpp-3985","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rcv9-qm8p-9p6j","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v4x8-3wr5-3wq8","GHSA-v87r-6q3f-2j67","GHSA-v9pv-5gc8-w2m6","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqwp-45wm-r9r5","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-w8jc-g24h-crhw","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wqgw-9xfh-qf2g","GHSA-wrfc-pvp9-mr9g","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-x9r9-c232-4q39","GHSA-xcvg-w56q-r89m","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xrqw-3rrv-vx5w","GHSA-xvh5-g6gv-559v","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139",218,[],{"files":327,"occurrenceCount":101},[328],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},{"packages":330,"vulnerabilities":1350},[331,345,356,366,376,385,394,405,415,425,436,446,456,465,475,486,495,504,513,522,531,540,549,558,568,578,587,596,605,614,623,632,641,650,659,668,677,686,695,704,713,722,731,740,749,758,767,776,785,794,803,812,821,830,839,848,858,867,876,885,893,902,911,920,929,938,947,956,965,973,982,991,1001,1010,1019,1028,1038,1047,1056,1065,1074,1083,1092,1101,1110,1119,1128,1137,1147,1156,1165,1174,1183,1192,1201,1210,1218,1227,1236,1245,1254,1263,1272,1281,1290,1299,1308,1315,1323,1332,1341],{"id":332,"slug":333,"identity":334,"label":335,"aiRelevant":91,"provider":336,"advisoryCount":339,"licenseExpressions":340,"versions":342,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":344},"package:pypi:transformers","transformers-65289303","pypi:transformers","Transformers",{"id":337,"label":338},"hugging-face","Hugging Face",27,[341],"Apache-2.0",[343],"4.51.0",[56],{"id":346,"slug":347,"identity":348,"label":349,"aiRelevant":91,"provider":84,"advisoryCount":350,"licenseExpressions":351,"versions":353,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":355},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[352],"BSD-3-Clause",[354],"2.9.1",[56],{"id":357,"slug":358,"identity":359,"label":360,"aiRelevant":91,"provider":361,"advisoryCount":32,"licenseExpressions":362,"versions":363,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":365},"package:pypi:sentence-transformers","sentence-transformers-3f3d7a36","pypi:sentence-transformers","Sentence Transformers",{"id":337,"label":338},[341],[364],"4.0.2",[56],{"id":367,"slug":368,"identity":369,"label":370,"aiRelevant":91,"provider":84,"advisoryCount":32,"licenseExpressions":371,"versions":373,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":375},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",[352,372],"non-standard",[374],"1.6.1",[56],{"id":377,"slug":378,"identity":379,"label":380,"aiRelevant":91,"provider":84,"advisoryCount":39,"licenseExpressions":381,"versions":382,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":384},"package:pypi:tokenizers","tokenizers-7ba00902","pypi:tokenizers","Hugging Face Tokenizers",[372],[383],"0.21.1",[56],{"id":386,"slug":387,"identity":388,"label":389,"aiRelevant":91,"provider":84,"advisoryCount":39,"licenseExpressions":390,"versions":391,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":393},"package:pypi:opencv-python","opencv-python-bfa06e24","pypi:opencv-python","OpenCV",[341],[392],"4.11.0.86",[56],{"id":395,"slug":396,"identity":397,"label":398,"aiRelevant":47,"provider":84,"advisoryCount":67,"licenseExpressions":399,"versions":402,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":404},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",[400,401],"HPND","MIT-CMU",[403],"11.1.0",[56],{"id":406,"slug":407,"identity":408,"label":409,"aiRelevant":47,"provider":84,"advisoryCount":410,"licenseExpressions":411,"versions":412,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":414},"package:pypi:gitpython","gitpython-dcd13009","pypi:gitpython","gitpython",37,[352],[413],"3.1.45",[56],{"id":416,"slug":417,"identity":418,"label":419,"aiRelevant":47,"provider":84,"advisoryCount":420,"licenseExpressions":421,"versions":422,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":424},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",20,[341],[423],"6.5.2",[56],{"id":426,"slug":427,"identity":428,"label":429,"aiRelevant":47,"provider":84,"advisoryCount":66,"licenseExpressions":430,"versions":433,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":435},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",[431,432],"MIT","Unlicense",[434],"3.18.0",[56],{"id":437,"slug":438,"identity":439,"label":440,"aiRelevant":47,"provider":84,"advisoryCount":441,"licenseExpressions":442,"versions":443,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":445},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[431],[444],"2.3.0",[56],{"id":447,"slug":448,"identity":449,"label":450,"aiRelevant":47,"provider":84,"advisoryCount":451,"licenseExpressions":452,"versions":453,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":455},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[352,372],[454],"3.1.6",[56],{"id":457,"slug":458,"identity":459,"label":460,"aiRelevant":47,"provider":84,"advisoryCount":451,"licenseExpressions":461,"versions":462,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":464},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[431],[463],"78.1.0",[56],{"id":466,"slug":467,"identity":468,"label":469,"aiRelevant":47,"provider":84,"advisoryCount":470,"licenseExpressions":471,"versions":472,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":474},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[341],[473],"2.32.3",[56],{"id":476,"slug":477,"identity":478,"label":479,"aiRelevant":47,"provider":84,"advisoryCount":480,"licenseExpressions":481,"versions":483,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":485},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",2,[482],"MPL-2.0",[484],"2025.1.31",[56],{"id":487,"slug":488,"identity":489,"label":490,"aiRelevant":47,"provider":84,"advisoryCount":480,"licenseExpressions":491,"versions":492,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":494},"package:pypi:protobuf","protobuf-6e30009a","pypi:protobuf","protobuf",[352],[493],"6.32.1",[56],{"id":496,"slug":497,"identity":498,"label":499,"aiRelevant":47,"provider":84,"advisoryCount":480,"licenseExpressions":500,"versions":501,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":503},"package:pypi:streamlit","streamlit-b61aa01e","pypi:streamlit","streamlit",[341],[502],"1.49.1",[56],{"id":505,"slug":506,"identity":507,"label":508,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":509,"versions":510,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":512},"package:pypi:duckdb","duckdb-8c0332c9","pypi:duckdb","duckdb",[431],[511],"1.3.2",[56],{"id":514,"slug":515,"identity":516,"label":517,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":518,"versions":519,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":521},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[431],[520],"4.55.8",[56],{"id":523,"slug":524,"identity":525,"label":526,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":527,"versions":528,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":530},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[352],[529],"2025.3.2",[56],{"id":532,"slug":533,"identity":534,"label":535,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":536,"versions":537,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":539},"package:pypi:geopandas","geopandas-968b51b0","pypi:geopandas","geopandas",[352],[538],"1.0.1",[56],{"id":541,"slug":542,"identity":543,"label":544,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":545,"versions":546,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":548},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[352,372],[547],"3.10",[56],{"id":550,"slug":551,"identity":552,"label":553,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":554,"versions":555,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":557},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[341,372],[556],"21.0.0",[56],{"id":559,"slug":560,"identity":561,"label":562,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":563,"versions":565,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":567},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[564],"BSD-2-Clause",[566],"2.19.1",[56],{"id":569,"slug":570,"identity":571,"label":572,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":573,"versions":575,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":577},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[574],"MIT AND MPL-2.0",[576],"4.67.1",[56],{"id":579,"slug":580,"identity":581,"label":582,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":583,"versions":584,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":586},"package:pypi:altair","altair-01b7f976","pypi:altair","altair",[352],[585],"5.5.0",[56],{"id":588,"slug":589,"identity":590,"label":591,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":592,"versions":593,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":595},"package:pypi:asttokens","asttokens-c349c5f9","pypi:asttokens","asttokens",[341],[594],"3.0.0",[56],{"id":597,"slug":598,"identity":599,"label":600,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":601,"versions":602,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":604},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[431],[603],"25.3.0",[56],{"id":606,"slug":607,"identity":608,"label":609,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":610,"versions":611,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":613},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[431],[612],"1.9.0",[56],{"id":615,"slug":616,"identity":617,"label":618,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":619,"versions":620,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":622},"package:pypi:branca","branca-e1a3550c","pypi:branca","branca",[431],[621],"0.8.1",[56],{"id":624,"slug":625,"identity":626,"label":627,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":628,"versions":629,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":631},"package:pypi:cachetools","cachetools-84fe6563","pypi:cachetools","cachetools",[431],[630],"6.2.0",[56],{"id":633,"slug":634,"identity":635,"label":636,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":637,"versions":638,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":640},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[431],[639],"3.4.1",[56],{"id":642,"slug":643,"identity":644,"label":645,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":646,"versions":647,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":649},"package:pypi:click","click-ef97f731","pypi:click","click",[352,372],[648],"8.2.1",[56],{"id":651,"slug":652,"identity":653,"label":654,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":655,"versions":656,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":658},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[372],[657],"0.4.6",[56],{"id":660,"slug":661,"identity":662,"label":663,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":664,"versions":665,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":667},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[352],[666],"1.3.1",[56],{"id":669,"slug":670,"identity":671,"label":672,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":673,"versions":674,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":676},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[352],[675],"0.12.1",[56],{"id":678,"slug":679,"identity":680,"label":681,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":682,"versions":683,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":685},"package:pypi:decorator","decorator-500c1fb8","pypi:decorator","decorator",[564,372],[684],"5.2.1",[56],{"id":687,"slug":688,"identity":689,"label":690,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":691,"versions":692,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":694},"package:pypi:executing","executing-36845a5b","pypi:executing","executing",[431],[693],"2.2.0",[56],{"id":696,"slug":697,"identity":698,"label":699,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":700,"versions":701,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":703},"package:pypi:folium","folium-6e89a148","pypi:folium","folium",[431],[702],"0.20.0",[56],{"id":705,"slug":706,"identity":707,"label":708,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":709,"versions":710,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":712},"package:pypi:ftfy","ftfy-b3100e16","pypi:ftfy","ftfy",[341],[711],"6.3.1",[56],{"id":714,"slug":715,"identity":716,"label":717,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":718,"versions":719,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":721},"package:pypi:gitdb","gitdb-dac4580b","pypi:gitdb","gitdb",[372],[720],"4.0.12",[56],{"id":723,"slug":724,"identity":725,"label":726,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":727,"versions":728,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":730},"package:pypi:huggingface-hub","huggingface-hub-443ec6ef","pypi:huggingface-hub","huggingface-hub",[341],[729],"0.30.1",[56],{"id":732,"slug":733,"identity":734,"label":735,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":736,"versions":737,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":739},"package:pypi:ipython","ipython-7a140323","pypi:ipython","ipython",[352],[738],"9.2.0",[56],{"id":741,"slug":742,"identity":743,"label":744,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":745,"versions":746,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":748},"package:pypi:ipython-pygments-lexers","ipython-pygments-lexers-6216051e","pypi:ipython-pygments-lexers","ipython-pygments-lexers",[372],[747],"1.1.1",[56],{"id":750,"slug":751,"identity":752,"label":753,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":754,"versions":755,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":757},"package:pypi:jedi","jedi-9eb0c211","pypi:jedi","jedi",[431],[756],"0.19.2",[56],{"id":759,"slug":760,"identity":761,"label":762,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":763,"versions":764,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":766},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[352],[765],"1.4.2",[56],{"id":768,"slug":769,"identity":770,"label":771,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":772,"versions":773,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":775},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[431],[774],"4.25.1",[56],{"id":777,"slug":778,"identity":779,"label":780,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":781,"versions":782,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":784},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[431],[783],"2025.9.1",[56],{"id":786,"slug":787,"identity":788,"label":789,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":790,"versions":791,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":793},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[372],[792],"1.4.8",[56],{"id":795,"slug":796,"identity":797,"label":798,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":799,"versions":800,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":802},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[352],[801],"3.0.2",[56],{"id":804,"slug":805,"identity":806,"label":807,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":808,"versions":809,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":811},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[372],[810],"3.10.0",[56],{"id":813,"slug":814,"identity":815,"label":816,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":817,"versions":818,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":820},"package:pypi:matplotlib-inline","matplotlib-inline-50f95e0d","pypi:matplotlib-inline","matplotlib-inline",[352],[819],"0.1.7",[56],{"id":822,"slug":823,"identity":824,"label":825,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":826,"versions":827,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":829},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[352],[828],"1.3.0",[56],{"id":831,"slug":832,"identity":833,"label":834,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":835,"versions":836,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":838},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[431],[837],"2.4.0",[56],{"id":840,"slug":841,"identity":842,"label":843,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":844,"versions":845,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":847},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[352,372],[846],"3.4.2",[56],{"id":849,"slug":850,"identity":851,"label":852,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":853,"versions":855,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":857},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[854,372],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[856],"2.3.2",[56],{"id":859,"slug":860,"identity":861,"label":862,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":863,"versions":864,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":866},"package:pypi:nvidia-cublas-cu12","nvidia-cublas-cu12-1d052261","pypi:nvidia-cublas-cu12","nvidia-cublas-cu12",[372],[865],"12.8.3.14",[56],{"id":868,"slug":869,"identity":870,"label":871,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":872,"versions":873,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":875},"package:pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12-973480f1","pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12",[372],[874],"12.8.57",[56],{"id":877,"slug":878,"identity":879,"label":880,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":881,"versions":882,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":884},"package:pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12-e32b7f38","pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12",[372],[883],"12.8.61",[56],{"id":886,"slug":887,"identity":888,"label":889,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":890,"versions":891,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":892},"package:pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12-2b875d2a","pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12",[372],[874],[56],{"id":894,"slug":895,"identity":896,"label":897,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":898,"versions":899,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":901},"package:pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12-a21dce6d","pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12",[372],[900],"9.7.1.26",[56],{"id":903,"slug":904,"identity":905,"label":906,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":907,"versions":908,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":910},"package:pypi:nvidia-cufft-cu12","nvidia-cufft-cu12-21ff54dd","pypi:nvidia-cufft-cu12","nvidia-cufft-cu12",[372],[909],"11.3.3.41",[56],{"id":912,"slug":913,"identity":914,"label":915,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":916,"versions":917,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":919},"package:pypi:nvidia-cufile-cu12","nvidia-cufile-cu12-14048140","pypi:nvidia-cufile-cu12","nvidia-cufile-cu12",[372],[918],"1.13.0.11",[56],{"id":921,"slug":922,"identity":923,"label":924,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":925,"versions":926,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":928},"package:pypi:nvidia-curand-cu12","nvidia-curand-cu12-2fed778b","pypi:nvidia-curand-cu12","nvidia-curand-cu12",[372],[927],"10.3.9.55",[56],{"id":930,"slug":931,"identity":932,"label":933,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":934,"versions":935,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":937},"package:pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12-7db0a33a","pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12",[372],[936],"11.7.2.55",[56],{"id":939,"slug":940,"identity":941,"label":942,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":943,"versions":944,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":946},"package:pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12-d7e6a309","pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12",[372],[945],"12.5.7.53",[56],{"id":948,"slug":949,"identity":950,"label":951,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":952,"versions":953,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":955},"package:pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12-97587f50","pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12",[372],[954],"0.6.3",[56],{"id":957,"slug":958,"identity":959,"label":960,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":961,"versions":962,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":964},"package:pypi:nvidia-nccl-cu12","nvidia-nccl-cu12-90361558","pypi:nvidia-nccl-cu12","nvidia-nccl-cu12",[352],[963],"2.26.2",[56],{"id":966,"slug":967,"identity":968,"label":969,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":970,"versions":971,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":972},"package:pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12-6d08af75","pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12",[372],[883],[56],{"id":974,"slug":975,"identity":976,"label":977,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":978,"versions":979,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":981},"package:pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12-9a2d0378","pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12",[341,372],[980],"12.8.55",[56],{"id":983,"slug":984,"identity":985,"label":986,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":987,"versions":988,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":990},"package:pypi:open-clip-torch","open-clip-torch-1f82ec28","pypi:open-clip-torch","open-clip-torch",[431],[989],"2.32.0",[56],{"id":992,"slug":993,"identity":994,"label":995,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":996,"versions":998,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1000},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[997,372],"Apache-2.0 OR BSD-2-Clause",[999],"24.2",[56],{"id":1002,"slug":1003,"identity":1004,"label":1005,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1006,"versions":1007,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1009},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[352,372],[1008],"2.2.3",[56],{"id":1011,"slug":1012,"identity":1013,"label":1014,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1015,"versions":1016,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1018},"package:pypi:pandas-stubs","pandas-stubs-b4eaabf3","pypi:pandas-stubs","pandas-stubs",[352],[1017],"2.3.2.250827",[56],{"id":1020,"slug":1021,"identity":1022,"label":1023,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1024,"versions":1025,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1027},"package:pypi:parso","parso-fa59fdde","pypi:parso","parso",[431],[1026],"0.8.4",[56],{"id":1029,"slug":1030,"identity":1031,"label":1032,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1033,"versions":1035,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1037},"package:pypi:pexpect","pexpect-9ad65a0c","pypi:pexpect","pexpect",[1034],"ISC",[1036],"4.9.0",[56],{"id":1039,"slug":1040,"identity":1041,"label":1042,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1043,"versions":1044,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1046},"package:pypi:prompt-toolkit","prompt-toolkit-e6f4118a","pypi:prompt-toolkit","prompt-toolkit",[352,372],[1045],"3.0.51",[56],{"id":1048,"slug":1049,"identity":1050,"label":1051,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1052,"versions":1053,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1055},"package:pypi:ptyprocess","ptyprocess-ec2650c7","pypi:ptyprocess","ptyprocess",[1034],[1054],"0.7.0",[56],{"id":1057,"slug":1058,"identity":1059,"label":1060,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1061,"versions":1062,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1064},"package:pypi:pure-eval","pure-eval-24d2bc1c","pypi:pure-eval","pure-eval",[431],[1063],"0.2.3",[56],{"id":1066,"slug":1067,"identity":1068,"label":1069,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1070,"versions":1071,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1073},"package:pypi:pydeck","pydeck-75380c92","pypi:pydeck","pydeck",[341],[1072],"0.9.1",[56],{"id":1075,"slug":1076,"identity":1077,"label":1078,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1079,"versions":1080,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1082},"package:pypi:pyogrio","pyogrio-ff34272a","pypi:pyogrio","pyogrio",[431],[1081],"0.10.0",[56],{"id":1084,"slug":1085,"identity":1086,"label":1087,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1088,"versions":1089,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1091},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[431],[1090],"3.2.1",[56],{"id":1093,"slug":1094,"identity":1095,"label":1096,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1097,"versions":1098,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1100},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[431],[1099],"3.7.0",[56],{"id":1102,"slug":1103,"identity":1104,"label":1105,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1106,"versions":1107,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1109},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[372],[1108],"2.9.0.post0",[56],{"id":1111,"slug":1112,"identity":1113,"label":1114,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1115,"versions":1116,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1118},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[431],[1117],"2025.1",[56],{"id":1120,"slug":1121,"identity":1122,"label":1123,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1124,"versions":1125,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1127},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[431],[1126],"6.0.2",[56],{"id":1129,"slug":1130,"identity":1131,"label":1132,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1133,"versions":1134,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1136},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[431],[1135],"0.36.2",[56],{"id":1138,"slug":1139,"identity":1140,"label":1141,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1142,"versions":1144,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1146},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[341,1143],"Apache-2.0 AND CNRI-Python",[1145],"2024.11.6",[56],{"id":1148,"slug":1149,"identity":1150,"label":1151,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1152,"versions":1153,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1155},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[431],[1154],"0.27.1",[56],{"id":1157,"slug":1158,"identity":1159,"label":1160,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1161,"versions":1162,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1164},"package:pypi:safetensors","safetensors-2a32c77a","pypi:safetensors","safetensors",[372],[1163],"0.5.3",[56],{"id":1166,"slug":1167,"identity":1168,"label":1169,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1170,"versions":1171,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1173},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[372],[1172],"1.15.2",[56],{"id":1175,"slug":1176,"identity":1177,"label":1178,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1179,"versions":1180,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1182},"package:pypi:seaborn","seaborn-1018de9a","pypi:seaborn","seaborn",[372],[1181],"0.13.2",[56],{"id":1184,"slug":1185,"identity":1186,"label":1187,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1188,"versions":1189,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1191},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[352],[1190],"2.0.7",[56],{"id":1193,"slug":1194,"identity":1195,"label":1196,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1197,"versions":1198,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1200},"package:pypi:six","six-3c3888bd","pypi:six","six",[431],[1199],"1.17.0",[56],{"id":1202,"slug":1203,"identity":1204,"label":1205,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1206,"versions":1207,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1209},"package:pypi:smmap","smmap-943fc5aa","pypi:smmap","smmap",[352],[1208],"5.0.2",[56],{"id":1211,"slug":1212,"identity":1213,"label":1214,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1215,"versions":1216,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1217},"package:pypi:stack-data","stack-data-d640fe0e","pypi:stack-data","stack-data",[431],[954],[56],{"id":1219,"slug":1220,"identity":1221,"label":1222,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1223,"versions":1224,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1226},"package:pypi:streamlit-folium","streamlit-folium-e76fb4ea","pypi:streamlit-folium","streamlit-folium",[],[1225],"0.25.1",[56],{"id":1228,"slug":1229,"identity":1230,"label":1231,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1232,"versions":1233,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1235},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[352,431,372],[1234],"1.14.0",[56],{"id":1237,"slug":1238,"identity":1239,"label":1240,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1241,"versions":1242,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1244},"package:pypi:tenacity","tenacity-415454f8","pypi:tenacity","tenacity",[341],[1243],"9.1.2",[56],{"id":1246,"slug":1247,"identity":1248,"label":1249,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1250,"versions":1251,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1253},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[352],[1252],"3.6.0",[56],{"id":1255,"slug":1256,"identity":1257,"label":1258,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1259,"versions":1260,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1262},"package:pypi:timm","timm-4594fb75","pypi:timm","timm",[341],[1261],"1.0.15",[56],{"id":1264,"slug":1265,"identity":1266,"label":1267,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1268,"versions":1269,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1271},"package:pypi:toml","toml-490ac3c8","pypi:toml","toml",[431],[1270],"0.10.2",[56],{"id":1273,"slug":1274,"identity":1275,"label":1276,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1277,"versions":1278,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1280},"package:pypi:torchvision","torchvision-7f85cafa","pypi:torchvision","torchvision",[352],[1279],"0.24.1",[56],{"id":1282,"slug":1283,"identity":1284,"label":1285,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1286,"versions":1287,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1289},"package:pypi:traitlets","traitlets-52bd6ddb","pypi:traitlets","traitlets",[352],[1288],"5.14.3",[56],{"id":1291,"slug":1292,"identity":1293,"label":1294,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1295,"versions":1296,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1298},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[431],[1297],"3.3.0",[56],{"id":1300,"slug":1301,"identity":1302,"label":1303,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1304,"versions":1305,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1307},"package:pypi:types-pytz","types-pytz-327ed57f","pypi:types-pytz","types-pytz",[341],[1306],"2025.2.0.20250809",[56],{"id":73,"slug":74,"identity":1309,"label":75,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1310,"versions":1312,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1314},"pypi:typing-extensions",[1311,372],"PSF-2.0",[1313],"4.13.1",[56],{"id":1316,"slug":1317,"identity":1318,"label":1319,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1320,"versions":1321,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1322},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[341],[1117],[56],{"id":1324,"slug":1325,"identity":1326,"label":1327,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1328,"versions":1329,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1331},"package:pypi:watchdog","watchdog-55ddb444","pypi:watchdog","watchdog",[341],[1330],"6.0.0",[56],{"id":1333,"slug":1334,"identity":1335,"label":1336,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1337,"versions":1338,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1340},"package:pypi:wcwidth","wcwidth-038a8957","pypi:wcwidth","wcwidth",[431],[1339],"0.2.13",[56],{"id":1342,"slug":1343,"identity":1344,"label":1345,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1346,"versions":1347,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1349},"package:pypi:xyzservices","xyzservices-a1955a18","pypi:xyzservices","xyzservices",[352],[1348],"2025.4.0",[56],[1351,1390,1427,1449,1484,1508,1530,1554,1596,1623,1656,1687,1723,1745,1788,1815,1841,1868,1898,1924,1953,1983,2006,2033,2059,2081,2108,2137,2161,2185,2211,2240,2279,2303,2327,2355,2379,2401,2424,2447,2483,2507,2530,2551,2581,2604,2634,2684,2721,2748,2776,2797,2823,2850,2876,2912,2938,2961,2982,3005,3037,3069,3099,3123,3148,3188,3211,3240,3264,3287,3324,3356,3378,3410,3429,3460,3483,3508,3535,3563,3601,3627,3654,3681,3701,3731,3753,3785,3807,3832,3886,3911,3935,3967,3987,4011,4042,4063,4096,4116,4136,4175,4203,4226,4249,4272,4293,4318,4343,4367,4400,4425,4452,4473,4497,4520,4548,4567,4601,4634,4661,4693,4723,4744,4766,4787,4809,4852,4879,4904,4928,4957,4977,4998,5019,5044,5067,5088,5109,5136,5159,5182,5206,5233,5258,5282,5306,5331,5347,5374,5400,5422,5448,5468,5487,5520,5546,5573,5600,5627,5649,5677,5700,5727,5749,5771,5801,5821,5855,5885,5905,5925,5949,5977,6004,6046,6064,6088,6118,6140,6160,6212,6235,6254,6279,6306,6330,6352,6384,6412,6433,6460,6483,6508,6529,6555,6585,6607,6627,6644,6663,6680,6701,6717,6732,6749,6764,6781,6798,6815,6828,6841,6854,6867,6880,6893,6906,6919],{"id":106,"slug":1352,"dossier":91,"summary":1353,"aliases":1354,"sourceIds":1357,"published":1358,"modified":1359,"checkedAt":7,"severity":1360,"references":1364,"versionKeys":1378,"packageCount":32,"repositoryCount":1389},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[1355,1356],"BIT-pillow-2026-112390","CVE-2026-112390",[106],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[1361],{"type":1362,"score":1363},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1365,1368,1371,1373,1376],{"type":1366,"url":1367},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1369,"url":1370},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1366,"url":1372},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1374,"url":1375},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1366,"url":1377},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",19,{"id":107,"slug":1391,"dossier":47,"summary":1392,"aliases":1393,"sourceIds":1396,"published":1397,"modified":1398,"checkedAt":7,"severity":1399,"references":1405,"versionKeys":1423,"packageCount":32,"repositoryCount":34},"ghsa-239g-whfq-7xj9-ede3fcd6","GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution",[1394,1395],"CVE-2026-87817","PYSEC-2026-3982",[107,1395],"2026-09-09T12:17:16.830Z","2026-09-30T23:45:04.022111787Z",[1400,1403],{"type":1401,"score":1402},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1362,"score":1404},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1406,1409,1411,1413,1415,1417,1419,1421],{"type":1407,"url":1408},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-239g-whfq-7xj9",{"type":1369,"url":1410},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87817",{"type":1366,"url":1412},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2218",{"type":1366,"url":1414},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fc7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b",{"type":1374,"url":1416},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython",{"type":1366,"url":1418},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.60",{"type":1366,"url":1420},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3982.yaml",{"type":1369,"url":1422},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",[1424,1425,1426],"pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46",{"id":108,"slug":1428,"dossier":47,"summary":1429,"aliases":1430,"sourceIds":1432,"published":1433,"modified":1434,"checkedAt":7,"severity":1435,"references":1438,"versionKeys":1448,"packageCount":32,"repositoryCount":34},"ghsa-23mf-xhv8-69c2-0feffb42","GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)",[1431],"CVE-2026-110859",[108],"2026-10-27T15:28:03Z","2026-10-27T15:47:08.812491596Z",[1436],{"type":1362,"score":1437},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1439,1441,1443,1445,1446],{"type":1366,"url":1440},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-23mf-xhv8-69c2",{"type":1366,"url":1442},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2233",{"type":1366,"url":1444},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8da65080849a56a2fc9f3e7817bbf0524e8397d5",{"type":1374,"url":1416},{"type":1366,"url":1447},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.0",[1424,1425,1426],{"id":109,"slug":1450,"dossier":47,"summary":1451,"aliases":1452,"sourceIds":1455,"published":1456,"modified":1457,"checkedAt":7,"severity":1458,"references":1461,"versionKeys":1482,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1453,1454],"CVE-2024-39689","PYSEC-2024-230",[109,1454],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1459],{"type":1401,"score":1460},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1462,1464,1466,1469,1471,1473,1476,1478,1480],{"type":1369,"url":1463},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1369,"url":1465},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1467,"url":1468},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1374,"url":1470},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1366,"url":1472},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1474,"url":1475},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1366,"url":1477},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1369,"url":1479},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1369,"url":1481},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1483],"pypi:certifi@2024.6.2",{"id":110,"slug":1485,"dossier":91,"summary":1486,"aliases":1487,"sourceIds":1490,"published":1491,"modified":1492,"checkedAt":7,"severity":1493,"references":1496,"versionKeys":1507,"packageCount":32,"repositoryCount":1389},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1488,1489],"BIT-pillow-2026-96638","CVE-2026-96638",[110],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1494],{"type":1401,"score":1495},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1497,1499,1501,1503,1505,1506],{"type":1366,"url":1498},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1369,"url":1500},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1366,"url":1502},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1366,"url":1504},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":111,"slug":1509,"dossier":91,"summary":1510,"aliases":1511,"sourceIds":1514,"published":1515,"modified":1516,"checkedAt":7,"severity":1517,"references":1520,"versionKeys":1529,"packageCount":32,"repositoryCount":1389},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1512,1513],"BIT-pillow-2026-112391","CVE-2026-112391",[111],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1518],{"type":1362,"score":1519},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1521,1523,1525,1527,1528],{"type":1366,"url":1522},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1369,"url":1524},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1366,"url":1526},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":112,"slug":1531,"dossier":91,"summary":1532,"aliases":1533,"sourceIds":1537,"published":1538,"modified":1539,"checkedAt":7,"severity":1540,"references":1544,"versionKeys":1553,"packageCount":32,"repositoryCount":1389},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1534,1535,1536],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[112,1536],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1541,1542],{"type":1362,"score":1363},{"type":1401,"score":1543},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1545,1547,1549,1551,1552],{"type":1467,"url":1546},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1369,"url":1548},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1467,"url":1550},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":113,"slug":1555,"dossier":47,"summary":1556,"aliases":1557,"sourceIds":1560,"published":1561,"modified":1562,"checkedAt":7,"severity":1563,"references":1565,"versionKeys":1586,"packageCount":32,"repositoryCount":104},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1558,1559],"CVE-2026-104851","PYSEC-2026-4217",[113,1559],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1564],{"type":1401,"score":1402},[1566,1568,1570,1572,1574,1576,1578,1580,1582,1584],{"type":1366,"url":1567},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1369,"url":1569},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1366,"url":1571},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1366,"url":1573},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1366,"url":1575},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1366,"url":1577},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1374,"url":1579},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1366,"url":1581},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1374,"url":1583},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1369,"url":1585},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1587,1588,1589,1590,1591,1592,1593,1594,1595],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",{"id":114,"slug":1597,"dossier":47,"summary":1598,"aliases":1599,"sourceIds":1602,"published":1603,"modified":1604,"checkedAt":7,"severity":1605,"references":1612,"versionKeys":1622,"packageCount":32,"repositoryCount":34},"ghsa-284h-m62q-gf8w-da9acb0c","GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE",[1600,1601],"CVE-2026-78676","PYSEC-2026-3786",[114,1601],"2026-08-25T02:16:52.030Z","2026-09-08T19:00:06.885837775Z",[1606,1608,1610],{"type":1401,"score":1607},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1362,"score":1609},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1362,"score":1611},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1613,1615,1617,1618,1620],{"type":1407,"url":1614},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-284h-m62q-gf8w",{"type":1369,"url":1616},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78676",{"type":1374,"url":1416},{"type":1366,"url":1619},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3786.yaml",{"type":1369,"url":1621},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-config-injection",[1424,1425,1426],{"id":115,"slug":1624,"dossier":47,"summary":1625,"aliases":1626,"sourceIds":1629,"published":1630,"modified":1631,"checkedAt":7,"severity":1632,"references":1635,"versionKeys":1646,"packageCount":32,"repositoryCount":66},"ghsa-29pf-2h5f-8g72-1d83ebb4","HuggingFace transformers vulnerable to remote code execution",[1627,1628],"CVE-2026-4372","PYSEC-2026-2289",[115,1628],"2026-05-24T14:16:16.917Z","2026-09-10T03:50:45.254378086Z",[1633],{"type":1401,"score":1634},"CVSS:3.0\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1636,1638,1640,1642,1644],{"type":1369,"url":1637},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4372",{"type":1467,"url":1639},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fa7f8e7ff37d87d1a1a0c8cf607971c607741452f",{"type":1374,"url":1641},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers",{"type":1407,"url":1643},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F1f693a6e-6836-4b8b-a0bd-ca036fba8884",{"type":1369,"url":1645},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-29pf-2h5f-8g72",[1647,1648,1649,1650,1651,1652,1653,1654,1655],"pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6",{"id":116,"slug":1657,"dossier":47,"summary":1658,"aliases":1659,"sourceIds":1662,"published":1663,"modified":1664,"checkedAt":7,"severity":1665,"references":1668,"versionKeys":1686,"packageCount":32,"repositoryCount":34},"ghsa-2f96-g7mh-g2hx-dd7ec02d","GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist",[1660,1661],"CVE-2026-67325","PYSEC-2026-3836",[116,1661],"2026-07-21T19:43:43Z","2026-09-23T05:15:05.950374846Z",[1666],{"type":1401,"score":1667},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1669,1671,1673,1675,1677,1678,1680,1682,1684],{"type":1366,"url":1670},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",{"type":1369,"url":1672},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67325",{"type":1366,"url":1674},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2161",{"type":1366,"url":1676},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F56806080c1348749b07daa4a2024ce47b3cad285",{"type":1374,"url":1416},{"type":1366,"url":1679},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.51",{"type":1366,"url":1681},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-option-prefix-abbreviation",{"type":1374,"url":1683},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fgitpython",{"type":1369,"url":1685},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",[1424,1425,1426],{"id":117,"slug":1688,"dossier":47,"summary":1689,"aliases":1690,"sourceIds":1693,"published":1694,"modified":1695,"checkedAt":7,"severity":1696,"references":1699,"versionKeys":1716,"packageCount":32,"repositoryCount":1722},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1691,1692],"CVE-2025-66471","PYSEC-2026-1994",[117,1692],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1697],{"type":1362,"score":1698},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1700,1702,1704,1706,1708,1710,1712,1714],{"type":1366,"url":1701},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1369,"url":1703},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1467,"url":1705},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1366,"url":1707},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1369,"url":1709},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1366,"url":1711},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1374,"url":1713},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1374,"url":1715},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1717,1718,1719,1720,1721],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":118,"slug":1724,"dossier":91,"summary":1725,"aliases":1726,"sourceIds":1729,"published":1730,"modified":1731,"checkedAt":7,"severity":1732,"references":1735,"versionKeys":1744,"packageCount":32,"repositoryCount":1389},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1727,1728],"BIT-pillow-2026-112393","CVE-2026-112393",[118],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1733],{"type":1362,"score":1734},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1736,1738,1740,1742,1743],{"type":1366,"url":1737},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1369,"url":1739},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1366,"url":1741},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":119,"slug":1746,"dossier":47,"summary":1747,"aliases":1748,"sourceIds":1752,"published":1753,"modified":1754,"checkedAt":7,"severity":1755,"references":1762,"versionKeys":1784,"packageCount":32,"repositoryCount":470},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1749,1750,1751],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[119,1751],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1756,1758,1760],{"type":1401,"score":1757},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1362,"score":1759},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1401,"score":1761},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1763,1765,1768,1770,1772,1774,1776,1778,1780,1782],{"type":1369,"url":1764},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1766,"url":1767},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1766,"url":1769},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1366,"url":1771},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1374,"url":1773},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1366,"url":1775},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1766,"url":1777},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1369,"url":1779},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1369,"url":1781},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1369,"url":1783},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1785,1786,1787],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":120,"slug":1789,"dossier":47,"summary":1790,"aliases":1791,"sourceIds":1794,"published":1795,"modified":1796,"checkedAt":7,"severity":1797,"references":1800,"versionKeys":1814,"packageCount":32,"repositoryCount":470},"ghsa-37mw-44qp-f5jm-fb05555e","Transformers is vulnerable to ReDoS attack through its DonutProcessor class",[1792,1793],"CVE-2025-3933","PYSEC-2026-1977",[120,1793],"2025-07-11T12:30:32Z","2026-09-10T03:50:57.888142744Z",[1798],{"type":1401,"score":1799},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1801,1803,1805,1807,1808,1810,1812],{"type":1369,"url":1802},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3933",{"type":1366,"url":1804},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F37788",{"type":1366,"url":1806},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Febbe9b12dd75b69f92100d684c47f923ee262a93",{"type":1374,"url":1641},{"type":1366,"url":1809},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25282953-5827-4384-bb6f-5790d275721b",{"type":1374,"url":1811},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftransformers",{"type":1369,"url":1813},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-37mw-44qp-f5jm",[1647,1648,1649],{"id":121,"slug":1816,"dossier":47,"summary":1817,"aliases":1818,"sourceIds":1821,"published":1822,"modified":1823,"checkedAt":7,"severity":1824,"references":1827,"versionKeys":1840,"packageCount":32,"repositoryCount":1722},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1819,1820],"CVE-2026-21441","PYSEC-2026-1996",[121,1820],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1825,1826],{"type":1401,"score":1543},{"type":1362,"score":1698},[1828,1830,1832,1834,1835,1837,1838],{"type":1366,"url":1829},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1369,"url":1831},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1467,"url":1833},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1374,"url":1713},{"type":1366,"url":1836},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1374,"url":1715},{"type":1369,"url":1839},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1717,1718,1719,1720,1721],{"id":122,"slug":1842,"dossier":47,"summary":1843,"aliases":1844,"sourceIds":1847,"published":1848,"modified":1849,"checkedAt":7,"severity":1850,"references":1855,"versionKeys":1867,"packageCount":32,"repositoryCount":34},"ghsa-3f7w-8rr8-f37f-9cab61a6","GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read",[1845,1846],"CVE-2026-73620","PYSEC-2026-3949",[122,1846],"2026-08-03T20:09:56Z","2026-09-10T13:10:44.075529324Z",[1851,1853],{"type":1401,"score":1852},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1362,"score":1854},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1856,1858,1860,1862,1863,1865],{"type":1407,"url":1857},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3f7w-8rr8-f37f",{"type":1366,"url":1859},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2193",{"type":1366,"url":1861},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F3af0c2516c5e18c829da30338614688f6b69b49c",{"type":1374,"url":1416},{"type":1366,"url":1864},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.57",{"type":1369,"url":1866},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-and-read",[1424,1425,1426],{"id":123,"slug":1869,"dossier":47,"summary":1870,"aliases":1871,"sourceIds":1873,"published":1874,"modified":1875,"checkedAt":7,"severity":1876,"references":1878,"versionKeys":1891,"packageCount":32,"repositoryCount":66},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[1872],"CVE-2026-103261",[123],"2026-09-30T23:49:25Z","2026-10-02T03:56:09.601689224Z",[1877],{"type":1401,"score":1799},[1879,1881,1883,1885,1887,1889],{"type":1366,"url":1880},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1366,"url":1882},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1366,"url":1884},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1366,"url":1886},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1374,"url":1888},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1366,"url":1890},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1892,1893,1894,1895,1896,1897],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7",{"id":124,"slug":1899,"dossier":91,"summary":1900,"aliases":1901,"sourceIds":1905,"published":1906,"modified":1907,"checkedAt":7,"severity":1908,"references":1912,"versionKeys":1923,"packageCount":32,"repositoryCount":1389},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1902,1903,1904],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[124,1904],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1909,1911],{"type":1362,"score":1910},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":1495},[1913,1915,1917,1919,1921,1922],{"type":1369,"url":1914},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1369,"url":1916},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1766,"url":1918},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1467,"url":1920},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":125,"slug":1925,"dossier":47,"summary":1926,"aliases":1927,"sourceIds":1930,"published":1931,"modified":1932,"checkedAt":7,"severity":1933,"references":1938,"versionKeys":1952,"packageCount":32,"repositoryCount":34},"ghsa-3rp5-jjmw-4wv2-6d7352e6","GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)",[1928,1929],"CVE-2026-69097","PYSEC-2026-3981",[125,1929],"2026-07-24T16:22:02Z","2026-10-23T21:47:05Z",[1934,1936],{"type":1401,"score":1935},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1401,"score":1937},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1939,1941,1943,1945,1946,1948,1950],{"type":1407,"url":1940},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3rp5-jjmw-4wv2",{"type":1366,"url":1942},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2176",{"type":1366,"url":1944},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed1b924f4e2d2ee7bab296df77b978af21853f1",{"type":1374,"url":1416},{"type":1366,"url":1947},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.53",{"type":1366,"url":1949},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3981.yaml",{"type":1369,"url":1951},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-submodule-names",[1424,1425,1426],{"id":126,"slug":1954,"dossier":47,"summary":1955,"aliases":1956,"sourceIds":1959,"published":1960,"modified":1961,"checkedAt":7,"severity":1962,"references":1965,"versionKeys":1982,"packageCount":32,"repositoryCount":34},"ghsa-3wxw-xv34-2frg-c013ae2d","GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)",[1957,1958],"CVE-2026-78679","PYSEC-2026-3837",[126,1958],"2026-09-08T19:42:22Z","2026-09-23T05:15:05.925079070Z",[1963],{"type":1401,"score":1964},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1966,1968,1970,1972,1974,1975,1977,1979,1980],{"type":1366,"url":1967},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",{"type":1369,"url":1969},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78679",{"type":1366,"url":1971},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2208",{"type":1366,"url":1973},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6",{"type":1374,"url":1416},{"type":1366,"url":1976},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.59",{"type":1366,"url":1978},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-tagreference-create",{"type":1374,"url":1683},{"type":1369,"url":1981},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",[1424,1425,1426],{"id":127,"slug":1984,"dossier":47,"summary":1985,"aliases":1986,"sourceIds":1989,"published":1990,"modified":1991,"checkedAt":7,"severity":1992,"references":1995,"versionKeys":2005,"packageCount":32,"repositoryCount":441},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1987,1988],"CVE-2026-49853","PYSEC-2026-3387",[127,1988],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1993],{"type":1401,"score":1994},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1996,1998,1999,2001,2003],{"type":1366,"url":1997},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1374,"url":1888},{"type":1374,"url":2000},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1369,"url":2002},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1369,"url":2004},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1892,1893,1894,1895,1896],{"id":128,"slug":2007,"dossier":91,"summary":2008,"aliases":2009,"sourceIds":2013,"published":2014,"modified":2015,"checkedAt":7,"severity":2016,"references":2021,"versionKeys":2032,"packageCount":32,"repositoryCount":1389},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[2010,2011,2012],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[128,2012],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[2017,2019],{"type":1362,"score":2018},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":2020},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[2022,2024,2026,2028,2030,2031],{"type":1407,"url":2023},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1369,"url":2025},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1366,"url":2027},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1467,"url":2029},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":129,"slug":2034,"dossier":47,"summary":2035,"aliases":2036,"sourceIds":2040,"published":2041,"modified":2042,"checkedAt":7,"severity":2043,"references":2045,"versionKeys":2057,"packageCount":32,"repositoryCount":2058},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[2037,2038,2039],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[129,2039],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[2044],{"type":1401,"score":1543},[2046,2048,2050,2052,2054,2055],{"type":1407,"url":2047},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1369,"url":2049},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1467,"url":2051},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1366,"url":2053},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1374,"url":1375},{"type":1369,"url":2056},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1379,1380,1381,1382,1383,1384,1385,1386,1387],18,{"id":130,"slug":2060,"dossier":91,"summary":2061,"aliases":2062,"sourceIds":2065,"published":2066,"modified":2067,"checkedAt":7,"severity":2068,"references":2071,"versionKeys":2080,"packageCount":32,"repositoryCount":1389},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[2063,2064],"BIT-pillow-2026-112395","CVE-2026-112395",[130],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[2069],{"type":1401,"score":2070},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[2072,2074,2076,2078,2079],{"type":1366,"url":2073},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1369,"url":2075},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1366,"url":2077},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":131,"slug":2082,"dossier":47,"summary":2083,"aliases":2084,"sourceIds":2087,"published":2088,"modified":2089,"checkedAt":7,"severity":2090,"references":2093,"versionKeys":2106,"packageCount":32,"repositoryCount":2107},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[2085,2086],"CVE-2025-50182","PYSEC-2026-1997",[131,2086],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[2091],{"type":1401,"score":2092},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2094,2096,2098,2100,2101,2103,2104],{"type":1366,"url":2095},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1369,"url":2097},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1467,"url":2099},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1374,"url":1713},{"type":1366,"url":2102},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1374,"url":1715},{"type":1369,"url":2105},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1717,1718,1719,1720],8,{"id":132,"slug":2109,"dossier":47,"summary":2110,"aliases":2111,"sourceIds":2114,"published":2115,"modified":2116,"checkedAt":7,"severity":2117,"references":2119,"versionKeys":2136,"packageCount":32,"repositoryCount":34},"ghsa-4gmw-gg2m-w46p-58f27cb8","GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\u002Freset\u002Fmerge_tree enables arbitrary file overwrite",[2112,2113],"CVE-2026-76219","PYSEC-2026-3838",[132,2113],"2026-08-07T15:33:57Z","2026-09-10T12:25:42.767166279Z",[2118],{"type":1401,"score":1852},[2120,2122,2124,2126,2128,2129,2131,2133,2134],{"type":1366,"url":2121},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",{"type":1369,"url":2123},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76219",{"type":1366,"url":2125},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2204",{"type":1366,"url":2127},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9b5dcaf85da5946dbf69dcd53f9edba08f760b32",{"type":1374,"url":1416},{"type":1366,"url":2130},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.58",{"type":1366,"url":2132},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-read-tree",{"type":1374,"url":1683},{"type":1369,"url":2135},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",[1424,1425,1426],{"id":133,"slug":2138,"dossier":91,"summary":2139,"aliases":2140,"sourceIds":2144,"published":2145,"modified":2146,"checkedAt":7,"severity":2147,"references":2149,"versionKeys":2160,"packageCount":32,"repositoryCount":1389},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[2141,2142,2143],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[133,2143],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[2148],{"type":1401,"score":1495},[2150,2152,2154,2156,2158,2159],{"type":1369,"url":2151},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1369,"url":2153},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1766,"url":2155},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1467,"url":2157},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":134,"slug":2162,"dossier":47,"summary":2163,"aliases":2164,"sourceIds":2168,"published":2169,"modified":2170,"checkedAt":7,"severity":2171,"references":2175,"versionKeys":2184,"packageCount":32,"repositoryCount":66},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[2165,2166,2167],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[134,2167],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[2172,2174],{"type":1401,"score":2173},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1401,"score":1543},[2176,2178,2180,2182,2183],{"type":1407,"url":2177},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1369,"url":2179},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1467,"url":2181},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1374,"url":1375},{"type":1369,"url":1377},[1383,1384,1385,1386,1387,1388],{"id":135,"slug":2186,"dossier":47,"summary":2187,"aliases":2188,"sourceIds":2191,"published":2192,"modified":2193,"checkedAt":7,"severity":2194,"references":2197,"versionKeys":2210,"packageCount":32,"repositoryCount":451},"ghsa-4w7r-h757-3r74-ca8973bc","Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer",[2189,2190],"CVE-2025-6921","PYSEC-2026-1980",[135,2190],"2025-09-23T15:31:09Z","2026-09-10T03:50:27.867584538Z",[2195],{"type":1401,"score":2196},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2198,2200,2202,2204,2205,2207,2208],{"type":1369,"url":2199},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6921",{"type":1366,"url":2201},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F47c34fba5c303576560cb29767efb452ff12b8be",{"type":1366,"url":2203},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fd37f7517972f67e3f2194c000ed0f87f064e5099",{"type":1374,"url":1641},{"type":1366,"url":2206},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F287d15a7-6e7c-45d2-8c05-11e305776f1f",{"type":1374,"url":1811},{"type":1369,"url":2209},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4w7r-h757-3r74",[1647,1648,1649,1650],{"id":136,"slug":2212,"dossier":47,"summary":2213,"aliases":2214,"sourceIds":2218,"published":2219,"modified":2220,"checkedAt":7,"severity":2221,"references":2224,"versionKeys":2239,"packageCount":32,"repositoryCount":2058},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[2215,2216,2217],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[136,2217],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[2222],{"type":1401,"score":2223},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2225,2227,2229,2231,2233,2235,2237,2238],{"type":1407,"url":2226},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1369,"url":2228},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1467,"url":2230},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1467,"url":2232},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1467,"url":2234},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1366,"url":2236},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1374,"url":1375},{"type":1369,"url":2056},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":137,"slug":2241,"dossier":47,"summary":2242,"aliases":2243,"sourceIds":2246,"published":2247,"modified":2248,"checkedAt":7,"severity":2249,"references":2252,"versionKeys":2275,"packageCount":32,"repositoryCount":2278},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[2244,2245],"CVE-2026-4539","PYSEC-2026-2987",[137,2245],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[2250,2251],{"type":1401,"score":1757},{"type":1362,"score":1759},[2253,2255,2257,2259,2261,2263,2265,2267,2269,2271,2273],{"type":1369,"url":2254},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1366,"url":2256},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1366,"url":2258},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1366,"url":2260},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1374,"url":2262},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1366,"url":2264},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1366,"url":2266},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1366,"url":2268},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1366,"url":2270},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1374,"url":2272},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1369,"url":2274},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[2276,2277],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",16,{"id":138,"slug":2280,"dossier":47,"summary":2281,"aliases":2282,"sourceIds":2285,"published":2286,"modified":2287,"checkedAt":7,"severity":2288,"references":2292,"versionKeys":2302,"packageCount":32,"repositoryCount":34},"ghsa-539m-9xh6-q6rr-c4575e3c","GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file \u002F --add-virtual-file, enabling arbitrary file read via Repo.archive()",[2283,2284],"CVE-2026-73619","PYSEC-2026-3948",[138,2284],"2026-08-03T20:14:28Z","2026-09-10T13:11:01.695990206Z",[2289,2290],{"type":1401,"score":1964},{"type":1362,"score":2291},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2293,2295,2296,2298,2299,2300],{"type":1407,"url":2294},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-539m-9xh6-q6rr",{"type":1366,"url":1859},{"type":1366,"url":2297},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca",{"type":1374,"url":1416},{"type":1366,"url":1864},{"type":1369,"url":2301},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-archive",[1424,1425,1426],{"id":139,"slug":2304,"dossier":47,"summary":2305,"aliases":2306,"sourceIds":2310,"published":2311,"modified":2312,"checkedAt":7,"severity":2313,"references":2316,"versionKeys":2326,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[2307,2308,2309],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[139,2309],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[2314,2315],{"type":1362,"score":1609},{"type":1401,"score":1607},[2317,2319,2321,2323,2325],{"type":1369,"url":2318},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1369,"url":2320},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1366,"url":2322},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1366,"url":2324},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1374,"url":1773},[1785],{"id":140,"slug":2328,"dossier":47,"summary":2329,"aliases":2330,"sourceIds":2332,"published":2333,"modified":2334,"checkedAt":7,"severity":2335,"references":2338,"versionKeys":2349,"packageCount":32,"repositoryCount":2354},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[2331],"CVE-2026-112907",[140],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[2336],{"type":1401,"score":2337},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2339,2341,2343,2345,2347],{"type":1366,"url":2340},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1366,"url":2342},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1366,"url":2344},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1374,"url":2346},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1366,"url":2348},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[2350,2351,2352,2353],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":141,"slug":2356,"dossier":91,"summary":2357,"aliases":2358,"sourceIds":2362,"published":2363,"modified":2364,"checkedAt":7,"severity":2365,"references":2369,"versionKeys":2378,"packageCount":32,"repositoryCount":1389},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[2359,2360,2361],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[141,2361],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[2366,2368],{"type":1362,"score":2367},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":1543},[2370,2372,2374,2376,2377],{"type":1407,"url":2371},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1369,"url":2373},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1467,"url":2375},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":142,"slug":2380,"dossier":47,"summary":2381,"aliases":2382,"sourceIds":2384,"published":2385,"modified":2386,"checkedAt":7,"severity":2387,"references":2390,"versionKeys":2400,"packageCount":32,"repositoryCount":34},"ghsa-59cr-6r3x-644w-a8ec12fb","GitPython submodule update path traversal can write outside the repository",[2383],"CVE-2026-100689",[142],"2026-09-30T23:47:12Z","2026-10-01T00:00:05.754996881Z",[2388],{"type":1362,"score":2389},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2391,2393,2395,2397,2398],{"type":1366,"url":2392},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-59cr-6r3x-644w",{"type":1366,"url":2394},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2225",{"type":1366,"url":2396},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed0ebc2f2e74d979cdc367a4864a7731fdcc093",{"type":1374,"url":1416},{"type":1366,"url":2399},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.62",[1424,1425,1426],{"id":143,"slug":2402,"dossier":47,"summary":2403,"aliases":2404,"sourceIds":2407,"published":2408,"modified":2409,"checkedAt":7,"severity":2410,"references":2412,"versionKeys":2423,"packageCount":32,"repositoryCount":451},"ghsa-59p9-h35m-wg4g-68657c65","Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer",[2405,2406],"CVE-2025-6638","PYSEC-2026-1981",[143,2406],"2025-09-12T12:30:23Z","2026-09-10T03:50:58.113501288Z",[2411],{"type":1401,"score":2196},[2413,2415,2416,2417,2418,2420,2421],{"type":1369,"url":2414},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6638",{"type":1366,"url":2201},{"type":1366,"url":2203},{"type":1374,"url":1641},{"type":1366,"url":2419},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F6a6c933f-9ce8-4ded-8b3b-2c1444c61f36",{"type":1374,"url":1811},{"type":1369,"url":2422},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59p9-h35m-wg4g",[1647,1648,1649,1650],{"id":144,"slug":2425,"dossier":47,"summary":2426,"aliases":2427,"sourceIds":2429,"published":2430,"modified":2431,"checkedAt":7,"severity":2432,"references":2435,"versionKeys":2445,"packageCount":32,"repositoryCount":42},"ghsa-5cjw-f85j-cv6r-1c54e04a","Tornado: Open redirect via triple-slash redirect paths",[2428],"CVE-2026-126347",[144],"2026-11-13T20:31:22Z","2026-11-13T20:45:03.690595670Z",[2433],{"type":1401,"score":2434},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2436,2438,2440,2442,2443],{"type":1366,"url":2437},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-5cjw-f85j-cv6r",{"type":1369,"url":2439},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-126347",{"type":1366,"url":2441},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fc503241622c0efe7c40110d89834ce8b7fead1e4",{"type":1374,"url":1888},{"type":1366,"url":2444},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.1",[1892,1893,1894,1895,1896,1897,2446],"pypi:tornado@6.6",{"id":145,"slug":2448,"dossier":47,"summary":2449,"aliases":2450,"sourceIds":2454,"published":2455,"modified":2456,"checkedAt":7,"severity":2457,"references":2461,"versionKeys":2478,"packageCount":32,"repositoryCount":451},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[2451,2452,2453],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[145,2453],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[2458,2460],{"type":1362,"score":2459},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1401,"score":1667},[2462,2464,2466,2468,2470,2472,2474,2476],{"type":1407,"url":2463},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1369,"url":2465},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1766,"url":2467},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1467,"url":2469},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1366,"url":2471},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1374,"url":2473},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1366,"url":2475},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1474,"url":2477},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2479,2480,2481,2482],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":146,"slug":2484,"dossier":91,"summary":2485,"aliases":2486,"sourceIds":2490,"published":2491,"modified":2492,"checkedAt":7,"severity":2493,"references":2497,"versionKeys":2506,"packageCount":32,"repositoryCount":1389},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2487,2488,2489],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[146,2489],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2494,2496],{"type":1362,"score":2495},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":1607},[2498,2500,2502,2504,2505],{"type":1407,"url":2499},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1369,"url":2501},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1467,"url":2503},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":147,"slug":2508,"dossier":47,"summary":2509,"aliases":2510,"sourceIds":2514,"published":2515,"modified":2516,"checkedAt":7,"severity":2517,"references":2519,"versionKeys":2529,"packageCount":32,"repositoryCount":2058},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2511,2512,2513],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[147,2513],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2518],{"type":1401,"score":1543},[2520,2522,2524,2525,2527,2528],{"type":1407,"url":2521},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1369,"url":2523},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1467,"url":2051},{"type":1366,"url":2526},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1374,"url":1375},{"type":1369,"url":2056},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":148,"slug":2531,"dossier":91,"summary":2532,"aliases":2533,"sourceIds":2536,"published":2537,"modified":2538,"checkedAt":7,"severity":2539,"references":2541,"versionKeys":2550,"packageCount":32,"repositoryCount":1389},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2534,2535],"BIT-pillow-2026-112399","CVE-2026-112399",[148],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2540],{"type":1362,"score":2367},[2542,2544,2546,2548,2549],{"type":1366,"url":2543},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1369,"url":2545},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1366,"url":2547},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":149,"slug":2552,"dossier":47,"summary":2553,"aliases":2554,"sourceIds":2558,"published":2559,"modified":2560,"checkedAt":7,"severity":2561,"references":2565,"versionKeys":2579,"packageCount":32,"repositoryCount":2580},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2555,2556,2557],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[149,2557],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2562,2563],{"type":1401,"score":1761},{"type":1362,"score":2564},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2566,2568,2570,2572,2574,2576,2577],{"type":1369,"url":2567},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1369,"url":2569},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1366,"url":2571},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1366,"url":2573},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1366,"url":2575},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1374,"url":1375},{"type":1369,"url":2578},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1382,1383,1384,1385,1386],13,{"id":150,"slug":2582,"dossier":47,"summary":2583,"aliases":2584,"sourceIds":2587,"published":2588,"modified":2589,"checkedAt":7,"severity":2590,"references":2593,"versionKeys":2603,"packageCount":32,"repositoryCount":34},"ghsa-5xxx-qhh7-9287-87d91b3e","GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\u002F-S, enabling arbitrary file read via Repo.blame()",[2585,2586],"CVE-2026-78678","PYSEC-2026-3788",[150,2586],"2026-08-25T02:16:52.313Z","2026-09-08T19:00:06.904435463Z",[2591,2592],{"type":1401,"score":1964},{"type":1362,"score":2291},[2594,2596,2598,2599,2601],{"type":1407,"url":2595},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-5xxx-qhh7-9287",{"type":1369,"url":2597},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78678",{"type":1374,"url":1416},{"type":1366,"url":2600},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3788.yaml",{"type":1369,"url":2602},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-blame",[1424,1425,1426],{"id":151,"slug":2605,"dossier":47,"summary":2606,"aliases":2607,"sourceIds":2611,"published":2612,"modified":2613,"checkedAt":7,"severity":2614,"references":2617,"versionKeys":2633,"packageCount":32,"repositoryCount":2058},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2608,2609,2610],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[151,2610],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2615],{"type":1362,"score":2616},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2618,2620,2622,2624,2626,2627,2629,2631],{"type":1366,"url":2619},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1369,"url":2621},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1366,"url":2623},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1366,"url":2625},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1374,"url":1375},{"type":1366,"url":2628},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1374,"url":2630},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1369,"url":2632},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":152,"slug":2635,"dossier":47,"summary":2636,"aliases":2637,"sourceIds":2642,"published":2643,"modified":2644,"checkedAt":7,"severity":2645,"references":2647,"versionKeys":2675,"packageCount":32,"repositoryCount":2683},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2638,2639,2640,2641],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[152,2641],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2646],{"type":1401,"score":1402},[2648,2650,2652,2654,2656,2658,2660,2662,2664,2666,2667,2669,2671,2673],{"type":1369,"url":2649},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1369,"url":2651},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1766,"url":2653},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1369,"url":2655},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1366,"url":2657},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1766,"url":2659},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1369,"url":2661},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1366,"url":2663},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1366,"url":2665},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1374,"url":1773},{"type":1467,"url":2668},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1369,"url":2670},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1366,"url":2672},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1366,"url":2674},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1785,1786,1787,2676,2677,2678,2679,2680,2681,2682],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":153,"slug":2685,"dossier":47,"summary":2686,"aliases":2687,"sourceIds":2690,"published":2691,"modified":2692,"checkedAt":7,"severity":2693,"references":2696,"versionKeys":2719,"packageCount":32,"repositoryCount":480},"ghsa-6497-prx7-gpmq-2b8ee85d","geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure",[2688,2689],"CVE-2025-69662","PYSEC-2026-62",[153,2689],"2026-01-30T19:16:11.967Z","2026-06-10T17:01:18.172032507Z",[2694],{"type":1401,"score":2695},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[2697,2699,2701,2703,2705,2707,2709,2711,2713,2715,2717],{"type":1369,"url":2698},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69662",{"type":1366,"url":2700},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fissues\u002F3679",{"type":1467,"url":2702},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fpull\u002F3681",{"type":1366,"url":2704},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fcommit\u002F6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419",{"type":1366,"url":2706},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas",{"type":1374,"url":2708},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas",{"type":1366,"url":2710},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Freleases\u002Ftag\u002Fv1.1.2",{"type":1366,"url":2712},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgeopandas\u002FPYSEC-2026-62.yaml",{"type":1366,"url":2714},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00025.html",{"type":1407,"url":2716},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas\u002F",{"type":1369,"url":2718},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6497-prx7-gpmq",[2720],"pypi:geopandas@1.0.1",{"id":154,"slug":2722,"dossier":47,"summary":2723,"aliases":2724,"sourceIds":2728,"published":2729,"modified":2730,"checkedAt":7,"severity":2731,"references":2736,"versionKeys":2747,"packageCount":32,"repositoryCount":104},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2725,2726,2727],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[154,2727],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2732,2734],{"type":1362,"score":2733},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":2735},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2737,2739,2741,2743,2745,2746],{"type":1369,"url":2738},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1369,"url":2740},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1766,"url":2742},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1467,"url":2744},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1374,"url":1375},{"type":1369,"url":1377},[1382,1383,1384,1385,1386,1387,1388],{"id":155,"slug":2749,"dossier":91,"summary":2750,"aliases":2751,"sourceIds":2754,"published":2755,"modified":2756,"checkedAt":7,"severity":2757,"references":2761,"versionKeys":2770,"packageCount":32,"repositoryCount":2775},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2752,2753],"CVE-2026-45409","PYSEC-2026-215",[155,2753],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2758,2759],{"type":1401,"score":1799},{"type":1362,"score":2760},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2762,2764,2766,2768],{"type":1369,"url":2763},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1369,"url":2765},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1374,"url":2767},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1366,"url":2769},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2771,2772,2773,2774],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":156,"slug":2777,"dossier":91,"summary":2778,"aliases":2779,"sourceIds":2782,"published":2783,"modified":2784,"checkedAt":7,"severity":2785,"references":2787,"versionKeys":2796,"packageCount":32,"repositoryCount":1389},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2780,2781],"BIT-pillow-2026-112400","CVE-2026-112400",[156],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2786],{"type":1362,"score":2367},[2788,2790,2792,2794,2795],{"type":1366,"url":2789},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1369,"url":2791},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1366,"url":2793},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":157,"slug":2798,"dossier":91,"summary":2799,"aliases":2800,"sourceIds":2802,"published":2803,"modified":2804,"checkedAt":7,"severity":2805,"references":2808,"versionKeys":2817,"packageCount":32,"repositoryCount":1389},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2801],"CVE-2026-112909",[157],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2806],{"type":1401,"score":2807},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2809,2811,2813,2814,2815,2816],{"type":1366,"url":2810},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1369,"url":2812},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1366,"url":2342},{"type":1366,"url":2344},{"type":1374,"url":2346},{"type":1366,"url":2348},[2818,2819,2820,2821,2822,2350,2351,2352,2353],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":158,"slug":2824,"dossier":47,"summary":2825,"aliases":2826,"sourceIds":2829,"published":2830,"modified":2831,"checkedAt":7,"severity":2832,"references":2837,"versionKeys":2849,"packageCount":32,"repositoryCount":66},"ghsa-69w3-r845-3855-1b4edc28","HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class",[2827,2828],"CVE-2026-1839","PYSEC-2026-2288",[158,2828],"2026-04-07T06:16:41.490Z","2026-09-10T03:50:43.300048881Z",[2833,2835],{"type":1401,"score":2834},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:H",{"type":1401,"score":2836},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2838,2840,2842,2843,2845,2847],{"type":1369,"url":2839},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1839",{"type":1467,"url":2841},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396",{"type":1374,"url":1641},{"type":1366,"url":2844},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Freleases\u002Ftag\u002Fv5.0.0rc3",{"type":1407,"url":2846},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c77bb97-e493-493d-9a88-c57f5c536485",{"type":1369,"url":2848},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69w3-r845-3855",[1647,1648,1649,1650,1651,1652,1653,1654,1655],{"id":159,"slug":2851,"dossier":47,"summary":2852,"aliases":2853,"sourceIds":2856,"published":2857,"modified":2858,"checkedAt":7,"severity":2859,"references":2863,"versionKeys":2875,"packageCount":32,"repositoryCount":34},"ghsa-6p8h-3wgx-97gf-635a010c","GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks",[2854,2855],"CVE-2026-73623","PYSEC-2026-3952",[159,2855],"2026-07-24T16:42:09Z","2026-09-10T13:11:03.995690741Z",[2860,2862],{"type":1401,"score":2861},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1401,"score":1667},[2864,2866,2868,2870,2871,2873],{"type":1407,"url":2865},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-6p8h-3wgx-97gf",{"type":1366,"url":2867},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2180",{"type":1366,"url":2869},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fffcb5359e87619f4fe4a70a4aff5f08c5580ba97",{"type":1374,"url":1416},{"type":1366,"url":2872},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.54",{"type":1369,"url":2874},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-template",[1424,1425,1426],{"id":160,"slug":2877,"dossier":91,"summary":2878,"aliases":2879,"sourceIds":2881,"published":2882,"modified":2883,"checkedAt":7,"severity":2884,"references":2887,"versionKeys":2899,"packageCount":32,"repositoryCount":2911},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2880],"PYSEC-2026-4320",[160,2880],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2885],{"type":1362,"score":2886},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2888,2890,2892,2894,2895,2897],{"type":1366,"url":2889},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1366,"url":2891},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1366,"url":2893},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1374,"url":1470},{"type":1374,"url":2896},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1369,"url":2898},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2900,1483,2901,2902,2903,2904,2905,2906,2907,2908,2909,2910],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":161,"slug":2913,"dossier":47,"summary":2914,"aliases":2915,"sourceIds":2919,"published":2920,"modified":2921,"checkedAt":7,"severity":2922,"references":2924,"versionKeys":2937,"packageCount":32,"repositoryCount":2058},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2916,2917,2918],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[161,2918],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2923],{"type":1401,"score":1543},[2925,2927,2929,2931,2933,2935,2936],{"type":1407,"url":2926},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1369,"url":2928},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1467,"url":2930},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1467,"url":2932},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1366,"url":2934},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1374,"url":1375},{"type":1369,"url":2628},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":162,"slug":2939,"dossier":47,"summary":2940,"aliases":2941,"sourceIds":2944,"published":2945,"modified":2946,"checkedAt":7,"severity":2947,"references":2949,"versionKeys":2960,"packageCount":32,"repositoryCount":32},"ghsa-6rvg-6v2m-4j46-e04ee614","Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[2942,2943],"CVE-2024-12720","PYSEC-2026-1982",[162,2943],"2025-03-20T12:32:43Z","2026-08-13T20:11:58.209202163Z",[2948],{"type":1401,"score":2196},[2950,2952,2954,2955,2957,2958],{"type":1369,"url":2951},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-12720",{"type":1366,"url":2953},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fdeac971c469bcbb182c2e52da0b82fb3bf54cccf",{"type":1374,"url":1641},{"type":1366,"url":2956},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F4bed1214-7835-4252-a853-22bbad891f98",{"type":1374,"url":1811},{"type":1369,"url":2959},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6rvg-6v2m-4j46",[1647],{"id":163,"slug":2962,"dossier":91,"summary":2963,"aliases":2964,"sourceIds":2967,"published":2968,"modified":2969,"checkedAt":7,"severity":2970,"references":2972,"versionKeys":2981,"packageCount":32,"repositoryCount":1389},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[2965,2966],"BIT-pillow-2026-112401","CVE-2026-112401",[163],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[2971],{"type":1362,"score":2760},[2973,2975,2977,2979,2980],{"type":1366,"url":2974},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1369,"url":2976},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1366,"url":2978},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":164,"slug":2983,"dossier":47,"summary":2984,"aliases":2985,"sourceIds":2988,"published":2989,"modified":2990,"checkedAt":7,"severity":2991,"references":2996,"versionKeys":3004,"packageCount":32,"repositoryCount":34},"ghsa-7545-fcxq-7j24-84dd19fd","GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository",[2986,2987],"CVE-2026-44243","PYSEC-2026-2162",[164,2987],"2026-05-06T19:38:48Z","2026-09-10T03:50:45.903378498Z",[2992,2994],{"type":1401,"score":2993},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1362,"score":2995},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2997,2999,3001,3002],{"type":1407,"url":2998},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7545-fcxq-7j24",{"type":1369,"url":3000},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44243",{"type":1374,"url":1416},{"type":1467,"url":3003},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.48",[1424,1425,1426],{"id":165,"slug":3006,"dossier":47,"summary":3007,"aliases":3008,"sourceIds":3011,"published":3012,"modified":3013,"checkedAt":7,"severity":3014,"references":3017,"versionKeys":3030,"packageCount":32,"repositoryCount":2107},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[3009,3010],"CVE-2025-66034","PYSEC-2026-1389",[165,3010],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[3015],{"type":1401,"score":3016},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[3018,3020,3022,3024,3026,3028],{"type":1366,"url":3019},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1369,"url":3021},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1366,"url":3023},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1374,"url":3025},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1374,"url":3027},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1369,"url":3029},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[3031,3032,3033,3034,3035,3036],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",{"id":166,"slug":3038,"dossier":47,"summary":3039,"aliases":3040,"sourceIds":3043,"published":3044,"modified":3045,"checkedAt":7,"severity":3046,"references":3053,"versionKeys":3068,"packageCount":32,"repositoryCount":34},"ghsa-7833-fr7j-v32q-fd003872","GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)",[3041,3042],"CVE-2026-78675","PYSEC-2026-3785",[166,3042],"2026-08-25T02:16:51.887Z","2026-09-23T05:15:05.931147061Z",[3047,3049,3051],{"type":1401,"score":3048},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1362,"score":3050},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":3052},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3054,3056,3058,3060,3062,3063,3064,3066],{"type":1407,"url":3055},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7833-fr7j-v32q",{"type":1369,"url":3057},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78675",{"type":1366,"url":3059},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2211",{"type":1366,"url":3061},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fef7568e3b317ce617eacda39b8b54dcdff8c3b5c",{"type":1374,"url":1416},{"type":1366,"url":1976},{"type":1366,"url":3065},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3785.yaml",{"type":1369,"url":3067},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-local-file-content-disclosure-via-gitmodules",[1424,1425,1426],{"id":167,"slug":3070,"dossier":47,"summary":3071,"aliases":3072,"sourceIds":3076,"published":3077,"modified":3078,"checkedAt":7,"severity":3079,"references":3086,"versionKeys":3098,"packageCount":32,"repositoryCount":441},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[3073,3074,3075],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[167,3074,3075],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[3080,3082,3084],{"type":1401,"score":3081},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1401,"score":3083},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1401,"score":3085},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[3087,3089,3091,3092,3094,3096],{"type":1369,"url":3088},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1366,"url":3090},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1374,"url":1888},{"type":1366,"url":3093},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1369,"url":3095},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1369,"url":3097},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1892,1893,1894,1895],{"id":168,"slug":3100,"dossier":47,"summary":3101,"aliases":3102,"sourceIds":3103,"published":3104,"modified":3105,"checkedAt":7,"severity":3106,"references":3109,"versionKeys":3122,"packageCount":32,"repositoryCount":1722},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[168],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[3107],{"type":1401,"score":3108},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3110,3112,3114,3116,3118,3119,3120],{"type":1366,"url":3111},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1366,"url":3113},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1366,"url":3115},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1366,"url":3117},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1374,"url":1375},{"type":1366,"url":1377},{"type":1366,"url":3121},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1381,1382,1383,1384,1385,1386,1387,1388],{"id":169,"slug":3124,"dossier":47,"summary":3125,"aliases":3126,"sourceIds":3129,"published":3130,"modified":3131,"checkedAt":7,"severity":3132,"references":3134,"versionKeys":3147,"packageCount":32,"repositoryCount":480},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[3127,3128],"CVE-2025-47287","PYSEC-2026-1974",[169,3128],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[3133],{"type":1401,"score":1543},[3135,3137,3139,3141,3142,3144,3145],{"type":1366,"url":3136},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1369,"url":3138},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1366,"url":3140},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1374,"url":1888},{"type":1366,"url":3143},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1374,"url":2000},{"type":1369,"url":3146},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1892],{"id":170,"slug":3149,"dossier":47,"summary":3150,"aliases":3151,"sourceIds":3154,"published":3155,"modified":3156,"checkedAt":7,"severity":3157,"references":3160,"versionKeys":3177,"packageCount":32,"repositoryCount":2580},"ghsa-7gcm-g887-7qv7-55bb9ff1","protobuf affected by a JSON recursion depth bypass",[3152,3153],"CVE-2026-0994","PYSEC-2026-1805",[170,3153],"2026-01-23T15:31:35Z","2026-09-10T03:50:32.795512159Z",[3158],{"type":1362,"score":3159},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:L",[3161,3163,3165,3167,3169,3171,3173,3175],{"type":1369,"url":3162},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0994",{"type":1366,"url":3164},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fissues\u002F25070",{"type":1366,"url":3166},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fpull\u002F25239",{"type":1366,"url":3168},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",{"type":1366,"url":3170},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002Fd2b001626d137c62dfee6c88c87324102531868b",{"type":1374,"url":3172},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf",{"type":1374,"url":3174},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fprotobuf",{"type":1369,"url":3176},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7gcm-g887-7qv7",[3178,3179,3180,3181,3182,3183,3184,3185,3186,3187],"pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4",{"id":171,"slug":3189,"dossier":91,"summary":3190,"aliases":3191,"sourceIds":3195,"published":3196,"modified":3197,"checkedAt":7,"severity":3198,"references":3201,"versionKeys":3210,"packageCount":32,"repositoryCount":1389},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[3192,3193,3194],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[171,3194],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[3199,3200],{"type":1362,"score":2367},{"type":1401,"score":1543},[3202,3204,3206,3208,3209],{"type":1467,"url":3203},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1369,"url":3205},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1467,"url":3207},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":172,"slug":3212,"dossier":47,"summary":3213,"aliases":3214,"sourceIds":3217,"published":3218,"modified":3219,"checkedAt":7,"severity":3220,"references":3225,"versionKeys":3236,"packageCount":32,"repositoryCount":470},"ghsa-7p48-42j8-8846-584b0522","Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)",[3215,3216],"CVE-2026-33682","PYSEC-2026-2285",[172,3216],"2026-03-25T21:20:52Z","2026-07-13T07:26:25.253864212Z",[3221,3223],{"type":1401,"score":3222},"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1401,"score":3224},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[3226,3228,3230,3232,3234],{"type":1369,"url":3227},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fsecurity\u002Fadvisories\u002FGHSA-7p48-42j8-8846",{"type":1369,"url":3229},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33682",{"type":1467,"url":3231},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002F23692ca70b2f2ac720c72d1feb4f190c9d6eed76",{"type":1374,"url":3233},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit",{"type":1369,"url":3235},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Freleases\u002Ftag\u002F1.54.0",[3237,3238,3239],"pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0",{"id":173,"slug":3241,"dossier":47,"summary":3242,"aliases":3243,"sourceIds":3245,"published":3246,"modified":3247,"checkedAt":7,"severity":3248,"references":3251,"versionKeys":3263,"packageCount":32,"repositoryCount":34},"ghsa-83vg-56qc-22m7-6ad99a7a","GitPython validates a submodule's \".git\" path only after cloning into it (RCE)",[3244],"CVE-2026-114145",[173],"2026-10-22T16:41:14Z","2026-10-22T16:45:04.297463159Z",[3249],{"type":1401,"score":3250},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3252,3254,3256,3258,3260,3261],{"type":1366,"url":3253},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-83vg-56qc-22m7",{"type":1369,"url":3255},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114145",{"type":1366,"url":3257},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2264",{"type":1366,"url":3259},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F97eadb888d2f99567e3113f4e455be4ca128f697",{"type":1374,"url":1416},{"type":1366,"url":3262},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.2.1",[1424,1425,1426],{"id":174,"slug":3265,"dossier":47,"summary":3266,"aliases":3267,"sourceIds":3269,"published":3270,"modified":3271,"checkedAt":7,"severity":3272,"references":3274,"versionKeys":3286,"packageCount":32,"repositoryCount":66},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[3268],"CVE-2026-91990",[174],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[3273],{"type":1362,"score":2760},[3275,3277,3279,3281,3283,3284],{"type":1366,"url":3276},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1366,"url":3278},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1366,"url":3280},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1366,"url":3282},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1374,"url":1888},{"type":1366,"url":3285},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1892,1893,1894,1895,1896,1897],{"id":175,"slug":3288,"dossier":47,"summary":3289,"aliases":3290,"sourceIds":3294,"published":3295,"modified":3296,"checkedAt":7,"severity":3297,"references":3301,"versionKeys":3323,"packageCount":32,"repositoryCount":2107},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[3291,3292,3293],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[175,3293],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[3298,3299],{"type":1401,"score":1757},{"type":1362,"score":3300},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3302,3304,3306,3308,3310,3312,3313,3315,3317,3319,3321],{"type":1369,"url":3303},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1366,"url":3305},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1366,"url":3307},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1366,"url":3309},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1366,"url":3311},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1374,"url":1773},{"type":1366,"url":3314},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1366,"url":3316},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1366,"url":3318},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1374,"url":3320},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1369,"url":3322},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1785,1786,1787,2676,2677],{"id":176,"slug":3325,"dossier":91,"summary":3326,"aliases":3327,"sourceIds":3330,"published":3331,"modified":3332,"checkedAt":7,"severity":3333,"references":3336,"versionKeys":3353,"packageCount":32,"repositoryCount":2775},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[3328,3329],"CVE-2026-97687","PYSEC-2026-4175",[176,3329],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[3334],{"type":1362,"score":3335},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3337,3339,3341,3343,3345,3347,3348,3350,3351],{"type":1366,"url":3338},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1369,"url":3340},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1366,"url":3342},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1366,"url":3344},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1366,"url":3346},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1374,"url":1713},{"type":1366,"url":3349},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1374,"url":1715},{"type":1369,"url":3352},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1717,1718,1719,1720,1721,3354,3355],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":177,"slug":3357,"dossier":47,"summary":3358,"aliases":3359,"sourceIds":3363,"published":3364,"modified":3365,"checkedAt":7,"severity":3366,"references":3369,"versionKeys":3377,"packageCount":32,"repositoryCount":1389},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[3360,3361,3362],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[177,3362],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[3367,3368],{"type":1362,"score":2495},{"type":1401,"score":1607},[3370,3372,3374,3375,3376],{"type":1407,"url":3371},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1369,"url":3373},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1467,"url":2503},{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":178,"slug":3379,"dossier":47,"summary":3380,"aliases":3381,"sourceIds":3384,"published":3385,"modified":3386,"checkedAt":7,"severity":3387,"references":3394,"versionKeys":3409,"packageCount":32,"repositoryCount":34},"ghsa-8mcc-hrx5-hvxc-9da62a9f","GitPython: clone_from()\u002Fclone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination",[3382,3383],"CVE-2026-78677","PYSEC-2026-3787",[178,3383],"2026-08-25T02:16:52.173Z","2026-09-08T19:00:06.914140693Z",[3388,3390,3392],{"type":1401,"score":3389},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1362,"score":3391},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1362,"score":3393},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3395,3397,3399,3401,3403,3404,3405,3407],{"type":1407,"url":3396},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-8mcc-hrx5-hvxc",{"type":1369,"url":3398},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78677",{"type":1366,"url":3400},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2210",{"type":1366,"url":3402},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fb68afff45af0f49e79a3e2d2162018986b37ad5d",{"type":1374,"url":1416},{"type":1366,"url":1976},{"type":1366,"url":3406},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3787.yaml",{"type":1369,"url":3408},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-separate-git-dir",[1424,1425,1426],{"id":179,"slug":3411,"dossier":47,"summary":3412,"aliases":3413,"sourceIds":3415,"published":3416,"modified":3417,"checkedAt":7,"severity":3418,"references":3421,"versionKeys":3428,"packageCount":32,"repositoryCount":1389},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[3414],"CVE-2026-112910",[179],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[3419],{"type":1401,"score":3420},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[3422,3424,3425,3426,3427],{"type":1366,"url":3423},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1366,"url":2342},{"type":1366,"url":2344},{"type":1374,"url":2346},{"type":1366,"url":2348},[2818,2819,2820,2821,2822,2350,2351,2352,2353],{"id":180,"slug":3430,"dossier":47,"summary":3431,"aliases":3432,"sourceIds":3435,"published":3436,"modified":3437,"checkedAt":7,"severity":3438,"references":3440,"versionKeys":3459,"packageCount":32,"repositoryCount":470},"ghsa-8qvm-5x2c-j2w7-8a075519","protobuf-python has a potential Denial of Service issue",[3433,3434],"CVE-2025-4565","PYSEC-2026-1806",[180,3434],"2025-06-16T16:02:58Z","2026-09-10T03:50:25.255076549Z",[3439],{"type":1362,"score":1363},[3441,3443,3445,3447,3449,3450,3452,3454,3456,3457],{"type":1366,"url":3442},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-735f-pc8j-v9w8",{"type":1366,"url":3444},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",{"type":1369,"url":3446},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-4565",{"type":1366,"url":3448},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F17838beda2943d08b8a9d4df5b68f5f04f26d901",{"type":1374,"url":3172},{"type":1366,"url":3451},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fdecoder_test.py#L87-L98",{"type":1366,"url":3453},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fmessage_test.py#L1436-L1478",{"type":1366,"url":3455},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Ftree\u002Fmain\u002Fpython#implementation-backends",{"type":1374,"url":3174},{"type":1369,"url":3458},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",[3178,3180,3181],{"id":181,"slug":3461,"dossier":47,"summary":3462,"aliases":3463,"sourceIds":3467,"published":3468,"modified":3469,"checkedAt":7,"severity":3470,"references":3472,"versionKeys":3482,"packageCount":32,"repositoryCount":2058},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[3464,3465,3466],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[181,3466],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[3471],{"type":1401,"score":1543},[3473,3475,3477,3478,3480,3481],{"type":1407,"url":3474},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1369,"url":3476},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1467,"url":2051},{"type":1366,"url":3479},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1374,"url":1375},{"type":1369,"url":2056},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":182,"slug":3484,"dossier":47,"summary":3485,"aliases":3486,"sourceIds":3489,"published":3490,"modified":3491,"checkedAt":7,"severity":3492,"references":3494,"versionKeys":3507,"packageCount":32,"repositoryCount":451},"ghsa-9356-575x-2w9m-908a1f8c","Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3487,3488],"CVE-2025-5197","PYSEC-2026-1983",[182,3488],"2025-08-06T12:31:20Z","2026-09-10T03:50:26.988216861Z",[3493],{"type":1401,"score":2196},[3495,3497,3499,3501,3502,3504,3505],{"type":1369,"url":3496},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-5197",{"type":1366,"url":3498},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F701caef704e356dc2f9331cc3fd5df0eccb4720a",{"type":1366,"url":3500},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F944b56000be5e9b61af8301aa340838770ad8a0b",{"type":1374,"url":1641},{"type":1366,"url":3503},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3f8b3fd0-166b-46e7-b60f-60dd9d2678bf",{"type":1374,"url":1811},{"type":1369,"url":3506},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9356-575x-2w9m",[1647,1648,1649,1650],{"id":183,"slug":3509,"dossier":47,"summary":3510,"aliases":3511,"sourceIds":3514,"published":3515,"modified":3516,"checkedAt":7,"severity":3517,"references":3520,"versionKeys":3534,"packageCount":32,"repositoryCount":34},"ghsa-94p4-4cq8-9g67-9a288a09","GitPython: Environment-variable exfiltration via Repo.create_remote() \u002F Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)",[3512,3513],"CVE-2026-73622","PYSEC-2026-3951",[183,3513],"2026-07-24T21:45:16Z","2026-09-24T14:45:07.411775302Z",[3518,3519],{"type":1401,"score":3389},{"type":1362,"score":3393},[3521,3523,3525,3527,3528,3530,3532],{"type":1407,"url":3522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-94p4-4cq8-9g67",{"type":1366,"url":3524},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F863417457a0633db7ea5aed4fd01e0b291a41162",{"type":1467,"url":3526},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8ac5a30519b6f4af85398b9b9d7064ff4d452da2",{"type":1374,"url":1416},{"type":1366,"url":3529},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.55",{"type":1366,"url":3531},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3951.yaml",{"type":1369,"url":3533},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-remote-add",[1424,1425,1426],{"id":184,"slug":3536,"dossier":47,"summary":3537,"aliases":3538,"sourceIds":3541,"published":3542,"modified":3543,"checkedAt":7,"severity":3544,"references":3546,"versionKeys":3562,"packageCount":32,"repositoryCount":34},"ghsa-956x-8gvw-wg5v-f5d32b2d","GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \u002F `Repo.blame()`",[3539,3540],"CVE-2026-67323","PYSEC-2026-3839",[184,3540],"2026-07-21T20:10:06Z","2026-09-10T12:25:39.217544351Z",[3545],{"type":1401,"score":3048},[3547,3549,3551,3553,3555,3556,3557,3559,3560],{"type":1366,"url":3548},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",{"type":1369,"url":3550},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67323",{"type":1366,"url":3552},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2163",{"type":1366,"url":3554},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F701ce32fe5ba8cb622c0e0342a376a6beb47d738",{"type":1374,"url":1416},{"type":1366,"url":1679},{"type":1366,"url":3558},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-unguarded-git-options",{"type":1374,"url":1683},{"type":1369,"url":3561},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",[1424,1425,1426],{"id":185,"slug":3564,"dossier":47,"summary":3565,"aliases":3566,"sourceIds":3569,"published":3570,"modified":3571,"checkedAt":7,"severity":3572,"references":3575,"versionKeys":3598,"packageCount":32,"repositoryCount":2107},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[3567,3568],"CVE-2024-47081","PYSEC-2026-1872",[185,3568],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[3573],{"type":1401,"score":3574},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3576,3578,3580,3582,3584,3586,3588,3590,3592,3594,3596],{"type":1366,"url":3577},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1369,"url":3579},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1366,"url":3581},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1467,"url":3583},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1369,"url":3585},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1374,"url":3587},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1366,"url":3589},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1366,"url":3591},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1374,"url":3593},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1366,"url":3595},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1366,"url":3597},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3599,3600],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":186,"slug":3602,"dossier":47,"summary":3603,"aliases":3604,"sourceIds":3608,"published":3609,"modified":3610,"checkedAt":7,"severity":3611,"references":3613,"versionKeys":3626,"packageCount":32,"repositoryCount":2058},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3605,3606,3607],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[186,3607],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3612],{"type":1401,"score":1543},[3614,3616,3618,3620,3622,3624,3625],{"type":1407,"url":3615},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1369,"url":3617},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1467,"url":3619},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1467,"url":3621},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1366,"url":3623},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1374,"url":1375},{"type":1369,"url":2628},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":187,"slug":3628,"dossier":47,"summary":3629,"aliases":3630,"sourceIds":3633,"published":3634,"modified":3635,"checkedAt":7,"severity":3636,"references":3638,"versionKeys":3653,"packageCount":32,"repositoryCount":34},"ghsa-9rj7-rf2p-w77r-996a0359","GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks",[3631,3632],"CVE-2026-76218","PYSEC-2026-3840",[187,3632],"2026-08-07T15:36:43Z","2026-09-10T12:25:55.324487522Z",[3637],{"type":1401,"score":2861},[3639,3641,3643,3644,3646,3647,3648,3650,3651],{"type":1366,"url":3640},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",{"type":1369,"url":3642},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76218",{"type":1366,"url":2125},{"type":1366,"url":3645},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fd9ddb55bdc66",{"type":1374,"url":1416},{"type":1366,"url":2130},{"type":1366,"url":3649},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-repo-init",{"type":1374,"url":1683},{"type":1369,"url":3652},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",[1424,1425,1426],{"id":188,"slug":3655,"dossier":47,"summary":3656,"aliases":3657,"sourceIds":3661,"published":3662,"modified":3663,"checkedAt":7,"severity":3664,"references":3669,"versionKeys":3680,"packageCount":32,"repositoryCount":1389},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3658,3659,3660],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[188,3660],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3665,3667],{"type":1362,"score":3666},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":3668},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3670,3672,3674,3676,3678,3679],{"type":1369,"url":3671},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1369,"url":3673},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1766,"url":3675},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1467,"url":3677},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":189,"slug":3682,"dossier":47,"summary":3683,"aliases":3684,"sourceIds":3686,"published":3687,"modified":3688,"checkedAt":7,"severity":3689,"references":3691,"versionKeys":3700,"packageCount":32,"repositoryCount":2354},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3685],"CVE-2026-112913",[189],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3690],{"type":1401,"score":1757},[3692,3694,3696,3698,3699],{"type":1366,"url":3693},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1366,"url":3695},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1366,"url":3697},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1374,"url":2346},{"type":1366,"url":2348},[2350,2351,2352,2353],{"id":190,"slug":3702,"dossier":47,"summary":3703,"aliases":3704,"sourceIds":3707,"published":3708,"modified":3709,"checkedAt":7,"severity":3710,"references":3713,"versionKeys":3730,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3705,3706],"CVE-2024-35195","PYSEC-2026-1873",[190,3706],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3711],{"type":1401,"score":3712},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3714,3716,3718,3720,3722,3723,3725,3727,3728],{"type":1366,"url":3715},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1369,"url":3717},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1366,"url":3719},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1467,"url":3721},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1374,"url":3587},{"type":1366,"url":3724},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1366,"url":3726},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1374,"url":3593},{"type":1369,"url":3729},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3599],{"id":191,"slug":3732,"dossier":47,"summary":3733,"aliases":3734,"sourceIds":3736,"published":3737,"modified":3738,"checkedAt":7,"severity":3739,"references":3742,"versionKeys":3752,"packageCount":32,"repositoryCount":66},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[3735],"CVE-2026-103263",[191],"2026-09-30T23:48:55Z","2026-10-02T03:56:10.964622908Z",[3740],{"type":1362,"score":3741},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3743,3745,3746,3748,3750,3751],{"type":1366,"url":3744},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1366,"url":1882},{"type":1366,"url":3747},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1366,"url":3749},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1374,"url":1888},{"type":1366,"url":1890},[1892,1893,1894,1895,1896,1897],{"id":192,"slug":3754,"dossier":47,"summary":3755,"aliases":3756,"sourceIds":3760,"published":3761,"modified":3762,"checkedAt":7,"severity":3763,"references":3768,"versionKeys":3784,"packageCount":32,"repositoryCount":480},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3757,3758,3759],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[192],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3764,3766],{"type":1401,"score":3765},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1362,"score":3767},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3769,3771,3773,3775,3776,3778,3780,3782],{"type":1369,"url":3770},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1366,"url":3772},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1366,"url":3774},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1374,"url":1773},{"type":1366,"url":3777},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1366,"url":3779},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1366,"url":3781},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1366,"url":3783},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1785,1786],{"id":193,"slug":3786,"dossier":47,"summary":3787,"aliases":3788,"sourceIds":3791,"published":3792,"modified":3793,"checkedAt":7,"severity":3794,"references":3797,"versionKeys":3806,"packageCount":32,"repositoryCount":1389},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3789,3790],"BIT-pillow-2026-112404","CVE-2026-112404",[193],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3795],{"type":1362,"score":3796},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3798,3800,3802,3804,3805],{"type":1366,"url":3799},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1369,"url":3801},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1366,"url":3803},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":194,"slug":3808,"dossier":47,"summary":3809,"aliases":3810,"sourceIds":3813,"published":3814,"modified":3815,"checkedAt":7,"severity":3816,"references":3818,"versionKeys":3830,"packageCount":32,"repositoryCount":3831},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[3811,3812],"CVE-2025-67725","PYSEC-2025-266",[194,3812],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[3817],{"type":1401,"score":1543},[3819,3821,3823,3825,3827,3828],{"type":1369,"url":3820},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1369,"url":3822},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1467,"url":3824},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1366,"url":3826},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1374,"url":1888},{"type":1369,"url":3829},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1892,1893,1894],9,{"id":195,"slug":3833,"dossier":47,"summary":3834,"aliases":3835,"sourceIds":3839,"published":3840,"modified":3841,"checkedAt":7,"severity":3842,"references":3845,"versionKeys":3885,"packageCount":32,"repositoryCount":2278},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3836,3837,3838],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[195,3838],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3843,3844],{"type":1362,"score":3050},{"type":1401,"score":1543},[3846,3848,3850,3852,3854,3856,3857,3859,3861,3863,3865,3867,3869,3871,3873,3875,3877,3879,3881,3883],{"type":1366,"url":3847},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1369,"url":3849},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1366,"url":3851},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1366,"url":3853},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1366,"url":3855},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1374,"url":1375},{"type":1366,"url":3858},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1366,"url":3860},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1366,"url":3862},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1369,"url":3864},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1369,"url":3866},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1369,"url":3868},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1369,"url":3870},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1369,"url":3872},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1369,"url":3874},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1369,"url":3876},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1369,"url":3878},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1369,"url":3880},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1369,"url":3882},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1369,"url":3884},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1379,1380,1381,1382,1383,1384,1385],{"id":196,"slug":3887,"dossier":47,"summary":3888,"aliases":3889,"sourceIds":3891,"published":3892,"modified":3893,"checkedAt":7,"severity":3894,"references":3896,"versionKeys":3910,"packageCount":32,"repositoryCount":66},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[3890],"CVE-2026-103262",[196],"2026-09-30T23:49:13Z","2026-10-02T03:56:11.819291984Z",[3895],{"type":1401,"score":1543},[3897,3899,3900,3902,3904,3906,3908,3909],{"type":1366,"url":3898},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1366,"url":1882},{"type":1366,"url":3901},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1366,"url":3903},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1366,"url":3905},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1366,"url":3907},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1374,"url":1888},{"type":1366,"url":1890},[1892,1893,1894,1895,1896,1897],{"id":197,"slug":3912,"dossier":47,"summary":3913,"aliases":3914,"sourceIds":3918,"published":3919,"modified":3920,"checkedAt":7,"severity":3921,"references":3924,"versionKeys":3933,"packageCount":32,"repositoryCount":3934},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3915,3916,3917],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[197,3917],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3922,3923],{"type":1362,"score":2367},{"type":1401,"score":1543},[3925,3927,3929,3931,3932],{"type":1407,"url":3926},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1369,"url":3928},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1467,"url":3930},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1374,"url":1375},{"type":1369,"url":1377},[1384,1385,1386,1387,1388],7,{"id":198,"slug":3936,"dossier":47,"summary":3937,"aliases":3938,"sourceIds":3941,"published":3942,"modified":3943,"checkedAt":7,"severity":3944,"references":3947,"versionKeys":3964,"packageCount":32,"repositoryCount":480},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3939,3940],"CVE-2025-27516","PYSEC-2026-1471",[198,3940],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3945],{"type":1362,"score":3946},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3948,3950,3952,3954,3956,3958,3960,3962],{"type":1366,"url":3949},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1369,"url":3951},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1467,"url":3953},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1374,"url":3955},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1366,"url":3957},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1366,"url":3959},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1374,"url":3961},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1369,"url":3963},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3965,3966],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":199,"slug":3968,"dossier":47,"summary":3969,"aliases":3970,"sourceIds":3972,"published":3973,"modified":3974,"checkedAt":7,"severity":3975,"references":3977,"versionKeys":3986,"packageCount":32,"repositoryCount":2354},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3971],"CVE-2026-112915",[199],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3976],{"type":1401,"score":1761},[3978,3980,3982,3983,3984,3985],{"type":1366,"url":3979},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1369,"url":3981},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1366,"url":3695},{"type":1366,"url":3697},{"type":1374,"url":2346},{"type":1366,"url":2348},[2350,2351,2352,2353],{"id":200,"slug":3988,"dossier":47,"summary":3989,"aliases":3990,"sourceIds":3993,"published":3994,"modified":3995,"checkedAt":7,"severity":3996,"references":3999,"versionKeys":4010,"packageCount":32,"repositoryCount":441},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[3991,3992],"CVE-2026-49854","PYSEC-2026-3388",[200,3992],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[3997],{"type":1401,"score":3998},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[4000,4002,4003,4005,4006,4008],{"type":1366,"url":4001},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1374,"url":1888},{"type":1366,"url":4004},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1374,"url":2000},{"type":1369,"url":4007},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1369,"url":4009},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1892,1893,1894,1895,1896],{"id":201,"slug":4012,"dossier":47,"summary":4013,"aliases":4014,"sourceIds":4018,"published":4019,"modified":4020,"checkedAt":7,"severity":4021,"references":4025,"versionKeys":4041,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[4015,4016,4017],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[201,4017],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[4022,4023],{"type":1401,"score":1402},{"type":1362,"score":4024},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4026,4028,4030,4032,4033,4035,4037,4039],{"type":1369,"url":4027},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1366,"url":4029},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1366,"url":4031},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1374,"url":2473},{"type":1366,"url":4034},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1366,"url":4036},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1374,"url":4038},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1369,"url":4040},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2479],{"id":202,"slug":4043,"dossier":47,"summary":4044,"aliases":4045,"sourceIds":4048,"published":4049,"modified":4050,"checkedAt":7,"severity":4051,"references":4053,"versionKeys":4062,"packageCount":32,"repositoryCount":1389},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[4046,4047],"BIT-pillow-2026-112406","CVE-2026-112406",[202],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[4052],{"type":1362,"score":2367},[4054,4056,4058,4060,4061],{"type":1366,"url":4055},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1369,"url":4057},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1366,"url":4059},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":203,"slug":4064,"dossier":47,"summary":4065,"aliases":4066,"sourceIds":4070,"published":4071,"modified":4072,"checkedAt":7,"severity":4073,"references":4077,"versionKeys":4095,"packageCount":32,"repositoryCount":480},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[4067,4068,4069],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[203],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[4074,4075],{"type":1401,"score":3420},{"type":1362,"score":4076},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[4078,4080,4082,4084,4086,4088,4089,4091,4093],{"type":1369,"url":4079},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1366,"url":4081},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1366,"url":4083},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1366,"url":4085},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1366,"url":4087},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1374,"url":1773},{"type":1366,"url":4090},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1366,"url":4092},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1366,"url":4094},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1785,1786],{"id":204,"slug":4097,"dossier":47,"summary":4098,"aliases":4099,"sourceIds":4101,"published":4102,"modified":4103,"checkedAt":7,"severity":4104,"references":4106,"versionKeys":4115,"packageCount":32,"repositoryCount":34},"ghsa-f9j4-qggq-h239-968ed9a4","GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution",[4100],"CVE-2026-110858",[204],"2026-10-27T15:26:50Z","2026-10-27T15:47:24.258288646Z",[4105],{"type":1401,"score":3108},[4107,4109,4111,4113,4114],{"type":1366,"url":4108},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-f9j4-qggq-h239",{"type":1366,"url":4110},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2247",{"type":1366,"url":4112},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F790bb3164948625ffb043d2a162425d55923fe9a",{"type":1374,"url":1416},{"type":1366,"url":1447},[1424,1425,1426],{"id":205,"slug":4117,"dossier":47,"summary":4118,"aliases":4119,"sourceIds":4122,"published":4123,"modified":4124,"checkedAt":7,"severity":4125,"references":4127,"versionKeys":4135,"packageCount":32,"repositoryCount":1389},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[4120,4121],"BIT-pillow-2026-112891","CVE-2026-112891",[205],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[4126],{"type":1362,"score":2760},[4128,4130,4132,4133,4134],{"type":1366,"url":4129},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1369,"url":4131},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1366,"url":2978},{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":206,"slug":4137,"dossier":47,"summary":4138,"aliases":4139,"sourceIds":4142,"published":4143,"modified":4144,"checkedAt":7,"severity":4145,"references":4150,"versionKeys":4174,"packageCount":32,"repositoryCount":66},"ghsa-fgcw-684q-jj6r-9fe55ba1","huggingface\u002Ftransformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path",[4140,4141],"CVE-2026-5241","PYSEC-2026-2290",[206,4141],"2026-06-03T14:16:46.337Z","2026-09-10T03:50:49.345942449Z",[4146,4148],{"type":1401,"score":4147},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",{"type":1401,"score":4149},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[4151,4153,4155,4157,4159,4161,4163,4165,4166,4168,4170,4172],{"type":1369,"url":4152},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-5241",{"type":1467,"url":4154},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F676559d5022b74aaa0cee1cee0842b7f27c5320e",{"type":1369,"url":4156},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34456",{"type":1369,"url":4158},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1366,"url":4160},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",{"type":1366,"url":4162},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-5241",{"type":1766,"url":4164},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484384",{"type":1374,"url":1641},{"type":1366,"url":4167},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2026-2290.yaml",{"type":1407,"url":4169},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fceb3ce1a-4c45-497a-b25e-cb9a7685e619",{"type":1366,"url":4171},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-5241.json",{"type":1369,"url":4173},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fgcw-684q-jj6r",[1647,1648,1649,1650,1651,1652,1653,1654,1655],{"id":207,"slug":4176,"dossier":47,"summary":4177,"aliases":4178,"sourceIds":4182,"published":4183,"modified":4184,"checkedAt":7,"severity":4185,"references":4188,"versionKeys":4202,"packageCount":32,"repositoryCount":2058},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[4179,4180,4181],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[207,4181],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[4186],{"type":1401,"score":4187},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[4189,4191,4193,4195,4197,4198,4199,4200],{"type":1366,"url":4190},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1369,"url":4192},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1366,"url":4194},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1366,"url":4196},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1374,"url":1375},{"type":1366,"url":2628},{"type":1374,"url":2630},{"type":1369,"url":4201},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":208,"slug":4204,"dossier":47,"summary":4205,"aliases":4206,"sourceIds":4209,"published":4210,"modified":4211,"checkedAt":7,"severity":4212,"references":4215,"versionKeys":4225,"packageCount":32,"repositoryCount":34},"ghsa-fjr4-x663-mwxc-324b7aa5","GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)",[4207,4208],"CVE-2026-73624","PYSEC-2026-3995",[208,4208],"2026-07-24T16:41:20Z","2026-09-29T09:10:55.738617943Z",[4213,4214],{"type":1401,"score":1852},{"type":1362,"score":1854},[4216,4218,4219,4221,4222,4223],{"type":1407,"url":4217},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fjr4-x663-mwxc",{"type":1366,"url":2867},{"type":1366,"url":4220},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1d51b891d7f236044a6aa17498ec682b63dad6e6",{"type":1374,"url":1416},{"type":1366,"url":2872},{"type":1369,"url":4224},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-diff",[1424,1425,1426],{"id":209,"slug":4227,"dossier":47,"summary":2940,"aliases":4228,"sourceIds":4231,"published":4232,"modified":4233,"checkedAt":7,"severity":4234,"references":4237,"versionKeys":4248,"packageCount":32,"repositoryCount":32},"ghsa-fpwr-67px-3qhx-94f30126",[4229,4230],"CVE-2025-1194","PYSEC-2026-1984",[209,4230],"2025-04-29T12:30:21Z","2026-08-13T20:11:58.399313771Z",[4235],{"type":1401,"score":4236},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[4238,4240,4242,4243,4245,4246],{"type":1369,"url":4239},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1194",{"type":1366,"url":4241},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F92c5ca9dd70de3ade2af2eb835c96215cc50e815",{"type":1374,"url":1641},{"type":1366,"url":4244},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F86f58dcd-683f-4adc-a735-849f51e9abb2",{"type":1374,"url":1811},{"type":1369,"url":4247},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fpwr-67px-3qhx",[1647],{"id":210,"slug":4250,"dossier":47,"summary":4251,"aliases":4252,"sourceIds":4254,"published":4255,"modified":4256,"checkedAt":7,"severity":4257,"references":4260,"versionKeys":4271,"packageCount":32,"repositoryCount":2354},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[4253],"CVE-2026-112935",[210],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[4258],{"type":1401,"score":4259},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4261,4263,4265,4267,4269,4270],{"type":1366,"url":4262},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1369,"url":4264},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1366,"url":4266},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1366,"url":4268},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1374,"url":2346},{"type":1366,"url":2348},[2350,2351,2352,2353],{"id":211,"slug":4273,"dossier":47,"summary":4274,"aliases":4275,"sourceIds":4277,"published":4278,"modified":4279,"checkedAt":7,"severity":4280,"references":4283,"versionKeys":4292,"packageCount":32,"repositoryCount":34},"ghsa-fx3j-rwgx-fr94-14d75c26","GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name",[4276],"CVE-2026-110855",[211],"2026-10-27T15:26:32Z","2026-10-27T15:47:24.291028301Z",[4281],{"type":1401,"score":4282},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4284,4286,4288,4290,4291],{"type":1366,"url":4285},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fx3j-rwgx-fr94",{"type":1366,"url":4287},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2255",{"type":1366,"url":4289},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9349ff58ee00c9fb14d515c8e693f33b2144b238",{"type":1374,"url":1416},{"type":1366,"url":1447},[1424,1425,1426],{"id":212,"slug":4294,"dossier":47,"summary":4295,"aliases":4296,"sourceIds":4300,"published":4301,"modified":4302,"checkedAt":7,"severity":4303,"references":4306,"versionKeys":4317,"packageCount":32,"repositoryCount":1722},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[4297,4298,4299],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[212,4299],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[4304,4305],{"type":1362,"score":1910},{"type":1401,"score":1495},[4307,4309,4311,4313,4315,4316],{"type":1369,"url":4308},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1369,"url":4310},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1766,"url":4312},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1467,"url":4314},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1374,"url":1375},{"type":1369,"url":1377},[1381,1382,1383,1384,1385,1386,1387,1388],{"id":213,"slug":4319,"dossier":47,"summary":4320,"aliases":4321,"sourceIds":4324,"published":4325,"modified":4326,"checkedAt":7,"severity":4327,"references":4329,"versionKeys":4342,"packageCount":32,"repositoryCount":34},"ghsa-g5vv-9gxw-82hx-203070a6","GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author\u002Fcommitter field parsing",[4322,4323],"CVE-2026-87819","PYSEC-2026-3984",[213,4323],"2026-09-09T12:17:17.120Z","2026-09-30T23:45:04.037560336Z",[4328],{"type":1401,"score":1543},[4330,4332,4334,4336,4337,4338,4340],{"type":1407,"url":4331},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-g5vv-9gxw-82hx",{"type":1366,"url":4333},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2215",{"type":1366,"url":4335},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F751473a5f3221d6f989291cbebcc404353fd3ba8",{"type":1374,"url":1416},{"type":1366,"url":1418},{"type":1366,"url":4339},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3984.yaml",{"type":1369,"url":4341},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-denial-of-service-via-redos",[1424,1425,1426],{"id":214,"slug":4344,"dossier":47,"summary":4345,"aliases":4346,"sourceIds":4349,"published":4350,"modified":4351,"checkedAt":7,"severity":4352,"references":4355,"versionKeys":4366,"packageCount":32,"repositoryCount":1389},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[4347,4348],"BIT-pillow-2026-96778","CVE-2026-96778",[214],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[4353],{"type":1362,"score":4354},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4356,4358,4360,4362,4364,4365],{"type":1366,"url":4357},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1369,"url":4359},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1366,"url":4361},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1366,"url":4363},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":215,"slug":4368,"dossier":47,"summary":4369,"aliases":4370,"sourceIds":4373,"published":4374,"modified":4375,"checkedAt":7,"severity":4376,"references":4379,"versionKeys":4398,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[4371,4372],"CVE-2024-34062","PYSEC-2026-1976",[215,4372],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[4377],{"type":1401,"score":4378},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4380,4382,4384,4386,4388,4390,4392,4394,4396],{"type":1366,"url":4381},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1369,"url":4383},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1366,"url":4385},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1374,"url":4387},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1366,"url":4389},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1366,"url":4391},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1366,"url":4393},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1374,"url":4395},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1369,"url":4397},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[4399],"pypi:tqdm@4.66.2",{"id":216,"slug":4401,"dossier":47,"summary":4402,"aliases":4403,"sourceIds":4407,"published":4408,"modified":4409,"checkedAt":7,"severity":4410,"references":4413,"versionKeys":4424,"packageCount":32,"repositoryCount":1389},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[4404,4405,4406],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[216,4406],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[4411,4412],{"type":1362,"score":1910},{"type":1401,"score":1495},[4414,4416,4418,4420,4422,4423],{"type":1369,"url":4415},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1369,"url":4417},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1766,"url":4419},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1467,"url":4421},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":217,"slug":4426,"dossier":47,"summary":4427,"aliases":4428,"sourceIds":4431,"published":4432,"modified":4433,"checkedAt":7,"severity":4434,"references":4439,"versionKeys":4449,"packageCount":32,"repositoryCount":1389},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[4429,4430],"CVE-2026-25645","PYSEC-2026-2275",[217,4430],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[4435,4437],{"type":1401,"score":4436},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1401,"score":4438},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4440,4442,4444,4446,4447],{"type":1369,"url":4441},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1369,"url":4443},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1467,"url":4445},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1374,"url":3587},{"type":1369,"url":4448},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3599,3600,4450,4451],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":218,"slug":4453,"dossier":47,"summary":4454,"aliases":4455,"sourceIds":4458,"published":4459,"modified":4460,"checkedAt":7,"severity":4461,"references":4463,"versionKeys":4472,"packageCount":32,"repositoryCount":1389},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[4456,4457],"BIT-pillow-2026-112892","CVE-2026-112892",[218],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[4462],{"type":1362,"score":2367},[4464,4466,4468,4470,4471],{"type":1366,"url":4465},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1369,"url":4467},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1366,"url":4469},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":219,"slug":4474,"dossier":47,"summary":4475,"aliases":4476,"sourceIds":4479,"published":4480,"modified":4481,"checkedAt":7,"severity":4482,"references":4484,"versionKeys":4496,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[4477,4478],"CVE-2026-97688","PYSEC-2026-4176",[219,4478],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[4483],{"type":1362,"score":2760},[4485,4487,4489,4491,4492,4493,4494],{"type":1366,"url":4486},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1369,"url":4488},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1366,"url":4490},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1374,"url":1713},{"type":1366,"url":3349},{"type":1374,"url":1715},{"type":1369,"url":4495},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[3354,3355],{"id":220,"slug":4498,"dossier":47,"summary":4499,"aliases":4500,"sourceIds":4503,"published":4504,"modified":4505,"checkedAt":7,"severity":4506,"references":4508,"versionKeys":4519,"packageCount":32,"repositoryCount":1722},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[4501,4502],"CVE-2025-66418","PYSEC-2026-1998",[220,4502],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[4507],{"type":1362,"score":1698},[4509,4511,4513,4515,4516,4517],{"type":1366,"url":4510},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1369,"url":4512},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1467,"url":4514},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1374,"url":1713},{"type":1374,"url":1715},{"type":1369,"url":4518},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1717,1718,1719,1720,1721],{"id":221,"slug":4521,"dossier":47,"summary":4522,"aliases":4523,"sourceIds":4526,"published":4527,"modified":4528,"checkedAt":7,"severity":4529,"references":4532,"versionKeys":4547,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[4524,4525],"CVE-2024-56201","PYSEC-2026-1472",[221,4525],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[4530,4531],{"type":1401,"score":1667},{"type":1362,"score":3946},[4533,4535,4537,4539,4541,4542,4544,4545],{"type":1366,"url":4534},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1369,"url":4536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1366,"url":4538},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1467,"url":4540},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1374,"url":3955},{"type":1366,"url":4543},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1374,"url":3961},{"type":1369,"url":4546},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3965],{"id":222,"slug":4549,"dossier":47,"summary":4550,"aliases":4551,"sourceIds":4553,"published":4554,"modified":4555,"checkedAt":7,"severity":4556,"references":4557,"versionKeys":4566,"packageCount":32,"repositoryCount":34},"ghsa-gq48-pqfc-9p58-0aa8d93f","GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree",[4552],"CVE-2026-110860",[222],"2026-10-27T15:26:57Z","2026-10-27T15:47:24.379897252Z",[],[4558,4560,4562,4564,4565],{"type":1366,"url":4559},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-gq48-pqfc-9p58",{"type":1366,"url":4561},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2232",{"type":1366,"url":4563},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F24b6f95d4b90ab1483fb601c736ac6e7c059cd61",{"type":1374,"url":1416},{"type":1366,"url":1447},[1424,1425,1426],{"id":223,"slug":4568,"dossier":47,"summary":4569,"aliases":4570,"sourceIds":4574,"published":4575,"modified":4576,"checkedAt":7,"severity":4577,"references":4580,"versionKeys":4592,"packageCount":32,"repositoryCount":1389},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[4571,4572,4573],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[223,4573],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[4578],{"type":1401,"score":4579},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[4581,4583,4585,4587,4589,4590],{"type":1407,"url":4582},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1369,"url":4584},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1467,"url":4586},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1366,"url":4588},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1374,"url":2473},{"type":1369,"url":4591},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2479,2480,2481,2482,4593,4594,4595,4596,4597,4598,4599,4600],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":224,"slug":4602,"dossier":47,"summary":4603,"aliases":4604,"sourceIds":4607,"published":4608,"modified":4609,"checkedAt":7,"severity":4610,"references":4612,"versionKeys":4633,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[4605,4606],"CVE-2024-34064","PYSEC-2026-1474",[224,4606],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[4611],{"type":1401,"score":3081},[4613,4615,4617,4619,4620,4622,4624,4626,4628,4630,4631],{"type":1366,"url":4614},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1369,"url":4616},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1467,"url":4618},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1374,"url":3955},{"type":1366,"url":4621},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1366,"url":4623},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1366,"url":4625},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1366,"url":4627},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1366,"url":4629},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1374,"url":3961},{"type":1369,"url":4632},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3965],{"id":225,"slug":4635,"dossier":47,"summary":4636,"aliases":4637,"sourceIds":4640,"published":4641,"modified":4642,"checkedAt":7,"severity":4643,"references":4645,"versionKeys":4660,"packageCount":32,"repositoryCount":34},"ghsa-hh9p-6wh2-4mfc-8e33cff1","GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",[4638,4639],"CVE-2026-76217","PYSEC-2026-3841",[225,4639],"2026-08-07T15:43:56Z","2026-09-10T12:26:07.095223621Z",[4644],{"type":1401,"score":1964},[4646,4648,4650,4651,4653,4654,4655,4657,4658],{"type":1366,"url":4647},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",{"type":1369,"url":4649},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76217",{"type":1366,"url":2125},{"type":1366,"url":4652},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Ff2550b65bf60ca087190981e2c7b6865e201f40c",{"type":1374,"url":1416},{"type":1366,"url":2130},{"type":1366,"url":4656},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-pathspec-from-file",{"type":1374,"url":1683},{"type":1369,"url":4659},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",[1424,1425,1426],{"id":226,"slug":4662,"dossier":47,"summary":4663,"aliases":4664,"sourceIds":4667,"published":4668,"modified":4669,"checkedAt":7,"severity":4670,"references":4675,"versionKeys":4692,"packageCount":32,"repositoryCount":34},"ghsa-hmq2-w58f-27jc-f0b0fe70","GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython",[4665,4666],"CVE-2026-76222","PYSEC-2026-3784",[226,4666],"2026-08-07T15:45:39Z","2026-09-08T21:00:05.149418166Z",[4671,4673],{"type":1401,"score":4672},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",{"type":1362,"score":4674},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4676,4678,4680,4682,4684,4686,4687,4688,4690],{"type":1407,"url":4677},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hmq2-w58f-27jc",{"type":1369,"url":4679},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76222",{"type":1366,"url":4681},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2202",{"type":1366,"url":4683},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F4299c990e1ca21896f9485277caf7bb0ae5b404c",{"type":1366,"url":4685},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe4b8e7d026ca6abb4cf604f8e77093432ce23c06",{"type":1374,"url":1416},{"type":1366,"url":2130},{"type":1366,"url":4689},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3784.yaml",{"type":1369,"url":4691},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-gitmodules-submodule-name",[1424,1425,1426],{"id":227,"slug":4694,"dossier":47,"summary":4695,"aliases":4696,"sourceIds":4699,"published":4700,"modified":4701,"checkedAt":7,"severity":4702,"references":4706,"versionKeys":4722,"packageCount":32,"repositoryCount":32},"ghsa-hxxf-235m-72v3-21da19b0","Deserialization of Untrusted Data in Hugging Face Transformers",[4697,4698],"CVE-2024-11394","PYSEC-2024-229",[227,4698],"2024-11-22T22:15:07Z","2026-09-10T03:50:20.811665084Z",[4703,4705],{"type":1401,"score":4704},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1401,"score":1402},[4707,4709,4711,4713,4714,4716,4718,4720],{"type":1369,"url":4708},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11394",{"type":1366,"url":4710},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fissues\u002F34840",{"type":1366,"url":4712},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F35296",{"type":1374,"url":1641},{"type":1366,"url":4715},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-229.yaml",{"type":1366,"url":4717},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515",{"type":1369,"url":4719},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515\u002F",{"type":1369,"url":4721},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxxf-235m-72v3",[1647],{"id":228,"slug":4724,"dossier":47,"summary":4725,"aliases":4726,"sourceIds":4729,"published":4730,"modified":4731,"checkedAt":7,"severity":4732,"references":4734,"versionKeys":4743,"packageCount":32,"repositoryCount":1389},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4727,4728],"BIT-pillow-2026-112893","CVE-2026-112893",[228],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4733],{"type":1362,"score":1363},[4735,4737,4739,4741,4742],{"type":1366,"url":4736},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1369,"url":4738},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1366,"url":4740},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":229,"slug":4745,"dossier":47,"summary":4746,"aliases":4747,"sourceIds":4749,"published":4750,"modified":4751,"checkedAt":7,"severity":4752,"references":4755,"versionKeys":4765,"packageCount":32,"repositoryCount":2354},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4748],"CVE-2026-112936",[229],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4753],{"type":1401,"score":4754},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4756,4758,4760,4762,4763],{"type":1366,"url":4757},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1369,"url":4759},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1366,"url":4761},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1374,"url":2346},{"type":1366,"url":4764},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[2350,2351,2352,2353],{"id":230,"slug":4767,"dossier":47,"summary":4768,"aliases":4769,"sourceIds":4772,"published":4773,"modified":4774,"checkedAt":7,"severity":4775,"references":4777,"versionKeys":4786,"packageCount":32,"repositoryCount":1389},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4770,4771],"BIT-pillow-2026-112894","CVE-2026-112894",[230],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4776],{"type":1362,"score":2367},[4778,4780,4782,4784,4785],{"type":1366,"url":4779},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1369,"url":4781},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1366,"url":4783},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":231,"slug":4788,"dossier":47,"summary":4789,"aliases":4790,"sourceIds":4793,"published":4794,"modified":4795,"checkedAt":7,"severity":4796,"references":4798,"versionKeys":4808,"packageCount":32,"repositoryCount":3831},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[4791,4792],"CVE-2025-67726","PYSEC-2025-267",[231,4792],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[4797],{"type":1401,"score":1543},[4799,4801,4803,4804,4806,4807],{"type":1369,"url":4800},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1369,"url":4802},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1467,"url":3824},{"type":1366,"url":4805},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1374,"url":1888},{"type":1369,"url":3829},[1892,1893,1894],{"id":232,"slug":4810,"dossier":47,"summary":4811,"aliases":4812,"sourceIds":4815,"published":4816,"modified":4817,"checkedAt":7,"severity":4818,"references":4821,"versionKeys":4846,"packageCount":32,"repositoryCount":34},"ghsa-jhr6-gm9c-rqjv-a6fbec2f","sentence-transformers local model loading bypasses trust_remote_code and executes custom Python",[4813,4814],"CVE-2026-68770","PYSEC-2026-4164",[232,4814],"2026-07-31T21:31:59Z","2026-10-01T17:55:41.036478465Z",[4819,4820],{"type":1401,"score":1607},{"type":1362,"score":1609},[4822,4824,4826,4828,4830,4832,4834,4836,4838,4840,4842,4844],{"type":1369,"url":4823},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-68770",{"type":1366,"url":4825},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fissues\u002F3801",{"type":1366,"url":4827},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3807",{"type":1366,"url":4829},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3935",{"type":1366,"url":4831},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002F626eb602b088878a8173bcab69225f68411b99e1",{"type":1366,"url":4833},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002Fae1acc3fb2aa2004577b297eb4a915ce7a03316a",{"type":1374,"url":4835},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers",{"type":1366,"url":4837},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv5.6.0",{"type":1366,"url":4839},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv6.0.0",{"type":1366,"url":4841},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fsentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false",{"type":1374,"url":4843},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsentence-transformers",{"type":1369,"url":4845},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jhr6-gm9c-rqjv",[4847,4848,4849,4850,4851],"pypi:sentence-transformers@3.3.1","pypi:sentence-transformers@4.0.2","pypi:sentence-transformers@4.1.0","pypi:sentence-transformers@5.0.0","pypi:sentence-transformers@5.2.0",{"id":233,"slug":4853,"dossier":47,"summary":4854,"aliases":4855,"sourceIds":4859,"published":4860,"modified":4861,"checkedAt":7,"severity":4862,"references":4864,"versionKeys":4878,"packageCount":32,"repositoryCount":2058},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4856,4857,4858],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[233,4858],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4863],{"type":1401,"score":1543},[4865,4867,4869,4871,4873,4874,4875,4876],{"type":1366,"url":4866},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1369,"url":4868},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1366,"url":4870},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1366,"url":4872},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1374,"url":1375},{"type":1366,"url":2628},{"type":1374,"url":2630},{"type":1369,"url":4877},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":234,"slug":4880,"dossier":47,"summary":4881,"aliases":4882,"sourceIds":4885,"published":4886,"modified":4887,"checkedAt":7,"severity":4888,"references":4890,"versionKeys":4903,"packageCount":32,"repositoryCount":32},"ghsa-jjph-296x-mrcr-0f661d67","Transformers vulnerable to ReDoS attack through its get_imports() function",[4883,4884],"CVE-2025-3264","PYSEC-2026-1985",[234,4884],"2025-07-07T12:30:22Z","2026-07-07T17:56:51.899728258Z",[4889],{"type":1401,"score":2196},[4891,4893,4895,4897,4898,4900,4901],{"type":1369,"url":4892},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3264",{"type":1366,"url":4894},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F0720e206c6ba28887e4d60ef60a6a089f6c1cc76",{"type":1366,"url":4896},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F126abe3461762e5fc180e7e614391d1b4ab051ca",{"type":1374,"url":1641},{"type":1366,"url":4899},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c6f7822-9992-476d-8cf0-b0b1623427df",{"type":1374,"url":1811},{"type":1369,"url":4902},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjph-296x-mrcr",[1647],{"id":235,"slug":4905,"dossier":47,"summary":4906,"aliases":4907,"sourceIds":4910,"published":4911,"modified":4912,"checkedAt":7,"severity":4913,"references":4917,"versionKeys":4927,"packageCount":32,"repositoryCount":34},"ghsa-jm78-9fvv-mhgr-2c167ddc","GitPython: git-config OPTION-name injection via =\u002F#\u002Fwhitespace bypasses name validator, enabling forged core.sshCommand\u002FhooksPath (RCE)",[4908,4909],"CVE-2026-76221","PYSEC-2026-3783",[235,4909],"2026-08-07T15:46:35Z","2026-09-10T03:51:14.296736368Z",[4914,4915],{"type":1401,"score":1667},{"type":1362,"score":4916},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4918,4920,4921,4923,4924,4925],{"type":1407,"url":4919},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-jm78-9fvv-mhgr",{"type":1366,"url":2125},{"type":1366,"url":4922},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fa495ccd3b547ccd60b2187215823b72a9c0188bf",{"type":1374,"url":1416},{"type":1366,"url":2130},{"type":1369,"url":4926},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-option-name",[1424,1425,1426],{"id":236,"slug":4929,"dossier":47,"summary":4930,"aliases":4931,"sourceIds":4934,"published":4935,"modified":4936,"checkedAt":7,"severity":4937,"references":4942,"versionKeys":4955,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[4932,4933],"CVE-2024-5206","PYSEC-2024-110",[236,4933],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[4938,4940],{"type":1401,"score":4939},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1401,"score":4941},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4943,4945,4947,4949,4951,4953],{"type":1369,"url":4944},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1467,"url":4946},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1366,"url":4948},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1374,"url":4950},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1366,"url":4952},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1369,"url":4954},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[4956],"pypi:scikit-learn@1.3.2",{"id":237,"slug":4958,"dossier":47,"summary":4959,"aliases":4960,"sourceIds":4962,"published":4963,"modified":4964,"checkedAt":7,"severity":4965,"references":4967,"versionKeys":4976,"packageCount":32,"repositoryCount":34},"ghsa-m64x-33q8-m5h7-491ad59c","GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines",[4961],"CVE-2026-110856",[237],"2026-10-27T15:26:24Z","2026-10-27T15:47:24.576766638Z",[4966],{"type":1362,"score":2367},[4968,4970,4972,4974,4975],{"type":1366,"url":4969},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-m64x-33q8-m5h7",{"type":1366,"url":4971},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2253",{"type":1366,"url":4973},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8290c98d35465a38090cdcc1b17be69967092a15",{"type":1374,"url":1416},{"type":1366,"url":1447},[1424,1425,1426],{"id":238,"slug":4978,"dossier":47,"summary":4979,"aliases":4980,"sourceIds":4983,"published":4984,"modified":4985,"checkedAt":7,"severity":4986,"references":4989,"versionKeys":4997,"packageCount":32,"repositoryCount":470},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4981,4982],"CVE-2026-44432","PYSEC-2026-142",[238,4982],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4987,4988],{"type":1401,"score":1543},{"type":1362,"score":1698},[4990,4992,4994,4996],{"type":1369,"url":4991},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1369,"url":4993},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1366,"url":4995},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1374,"url":1713},[3354],{"id":239,"slug":4999,"dossier":47,"summary":5000,"aliases":5001,"sourceIds":5004,"published":5005,"modified":5006,"checkedAt":7,"severity":5007,"references":5009,"versionKeys":5018,"packageCount":32,"repositoryCount":441},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[5002,5003],"CVE-2026-49855","PYSEC-2026-3389",[239,5003],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[5008],{"type":1401,"score":1543},[5010,5012,5013,5014,5016],{"type":1366,"url":5011},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1374,"url":1888},{"type":1374,"url":2000},{"type":1369,"url":5015},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1369,"url":5017},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1892,1893,1894,1895,1896],{"id":240,"slug":5020,"dossier":47,"summary":5021,"aliases":5022,"sourceIds":5025,"published":5026,"modified":5027,"checkedAt":7,"severity":5028,"references":5030,"versionKeys":5043,"packageCount":32,"repositoryCount":66},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[5023,5024],"CVE-2026-82397","PYSEC-2026-3928",[240,5024],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[5029],{"type":1401,"score":1543},[5031,5033,5035,5036,5038,5039,5040,5041],{"type":1366,"url":5032},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1369,"url":5034},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1366,"url":3278},{"type":1366,"url":5037},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1374,"url":1888},{"type":1366,"url":3285},{"type":1374,"url":2000},{"type":1369,"url":5042},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1892,1893,1894,1895,1896,1897],{"id":241,"slug":5045,"dossier":47,"summary":5046,"aliases":5047,"sourceIds":5050,"published":5051,"modified":5052,"checkedAt":7,"severity":5053,"references":5055,"versionKeys":5066,"packageCount":32,"repositoryCount":1389},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[5048,5049],"BIT-pillow-2026-96640","CVE-2026-96640",[241],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[5054],{"type":1362,"score":1363},[5056,5058,5060,5062,5064,5065],{"type":1366,"url":5057},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1369,"url":5059},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1366,"url":5061},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1366,"url":5063},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":242,"slug":5068,"dossier":47,"summary":5069,"aliases":5070,"sourceIds":5073,"published":5074,"modified":5075,"checkedAt":7,"severity":5076,"references":5079,"versionKeys":5087,"packageCount":32,"repositoryCount":34},"ghsa-mv93-w799-cj2w-4413137a","GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath",[5071,5072],"CVE-2026-67326","PYSEC-2026-3980",[242,5072],"2026-05-08T23:19:02Z","2026-09-17T09:10:55.928803360Z",[5077,5078],{"type":1401,"score":1935},{"type":1401,"score":3052},[5080,5082,5084,5085],{"type":1407,"url":5081},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-mv93-w799-cj2w",{"type":1369,"url":5083},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1374,"url":1416},{"type":1369,"url":5086},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-newline-injection-via-config-writer-section",[1424,1425,1426],{"id":243,"slug":5089,"dossier":47,"summary":5090,"aliases":5091,"sourceIds":5094,"published":5095,"modified":5096,"checkedAt":7,"severity":5097,"references":5099,"versionKeys":5108,"packageCount":32,"repositoryCount":1389},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[5092,5093],"BIT-pillow-2026-112895","CVE-2026-112895",[243],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[5098],{"type":1362,"score":2367},[5100,5102,5104,5106,5107],{"type":1366,"url":5101},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1369,"url":5103},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1366,"url":5105},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":244,"slug":5110,"dossier":47,"summary":5111,"aliases":5112,"sourceIds":5115,"published":5116,"modified":5117,"checkedAt":7,"severity":5118,"references":5123,"versionKeys":5135,"packageCount":32,"repositoryCount":34},"ghsa-p538-c434-8v24-c303e516","GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count",[5113,5114],"CVE-2026-73621","PYSEC-2026-3950",[244,5114],"2026-08-03T20:23:17Z","2026-09-10T13:10:55.177009469Z",[5119,5121],{"type":1401,"score":5120},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1362,"score":5122},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[5124,5126,5128,5130,5131,5133],{"type":1407,"url":5125},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-p538-c434-8v24",{"type":1366,"url":5127},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2184",{"type":1366,"url":5129},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F38553b6fddc7f6a667cdb45a6762343a08fc72b2",{"type":1374,"url":1416},{"type":1366,"url":5132},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.56",{"type":1369,"url":5134},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-truncation-via-commit-count",[1424,1425,1426],{"id":245,"slug":5137,"dossier":47,"summary":5138,"aliases":5139,"sourceIds":5143,"published":5144,"modified":5145,"checkedAt":7,"severity":5146,"references":5148,"versionKeys":5158,"packageCount":32,"repositoryCount":1389},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[5140,5141,5142],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[245,5142],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[5147],{"type":1401,"score":1495},[5149,5151,5153,5155,5156,5157],{"type":1369,"url":5150},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1369,"url":5152},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1766,"url":5154},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1467,"url":2547},{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":246,"slug":5160,"dossier":47,"summary":5161,"aliases":5162,"sourceIds":5164,"published":5165,"modified":5166,"checkedAt":7,"severity":5167,"references":5169,"versionKeys":5181,"packageCount":32,"repositoryCount":66},"ghsa-pcg2-g6cj-q92c-613600e5","Tornado: Quadratic CPU usage when parsing HTTP headers with line folding",[5163],"CVE-2026-116577",[246],"2026-10-28T22:43:41Z","2026-10-28T23:00:04.070057045Z",[5168],{"type":1401,"score":1799},[5170,5172,5174,5176,5178,5179],{"type":1366,"url":5171},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pcg2-g6cj-q92c",{"type":1369,"url":5173},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116577",{"type":1366,"url":5175},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3765",{"type":1366,"url":5177},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F1b7a1dc9f340f52de929852e8125aa12f25297c9",{"type":1374,"url":1888},{"type":1366,"url":5180},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.6.0",[1892,1893,1894,1895,1896,1897],{"id":247,"slug":5183,"dossier":47,"summary":5184,"aliases":5185,"sourceIds":5189,"published":5190,"modified":5191,"checkedAt":7,"severity":5192,"references":5196,"versionKeys":5205,"packageCount":32,"repositoryCount":1389},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[5186,5187,5188],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[247,5188],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[5193,5194],{"type":1362,"score":3796},{"type":1401,"score":5195},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5197,5199,5201,5203,5204],{"type":1407,"url":5198},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1369,"url":5200},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1467,"url":5202},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":248,"slug":5207,"dossier":47,"summary":5208,"aliases":5209,"sourceIds":5213,"published":5214,"modified":5215,"checkedAt":7,"severity":5216,"references":5219,"versionKeys":5232,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[5210,5211,5212],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[248,5212],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[5217,5218],{"type":1401,"score":1799},{"type":1401,"score":1543},[5220,5222,5224,5226,5228,5230,5231],{"type":1407,"url":5221},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1369,"url":5223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1467,"url":5225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1467,"url":5227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1366,"url":5229},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1374,"url":1375},{"type":1369,"url":2628},[1384,1385,1386,1387],{"id":249,"slug":5234,"dossier":47,"summary":5235,"aliases":5236,"sourceIds":5239,"published":4886,"modified":5240,"checkedAt":7,"severity":5241,"references":5244,"versionKeys":5257,"packageCount":32,"repositoryCount":470},"ghsa-phhr-52qp-3mj4-6f5d82e3","Transformers's Improper Input Validation vulnerability can be exploited through username injection",[5237,5238],"CVE-2025-3777","PYSEC-2026-1986",[249,5238],"2026-09-10T03:50:26.198077196Z",[5242],{"type":1401,"score":5243},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[5245,5247,5249,5250,5252,5254,5255],{"type":1369,"url":5246},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3777",{"type":1366,"url":5248},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F4dda5f71b35fb70cf602187eef84bb17a50b9082",{"type":1374,"url":1641},{"type":1366,"url":5251},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fblame\u002Fa7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4\u002Fsrc\u002Ftransformers\u002Fimage_utils.py",{"type":1366,"url":5253},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fccba0730-9248-4853-b7ff-5c20e6364f09",{"type":1374,"url":1811},{"type":1369,"url":5256},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-phhr-52qp-3mj4",[1647,1648,1649],{"id":250,"slug":5259,"dossier":47,"summary":5260,"aliases":5261,"sourceIds":5265,"published":5266,"modified":5267,"checkedAt":7,"severity":5268,"references":5270,"versionKeys":5281,"packageCount":32,"repositoryCount":2058},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[5262,5263,5264],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[250,5264],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[5269],{"type":1401,"score":1543},[5271,5273,5275,5277,5279,5280],{"type":1407,"url":5272},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1369,"url":5274},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1467,"url":5276},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1366,"url":5278},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1374,"url":1375},{"type":1369,"url":2056},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":251,"slug":5283,"dossier":47,"summary":5284,"aliases":5285,"sourceIds":5288,"published":5289,"modified":5290,"checkedAt":7,"severity":5291,"references":5293,"versionKeys":5305,"packageCount":32,"repositoryCount":2107},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[5286,5287],"CVE-2025-50181","PYSEC-2026-1999",[251,5287],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[5292],{"type":1401,"score":2092},[5294,5296,5298,5300,5301,5302,5303],{"type":1366,"url":5295},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1369,"url":5297},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1467,"url":5299},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1374,"url":1713},{"type":1366,"url":2102},{"type":1374,"url":1715},{"type":1369,"url":5304},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1717,1718,1719,1720],{"id":252,"slug":5307,"dossier":47,"summary":5308,"aliases":5309,"sourceIds":5312,"published":5313,"modified":5314,"checkedAt":7,"severity":5315,"references":5319,"versionKeys":5330,"packageCount":32,"repositoryCount":3831},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[5310,5311],"CVE-2025-67724","PYSEC-2025-265",[252,5311],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[5316,5317],{"type":1401,"score":3081},{"type":1401,"score":5318},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[5320,5322,5324,5326,5328,5329],{"type":1369,"url":5321},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1369,"url":5323},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1467,"url":5325},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1366,"url":5327},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1374,"url":1888},{"type":1369,"url":3829},[1892,1893,1894],{"id":253,"slug":5332,"dossier":47,"summary":5333,"aliases":5334,"sourceIds":5336,"published":5337,"modified":5338,"checkedAt":7,"severity":5339,"references":5342,"versionKeys":5346,"packageCount":32,"repositoryCount":441},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[5335],"CVE-2026-91992",[253],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[5340],{"type":1401,"score":5341},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[5343,5345],{"type":1366,"url":5344},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1374,"url":1888},[1892,1893,1894,1895,1896],{"id":254,"slug":5348,"dossier":47,"summary":5349,"aliases":5350,"sourceIds":5352,"published":5353,"modified":5354,"checkedAt":7,"severity":5355,"references":5358,"versionKeys":5373,"packageCount":32,"repositoryCount":66},"ghsa-pw9p-v7r6-gx4p-86e36276","Tornado: Open redirect in RedirectHandler via protocol-relative URLs",[5351],"CVE-2026-116578",[254],"2026-10-28T22:43:45Z","2026-10-28T23:00:04.066537287Z",[5356],{"type":1362,"score":5357},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:L\u002FSA:N",[5359,5361,5363,5365,5367,5369,5371,5372],{"type":1366,"url":5360},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw9p-v7r6-gx4p",{"type":1369,"url":5362},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-116578",{"type":1366,"url":5364},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3786",{"type":1366,"url":5366},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F940ea725bdd9bc68231d68a105eef17ea6e11233",{"type":1366,"url":5368},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fcc75ab0eb3af459c714895a49f682ad354f50117",{"type":1366,"url":5370},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fccb6a2e5482f17997efd4a74b8200d5b4babc035",{"type":1374,"url":1888},{"type":1366,"url":5180},[1892,1893,1894,1895,1896,1897],{"id":255,"slug":5375,"dossier":47,"summary":5376,"aliases":5377,"sourceIds":5381,"published":5382,"modified":5383,"checkedAt":7,"severity":5384,"references":5387,"versionKeys":5399,"packageCount":32,"repositoryCount":1722},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[5378,5379,5380],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[255,5380],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[5385,5386],{"type":1362,"score":3050},{"type":1401,"score":2836},[5388,5389,5391,5393,5395,5397,5398],{"type":1366,"url":3847},{"type":1467,"url":5390},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1369,"url":5392},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1467,"url":5394},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1467,"url":5396},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1374,"url":1375},{"type":1369,"url":2578},[1379,1380,1381,1382,1383,1384,1385,1386],{"id":256,"slug":5401,"dossier":47,"summary":5402,"aliases":5403,"sourceIds":5406,"published":4886,"modified":5407,"checkedAt":7,"severity":5408,"references":5410,"versionKeys":5421,"packageCount":32,"repositoryCount":32},"ghsa-q2wp-rjmx-x6x9-43135d3d","Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking",[5404,5405],"CVE-2025-3263","PYSEC-2026-1987",[256,5405],"2026-07-07T17:56:57.889099913Z",[5409],{"type":1401,"score":2196},[5411,5413,5414,5415,5416,5418,5419],{"type":1369,"url":5412},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3263",{"type":1366,"url":4894},{"type":1366,"url":4896},{"type":1374,"url":1641},{"type":1366,"url":5417},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fc7a69150-54f8-4e81-8094-791e7a2a0f29",{"type":1374,"url":1811},{"type":1369,"url":5420},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2wp-rjmx-x6x9",[1647],{"id":257,"slug":5423,"dossier":47,"summary":5424,"aliases":5425,"sourceIds":5428,"published":5429,"modified":5430,"checkedAt":7,"severity":5431,"references":5434,"versionKeys":5447,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[5426,5427],"CVE-2024-56326","PYSEC-2026-1475",[257,5427],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[5432,5433],{"type":1401,"score":3052},{"type":1362,"score":3946},[5435,5437,5439,5441,5442,5443,5444,5445],{"type":1366,"url":5436},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1369,"url":5438},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1467,"url":5440},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1374,"url":3955},{"type":1366,"url":4543},{"type":1366,"url":3957},{"type":1374,"url":3961},{"type":1369,"url":5446},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3965],{"id":258,"slug":5449,"dossier":47,"summary":5450,"aliases":5451,"sourceIds":5454,"published":5455,"modified":5456,"checkedAt":7,"severity":5457,"references":5459,"versionKeys":5467,"packageCount":32,"repositoryCount":1389},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[5452,5453],"BIT-pillow-2026-112897","CVE-2026-112897",[258],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[5458],{"type":1362,"score":3391},[5460,5462,5464,5465,5466],{"type":1366,"url":5461},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1369,"url":5463},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1366,"url":3803},{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":259,"slug":5469,"dossier":47,"summary":5470,"aliases":5471,"sourceIds":5474,"published":5475,"modified":5476,"checkedAt":7,"severity":5477,"references":5480,"versionKeys":5486,"packageCount":32,"repositoryCount":1389},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[5472,5473],"CVE-2026-44431","PYSEC-2026-141",[259,5473],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[5478,5479],{"type":1401,"score":2735},{"type":1362,"score":3741},[5481,5483,5485],{"type":1369,"url":5482},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1369,"url":5484},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1374,"url":1713},[1717,1718,1719,1720,1721,3354],{"id":260,"slug":5488,"dossier":47,"summary":5489,"aliases":5490,"sourceIds":5494,"published":5495,"modified":5496,"checkedAt":7,"severity":5497,"references":5501,"versionKeys":5519,"packageCount":32,"repositoryCount":2683},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[5491,5492,5493],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[260],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[5498,5499],{"type":1401,"score":3420},{"type":1362,"score":5500},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[5502,5504,5506,5508,5510,5512,5513,5515,5517],{"type":1369,"url":5503},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1366,"url":5505},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1366,"url":5507},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1366,"url":5509},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1366,"url":5511},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1374,"url":1773},{"type":1366,"url":5514},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1366,"url":5516},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1366,"url":5518},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1785,1786,1787,2676,2677,2678,2679,2680,2681,2682],{"id":261,"slug":5521,"dossier":47,"summary":5522,"aliases":5523,"sourceIds":5526,"published":5527,"modified":5528,"checkedAt":7,"severity":5529,"references":5532,"versionKeys":5545,"packageCount":32,"repositoryCount":441},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[5524,5525],"CVE-2026-31958","PYSEC-2026-140",[261,5525],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[5530,5531],{"type":1401,"score":1543},{"type":1362,"score":2367},[5533,5535,5537,5539,5541,5542,5543],{"type":1369,"url":5534},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1369,"url":5536},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1366,"url":5538},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1366,"url":5540},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1374,"url":1888},{"type":1366,"url":3093},{"type":1366,"url":5544},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1892,1893,1894,1895],{"id":262,"slug":5547,"dossier":47,"summary":5548,"aliases":5549,"sourceIds":5552,"published":5553,"modified":5554,"checkedAt":7,"severity":5555,"references":5558,"versionKeys":5572,"packageCount":32,"repositoryCount":2683},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[5550,5551],"CVE-2026-22701","PYSEC-2026-1374",[262,5551],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[5556],{"type":1401,"score":5557},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5559,5561,5563,5565,5567,5568,5570],{"type":1366,"url":5560},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1369,"url":5562},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1366,"url":5564},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1366,"url":5566},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1374,"url":2346},{"type":1374,"url":5569},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1369,"url":5571},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2818,2819,2820,2821],{"id":263,"slug":5574,"dossier":47,"summary":5575,"aliases":5576,"sourceIds":5579,"published":5580,"modified":5581,"checkedAt":7,"severity":5582,"references":5585,"versionKeys":5599,"packageCount":32,"repositoryCount":32},"ghsa-qq3j-4f4f-9583-cd76c72c","Hugging Face Transformers Regular Expression Denial of Service",[5577,5578],"CVE-2025-2099","PYSEC-2025-40",[263,5578],"2025-05-19T12:15:19Z","2026-06-10T17:02:48.111891265Z",[5583,5584],{"type":1401,"score":2196},{"type":1401,"score":1543},[5586,5588,5590,5592,5593,5595,5597],{"type":1369,"url":5587},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2099",{"type":1366,"url":5589},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F36648",{"type":1467,"url":5591},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F8cb522b4190bd556ce51be04942720650b1a3e57",{"type":1374,"url":1641},{"type":1366,"url":5594},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2025-40.yaml",{"type":1366,"url":5596},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F97b780f3-ffca-424f-ad5d-0e1c57a5bde4",{"type":1369,"url":5598},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qq3j-4f4f-9583",[1647],{"id":264,"slug":5601,"dossier":47,"summary":4695,"aliases":5602,"sourceIds":5605,"published":5606,"modified":5607,"checkedAt":7,"severity":5608,"references":5612,"versionKeys":5626,"packageCount":32,"repositoryCount":32},"ghsa-qxrp-vhvm-j765-63c6e9a2",[5603,5604],"CVE-2024-11392","PYSEC-2024-227",[264,5604],"2024-11-22T22:15:06Z","2026-09-10T03:50:21.016710762Z",[5609,5611],{"type":1401,"score":5610},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1401,"score":1402},[5613,5615,5616,5617,5618,5620,5622,5624],{"type":1369,"url":5614},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11392",{"type":1366,"url":4710},{"type":1366,"url":4712},{"type":1374,"url":1641},{"type":1366,"url":5619},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-227.yaml",{"type":1366,"url":5621},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513",{"type":1369,"url":5623},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513\u002F",{"type":1369,"url":5625},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qxrp-vhvm-j765",[1647],{"id":265,"slug":5628,"dossier":47,"summary":5629,"aliases":5630,"sourceIds":5632,"published":5633,"modified":5634,"checkedAt":7,"severity":5635,"references":5637,"versionKeys":5648,"packageCount":32,"repositoryCount":66},"ghsa-r4j5-9xpp-3985-880dec7e","Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks",[5631],"CVE-2026-115927",[265],"2026-10-28T22:43:50Z","2026-10-28T23:00:04.082411607Z",[5636],{"type":1401,"score":1799},[5638,5640,5642,5644,5646,5647],{"type":1366,"url":5639},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-r4j5-9xpp-3985",{"type":1369,"url":5641},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-115927",{"type":1366,"url":5643},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3773",{"type":1366,"url":5645},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fceab33581489751a66fba8566ad6d5960d4b01c8",{"type":1374,"url":1888},{"type":1366,"url":5180},[1892,1893,1894,1895,1896,1897],{"id":266,"slug":5650,"dossier":47,"summary":5651,"aliases":5652,"sourceIds":5656,"published":5657,"modified":5658,"checkedAt":7,"severity":5659,"references":5662,"versionKeys":5676,"packageCount":32,"repositoryCount":1722},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[5653,5654,5655],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[266,5655],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[5660,5661],{"type":1401,"score":1761},{"type":1362,"score":2564},[5663,5665,5667,5669,5671,5672,5673,5674],{"type":1366,"url":5664},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1369,"url":5666},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1366,"url":5668},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1366,"url":5670},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1374,"url":1375},{"type":1366,"url":2578},{"type":1374,"url":2630},{"type":1369,"url":5675},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1379,1380,1381,1382,1383,1384,1385,1386],{"id":267,"slug":5678,"dossier":47,"summary":5679,"aliases":5680,"sourceIds":5683,"published":5684,"modified":5685,"checkedAt":7,"severity":5686,"references":5689,"versionKeys":5699,"packageCount":32,"repositoryCount":34},"ghsa-r9mr-m37c-5fr3-d43000fc","GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution",[5681,5682],"CVE-2026-73625","PYSEC-2026-3953",[267,5682],"2026-07-24T16:42:57Z","2026-09-10T13:10:47.448946391Z",[5687,5688],{"type":1401,"score":1667},{"type":1362,"score":4916},[5690,5692,5693,5695,5696,5697],{"type":1407,"url":5691},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-r9mr-m37c-5fr3",{"type":1366,"url":2867},{"type":1366,"url":5694},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe8d0fbf774d1f6baa3b481adfe48bd262e43b453",{"type":1374,"url":1416},{"type":1366,"url":2872},{"type":1369,"url":5698},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-kwarg-value-smuggling",[1424,1425,1426],{"id":268,"slug":5701,"dossier":47,"summary":5702,"aliases":5703,"sourceIds":5706,"published":5707,"modified":5708,"checkedAt":7,"severity":5709,"references":5711,"versionKeys":5726,"packageCount":32,"repositoryCount":451},"ghsa-rcv9-qm8p-9p6j-edc1db04","Hugging Face Transformers library has Regular Expression Denial of Service",[5704,5705],"CVE-2025-6051","PYSEC-2026-1988",[268,5705],"2025-09-14T18:30:26Z","2026-09-10T03:50:28.694224028Z",[5710],{"type":1401,"score":2196},[5712,5714,5716,5718,5720,5721,5723,5724],{"type":1369,"url":5713},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6051",{"type":1366,"url":5715},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F38844",{"type":1366,"url":5717},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F54a02160eb030da9be18231c77791f2eb3a52216",{"type":1366,"url":5719},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fba8eaba9865618253f997784aa565b96206426f0",{"type":1374,"url":1641},{"type":1366,"url":5722},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Faf929523-7b59-418a-bf55-301830b2ac9d",{"type":1374,"url":1811},{"type":1369,"url":5725},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rcv9-qm8p-9p6j",[1647,1648,1649,1650],{"id":269,"slug":5728,"dossier":47,"summary":5729,"aliases":5730,"sourceIds":5733,"published":5734,"modified":5735,"checkedAt":7,"severity":5736,"references":5739,"versionKeys":5748,"packageCount":32,"repositoryCount":1389},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[5731,5732],"BIT-pillow-2026-112898","CVE-2026-112898",[269],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[5737],{"type":1362,"score":5738},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5740,5742,5744,5746,5747],{"type":1366,"url":5741},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1369,"url":5743},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1366,"url":5745},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":270,"slug":5750,"dossier":47,"summary":5751,"aliases":5752,"sourceIds":5754,"published":5755,"modified":5756,"checkedAt":7,"severity":5757,"references":5759,"versionKeys":5770,"packageCount":32,"repositoryCount":2354},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[5753],"CVE-2026-112939",[270],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[5758],{"type":1401,"score":4259},[5760,5762,5764,5766,5768,5769],{"type":1366,"url":5761},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1369,"url":5763},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1366,"url":5765},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1366,"url":5767},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1374,"url":2346},{"type":1366,"url":2348},[2350,2351,2352,2353],{"id":271,"slug":5772,"dossier":47,"summary":5773,"aliases":5774,"sourceIds":5777,"published":5778,"modified":5779,"checkedAt":7,"severity":5780,"references":5783,"versionKeys":5796,"packageCount":32,"repositoryCount":2580},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[5775,5776],"CVE-2026-25087","PYSEC-2026-113",[271,5776],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[5781],{"type":1401,"score":5782},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[5784,5786,5788,5790,5792,5794],{"type":1369,"url":5785},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1467,"url":5787},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1374,"url":5789},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1366,"url":5791},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1369,"url":5793},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1369,"url":5795},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[5797,5798,5799,5800],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":272,"slug":5802,"dossier":47,"summary":5803,"aliases":5804,"sourceIds":5807,"published":5808,"modified":5809,"checkedAt":7,"severity":5810,"references":5812,"versionKeys":5820,"packageCount":32,"repositoryCount":34},"ghsa-rpm5-65cw-6hj4-6c97dd77","GitPython has Command Injection via Git options bypass",[5805,5806],"CVE-2026-42215","PYSEC-2026-2160",[272,5806],"2026-04-25T23:42:16Z","2026-09-10T03:51:03.167884784Z",[5811],{"type":1401,"score":1667},[5813,5815,5817,5818],{"type":1407,"url":5814},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1369,"url":5816},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42215",{"type":1374,"url":1416},{"type":1467,"url":5819},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.47",[1424,1425,1426],{"id":273,"slug":5822,"dossier":47,"summary":5823,"aliases":5824,"sourceIds":5828,"published":4071,"modified":5829,"checkedAt":7,"severity":5830,"references":5833,"versionKeys":5851,"packageCount":32,"repositoryCount":1722},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[5825,5826,5827],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[273],"2026-09-10T03:49:48.419046410Z",[5831,5832],{"type":1401,"score":3420},{"type":1362,"score":5500},[5834,5836,5838,5840,5842,5844,5845,5847,5849],{"type":1369,"url":5835},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1366,"url":5837},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1366,"url":5839},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1366,"url":5841},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1366,"url":5843},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1374,"url":1773},{"type":1366,"url":5846},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1366,"url":5848},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1366,"url":5850},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[5852,5853,5854,1785,1786,1787,2676,2677,2678,2679,2680,2681,2682],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":274,"slug":5856,"dossier":47,"summary":5857,"aliases":5858,"sourceIds":5861,"published":5862,"modified":5863,"checkedAt":7,"severity":5864,"references":5866,"versionKeys":5884,"packageCount":32,"repositoryCount":34},"ghsa-rwj8-pgh3-r573-0bf779f8","GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL",[5859,5860],"CVE-2026-67322","PYSEC-2026-3842",[274,5860],"2026-07-21T22:06:09Z","2026-09-24T18:28:17.149390188Z",[5865],{"type":1401,"score":3389},[5867,5869,5871,5873,5874,5876,5877,5879,5881,5882],{"type":1366,"url":5868},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1369,"url":5870},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67322",{"type":1366,"url":5872},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2172",{"type":1366,"url":3526},{"type":1369,"url":5875},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1374,"url":1416},{"type":1366,"url":5878},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.52",{"type":1366,"url":5880},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3842.yaml",{"type":1374,"url":1683},{"type":1366,"url":5883},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-clone-from",[1424,1425,1426],{"id":275,"slug":5886,"dossier":47,"summary":5887,"aliases":5888,"sourceIds":5890,"published":5891,"modified":5892,"checkedAt":7,"severity":5893,"references":5895,"versionKeys":5904,"packageCount":32,"repositoryCount":2354},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[5889],"CVE-2026-112940",[275],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[5894],{"type":1401,"score":2993},[5896,5898,5900,5901,5902,5903],{"type":1366,"url":5897},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1369,"url":5899},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1366,"url":3695},{"type":1366,"url":3697},{"type":1374,"url":2346},{"type":1366,"url":2348},[2350,2351,2352,2353],{"id":276,"slug":5906,"dossier":47,"summary":5907,"aliases":5908,"sourceIds":5911,"published":5912,"modified":5913,"checkedAt":7,"severity":5914,"references":5916,"versionKeys":5924,"packageCount":32,"repositoryCount":34},"ghsa-v87r-6q3f-2j67-81913ca6","GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath",[5909,5910],"CVE-2026-44244","PYSEC-2026-2163",[276,5910],"2026-05-06T21:58:00Z","2026-09-10T03:50:47.691444343Z",[5915],{"type":1401,"score":3052},[5917,5919,5921,5922],{"type":1407,"url":5918},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-v87r-6q3f-2j67",{"type":1369,"url":5920},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44244",{"type":1374,"url":1416},{"type":1467,"url":5923},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.49",[1424,1425,1426],{"id":277,"slug":5926,"dossier":47,"summary":5927,"aliases":5928,"sourceIds":5932,"published":5933,"modified":5934,"checkedAt":7,"severity":5935,"references":5937,"versionKeys":5948,"packageCount":32,"repositoryCount":1722},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[5929,5930,5931],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[277,5931],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[5936],{"type":1401,"score":1607},[5938,5940,5942,5944,5946,5947],{"type":1369,"url":5939},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1369,"url":5941},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1766,"url":5943},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1467,"url":5945},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1374,"url":1375},{"type":1369,"url":1377},[1381,1382,1383,1384,1385,1386,1387,1388],{"id":278,"slug":5950,"dossier":47,"summary":5951,"aliases":5952,"sourceIds":5956,"published":4071,"modified":5957,"checkedAt":7,"severity":5958,"references":5961,"versionKeys":5976,"packageCount":32,"repositoryCount":66},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[5953,5954,5955],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[278],"2026-06-10T17:41:15.774477397Z",[5959,5960],{"type":1401,"score":3420},{"type":1362,"score":4076},[5962,5964,5965,5966,5967,5969,5970,5972,5974],{"type":1369,"url":5963},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1366,"url":4081},{"type":1366,"url":4083},{"type":1366,"url":4085},{"type":1366,"url":5968},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1374,"url":1773},{"type":1366,"url":5971},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1366,"url":5973},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1366,"url":5975},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1785,1786,1787,2676,2677,2678,2679],{"id":279,"slug":5978,"dossier":47,"summary":5979,"aliases":5980,"sourceIds":5984,"published":5985,"modified":5986,"checkedAt":7,"severity":5987,"references":5989,"versionKeys":6003,"packageCount":32,"repositoryCount":2058},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5981,5982,5983],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[279,5983],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5988],{"type":1362,"score":2367},[5990,5992,5994,5996,5998,5999,6000,6001],{"type":1366,"url":5991},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1369,"url":5993},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1366,"url":5995},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1366,"url":5997},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1374,"url":1375},{"type":1366,"url":2628},{"type":1374,"url":2630},{"type":1369,"url":6002},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":280,"slug":6005,"dossier":47,"summary":6006,"aliases":6007,"sourceIds":6010,"published":6011,"modified":6012,"checkedAt":7,"severity":6013,"references":6019,"versionKeys":6045,"packageCount":32,"repositoryCount":470},"ghsa-vqwp-45wm-r9r5-eaa960a2","Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission",[6008,6009],"CVE-2026-10804","PYSEC-2026-212",[280,6009],"2026-06-04T12:16:24.620Z","2026-07-23T15:00:23.893493649Z",[6014,6016,6018],{"type":1401,"score":6015},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1362,"score":6017},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1401,"score":4259},[6020,6022,6024,6026,6028,6030,6032,6033,6035,6037,6039,6041,6043],{"type":1369,"url":6021},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10804",{"type":1467,"url":6023},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fissues\u002F14622",{"type":1467,"url":6025},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F14635",{"type":1366,"url":6027},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F15397",{"type":1366,"url":6029},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002Ffec0f584dae9261abed16cad35b32922104bb933",{"type":1366,"url":6031},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstreamlit\u002FPYSEC-2026-212.yaml",{"type":1374,"url":3233},{"type":1369,"url":6034},"https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-10804",{"type":1369,"url":6036},"https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F831508",{"type":1369,"url":6038},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253",{"type":1766,"url":6040},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253\u002Fcti",{"type":1366,"url":6042},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002F",{"type":1369,"url":6044},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqwp-45wm-r9r5",[3237,3238,3239],{"id":281,"slug":6047,"dossier":47,"summary":6048,"aliases":6049,"sourceIds":6051,"published":6052,"modified":6053,"checkedAt":7,"severity":6054,"references":6056,"versionKeys":6063,"packageCount":32,"repositoryCount":1389},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[6050],"CVE-2026-112899",[281],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[6055],{"type":1362,"score":2760},[6057,6059,6061,6062],{"type":1366,"url":6058},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1366,"url":6060},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":282,"slug":6065,"dossier":91,"summary":6066,"aliases":6067,"sourceIds":6070,"published":6071,"modified":6072,"checkedAt":7,"severity":6073,"references":6075,"versionKeys":6087,"packageCount":32,"repositoryCount":2775},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[6068,6069],"CVE-2026-97689","PYSEC-2026-4177",[282,6069],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[6074],{"type":1362,"score":1698},[6076,6078,6080,6082,6083,6084,6085],{"type":1366,"url":6077},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1369,"url":6079},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1366,"url":6081},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1374,"url":1713},{"type":1366,"url":3349},{"type":1374,"url":1715},{"type":1369,"url":6086},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1717,1718,1719,1720,1721,3354,3355],{"id":283,"slug":6089,"dossier":47,"summary":6090,"aliases":6091,"sourceIds":6094,"published":6095,"modified":6096,"checkedAt":7,"severity":6097,"references":6100,"versionKeys":6117,"packageCount":32,"repositoryCount":2683},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[6092,6093],"CVE-2025-68146","PYSEC-2026-1375",[283,6093],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[6098],{"type":1401,"score":6099},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[6101,6103,6105,6106,6108,6110,6112,6113,6115],{"type":1366,"url":6102},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1366,"url":6104},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1374,"url":2346},{"type":1366,"url":6107},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1366,"url":6109},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1366,"url":6111},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1374,"url":5569},{"type":1369,"url":6114},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1369,"url":6116},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2818,2819,2820,2821],{"id":284,"slug":6119,"dossier":47,"summary":6120,"aliases":6121,"sourceIds":6124,"published":6125,"modified":6126,"checkedAt":7,"severity":6127,"references":6130,"versionKeys":6139,"packageCount":32,"repositoryCount":1389},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[6122,6123],"BIT-pillow-2026-112900","CVE-2026-112900",[284],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[6128],{"type":1362,"score":6129},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6131,6133,6135,6137,6138],{"type":1366,"url":6132},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1369,"url":6134},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1366,"url":6136},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":285,"slug":6141,"dossier":47,"summary":6142,"aliases":6143,"sourceIds":6145,"published":6146,"modified":6147,"checkedAt":7,"severity":6148,"references":6150,"versionKeys":6159,"packageCount":32,"repositoryCount":34},"ghsa-w8jc-g24h-crhw-5553514f","GitPython command wrappers omit unsafe protocol and option checks",[6144],"CVE-2026-110857",[285],"2026-10-27T15:26:43Z","2026-10-27T15:47:24.947223105Z",[6149],{"type":1401,"score":3250},[6151,6153,6155,6157,6158],{"type":1366,"url":6152},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-w8jc-g24h-crhw",{"type":1366,"url":6154},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2251",{"type":1366,"url":6156},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9ad28cc4c7176d22cd6181d69805058a719dd03b",{"type":1374,"url":1416},{"type":1366,"url":1447},[1424,1425,1426],{"id":286,"slug":6161,"dossier":47,"summary":6162,"aliases":6163,"sourceIds":6167,"published":6168,"modified":6169,"checkedAt":7,"severity":6170,"references":6173,"versionKeys":6211,"packageCount":32,"repositoryCount":1722},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[6164,6165,6166],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[286,6166],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[6171,6172],{"type":1401,"score":1543},{"type":1362,"score":2367},[6174,6176,6178,6180,6182,6183,6185,6187,6189,6191,6193,6195,6196,6198,6200,6202,6203,6205,6207,6209],{"type":1366,"url":6175},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1369,"url":6177},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1366,"url":6179},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1366,"url":6181},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1374,"url":1375},{"type":1366,"url":6184},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1366,"url":6186},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1366,"url":6188},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1369,"url":6190},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1369,"url":6192},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1369,"url":6194},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1369,"url":3870},{"type":1369,"url":6197},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1369,"url":6199},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1369,"url":6201},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1369,"url":3872},{"type":1369,"url":6204},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1369,"url":6206},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1369,"url":6208},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1369,"url":6210},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1379,1380,1381,1382,1383,1384,1385,1386],{"id":287,"slug":6213,"dossier":47,"summary":6214,"aliases":6215,"sourceIds":6219,"published":6220,"modified":6221,"checkedAt":7,"severity":6222,"references":6225,"versionKeys":6234,"packageCount":32,"repositoryCount":1722},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[6216,6217,6218],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[287,6218],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[6223,6224],{"type":1401,"score":1761},{"type":1362,"score":2564},[6226,6228,6230,6232,6233],{"type":1369,"url":6227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1369,"url":6229},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1366,"url":6231},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1374,"url":1375},{"type":1369,"url":2578},[1379,1380,1381,1382,1383,1384,1385,1386],{"id":288,"slug":6236,"dossier":47,"summary":6237,"aliases":6238,"sourceIds":6240,"published":6241,"modified":6242,"checkedAt":7,"severity":6243,"references":6244,"versionKeys":6253,"packageCount":32,"repositoryCount":1389},"ghsa-wqgw-9xfh-qf2g-351c6680","Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data",[6239],"CVE-2026-128066",[288],"2026-11-12T23:35:39Z","2026-11-12T23:45:03.298534910Z",[],[6245,6247,6249,6251,6252],{"type":1366,"url":6246},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wqgw-9xfh-qf2g",{"type":1366,"url":6248},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4908edaf7f416616784c7c03d8c1a60153710ffb",{"type":1366,"url":6250},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4b63dffd8a6d980fa0e21b40832fa6cbf033eacf",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":289,"slug":6255,"dossier":47,"summary":4695,"aliases":6256,"sourceIds":6259,"published":4700,"modified":6260,"checkedAt":7,"severity":6261,"references":6264,"versionKeys":6278,"packageCount":32,"repositoryCount":32},"ghsa-wrfc-pvp9-mr9g-c6b03ddf",[6257,6258],"CVE-2024-11393","PYSEC-2024-228",[289,6258],"2026-09-10T03:50:55.987633957Z",[6262,6263],{"type":1401,"score":4704},{"type":1401,"score":1402},[6265,6267,6268,6269,6270,6272,6274,6276],{"type":1369,"url":6266},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11393",{"type":1366,"url":4710},{"type":1366,"url":4712},{"type":1374,"url":1641},{"type":1366,"url":6271},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-228.yaml",{"type":1366,"url":6273},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514",{"type":1369,"url":6275},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514\u002F",{"type":1369,"url":6277},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wrfc-pvp9-mr9g",[1647],{"id":290,"slug":6280,"dossier":47,"summary":6281,"aliases":6282,"sourceIds":6285,"published":6286,"modified":6287,"checkedAt":7,"severity":6288,"references":6290,"versionKeys":6305,"packageCount":32,"repositoryCount":34},"ghsa-wvpp-8hx9-p66j-188b3951","GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution",[6283,6284],"CVE-2026-76220","PYSEC-2026-3843",[290,6284],"2026-08-07T15:49:07Z","2026-09-10T12:26:01.792035310Z",[6289],{"type":1401,"score":1667},[6291,6293,6295,6296,6298,6299,6300,6302,6303],{"type":1366,"url":6292},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",{"type":1369,"url":6294},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76220",{"type":1366,"url":2125},{"type":1366,"url":6297},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F96a888f4d782cb2f80452148e48e60ce4af6d541",{"type":1374,"url":1416},{"type":1366,"url":2130},{"type":1366,"url":6301},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-execution-via-split-single-char-options",{"type":1374,"url":1683},{"type":1369,"url":6304},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",[1424,1425,1426],{"id":291,"slug":6307,"dossier":47,"summary":6308,"aliases":6309,"sourceIds":6311,"published":6312,"modified":6313,"checkedAt":7,"severity":6314,"references":6317,"versionKeys":6329,"packageCount":32,"repositoryCount":480},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[6310],"CVE-2026-91991",[291],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[6315],{"type":1362,"score":6316},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6318,6320,6321,6323,6325,6327,6328],{"type":1366,"url":6319},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1366,"url":3278},{"type":1366,"url":6322},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1366,"url":6324},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1366,"url":6326},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1374,"url":1888},{"type":1366,"url":3285},[1896,1897],{"id":292,"slug":6331,"dossier":47,"summary":6332,"aliases":6333,"sourceIds":6336,"published":6337,"modified":6338,"checkedAt":7,"severity":6339,"references":6342,"versionKeys":6351,"packageCount":32,"repositoryCount":34},"ghsa-x2qx-6953-8485-107f8fe2","GitPython: Unsafe option check validates multi_options before shlex.split transformation",[6334,6335],"CVE-2026-42284","PYSEC-2026-2161",[292,6335],"2026-04-25T23:41:49Z","2026-09-10T03:51:03.787491179Z",[6340,6341],{"type":1401,"score":3108},{"type":1401,"score":1607},[6343,6345,6347,6348,6349],{"type":1407,"url":6344},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-x2qx-6953-8485",{"type":1369,"url":6346},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42284",{"type":1374,"url":1416},{"type":1467,"url":5819},{"type":1366,"url":6350},"https:\u002F\u002Fwww.tenable.com\u002Fcve\u002FCVE-2026-32686",[1424,1425,1426],{"id":293,"slug":6353,"dossier":47,"summary":6354,"aliases":6355,"sourceIds":6359,"published":6360,"modified":6361,"checkedAt":7,"severity":6362,"references":6367,"versionKeys":6383,"packageCount":32,"repositoryCount":480},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[6356,6357,6358],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[293],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[6363,6365],{"type":1401,"score":6364},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":1362,"score":6366},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6368,6370,6372,6374,6376,6377,6379,6381],{"type":1369,"url":6369},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1366,"url":6371},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1366,"url":6373},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1366,"url":6375},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1374,"url":1773},{"type":1366,"url":6378},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1366,"url":6380},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1366,"url":6382},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1785,1786],{"id":294,"slug":6385,"dossier":47,"summary":6386,"aliases":6387,"sourceIds":6390,"published":6391,"modified":6392,"checkedAt":7,"severity":6393,"references":6395,"versionKeys":6410,"packageCount":32,"repositoryCount":66},"ghsa-x9r9-c232-4q39-1586e326","Hugging Face Transformers downloads custom generation code before trust consent",[6388,6389],"CVE-2026-80047","PYSEC-2026-4174",[294,6389],"2026-09-01T15:31:13Z","2026-10-01T17:55:55.397425521Z",[6394],{"type":1401,"score":3052},[6396,6398,6400,6402,6403,6405,6407,6408],{"type":1369,"url":6397},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80047",{"type":1366,"url":6399},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F48620",{"type":1366,"url":6401},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fcbc1651a032b923da7f4b44b3d0e6f68e6ba6b55",{"type":1374,"url":1641},{"type":1366,"url":6404},"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1366,"url":6406},"https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1374,"url":1811},{"type":1369,"url":6409},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-x9r9-c232-4q39",[1648,1649,1650,1651,1652,1653,1654,1655,6411],"pypi:transformers@5.8.0",{"id":295,"slug":6413,"dossier":47,"summary":6414,"aliases":6415,"sourceIds":6417,"published":6418,"modified":6419,"checkedAt":7,"severity":6420,"references":6423,"versionKeys":6432,"packageCount":32,"repositoryCount":1389},"ghsa-xcvg-w56q-r89m-87c516ac","Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size",[6416],"CVE-2026-128067",[295],"2026-11-12T23:34:43Z","2026-11-12T23:45:03.322245161Z",[6421],{"type":1362,"score":6422},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6424,6426,6428,6430,6431],{"type":1366,"url":6425},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xcvg-w56q-r89m",{"type":1366,"url":6427},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F53318b50e8e9e85a57d033d4d879e1398d97aeb1",{"type":1366,"url":6429},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fec5f1cbcf67275641abaad5c065ffb64a0a804a9",{"type":1374,"url":1375},{"type":1366,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":296,"slug":6434,"dossier":47,"summary":6435,"aliases":6436,"sourceIds":6440,"published":6441,"modified":6442,"checkedAt":7,"severity":6443,"references":6445,"versionKeys":6459,"packageCount":32,"repositoryCount":451},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[6437,6438,6439],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[296,6439],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[6444],{"type":1401,"score":2993},[6446,6448,6450,6452,6454,6456,6457],{"type":1369,"url":6447},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1369,"url":6449},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1366,"url":6451},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1467,"url":6453},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1366,"url":6455},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1374,"url":1375},{"type":1366,"url":6458},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1382],{"id":297,"slug":6461,"dossier":47,"summary":6462,"aliases":6463,"sourceIds":6467,"published":6468,"modified":6469,"checkedAt":7,"severity":6470,"references":6473,"versionKeys":6482,"packageCount":32,"repositoryCount":1389},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[6464,6465,6466],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[297,6466],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[6471,6472],{"type":1362,"score":2760},{"type":1401,"score":1543},[6474,6476,6478,6480,6481],{"type":1467,"url":6475},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1369,"url":6477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1467,"url":6479},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":298,"slug":6484,"dossier":47,"summary":6485,"aliases":6486,"sourceIds":6490,"published":6491,"modified":6492,"checkedAt":7,"severity":6493,"references":6496,"versionKeys":6507,"packageCount":32,"repositoryCount":2058},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[6487,6488,6489],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[298,6489],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[6494],{"type":1401,"score":6495},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[6497,6499,6501,6503,6505,6506],{"type":1407,"url":6498},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1369,"url":6500},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1467,"url":6502},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1467,"url":6504},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1374,"url":1375},{"type":1369,"url":2628},[1379,1380,1381,1382,1383,1384,1385,1386,1387],{"id":299,"slug":6509,"dossier":47,"summary":6510,"aliases":6511,"sourceIds":6512,"published":6513,"modified":6514,"checkedAt":7,"severity":6515,"references":6518,"versionKeys":6528,"packageCount":32,"repositoryCount":1389},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[299],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[6516],{"type":1362,"score":6517},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[6519,6521,6523,6525,6526],{"type":1366,"url":6520},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1366,"url":6522},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1366,"url":6524},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1374,"url":2473},{"type":1366,"url":6527},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[2479,2480,2481,2482,4593,4594,4595,4596,4597,4598,4599,4600],{"id":300,"slug":6530,"dossier":47,"summary":6531,"aliases":6532,"sourceIds":6535,"published":6536,"modified":6537,"checkedAt":7,"severity":6538,"references":6541,"versionKeys":6554,"packageCount":32,"repositoryCount":42},"ghsa-xrqw-3rrv-vx5w-3d985837","Transformers save_pretrained path traversal allows arbitrary file writes through chat template names",[6533,6534],"CVE-2026-9856","PYSEC-2026-3929",[300,6534],"2026-08-02T18:30:20Z","2026-09-10T12:25:36.528730268Z",[6539],{"type":1401,"score":6540},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[6542,6544,6546,6548,6549,6551,6552],{"type":1369,"url":6543},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9856",{"type":1366,"url":6545},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F46191",{"type":1366,"url":6547},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Feaaaf8494dd5386634ae37d1d122212fdc315be5",{"type":1374,"url":1641},{"type":1366,"url":6550},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F362824d5-fe18-40e8-a6cf-62277f97a170",{"type":1374,"url":1811},{"type":1369,"url":6553},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xrqw-3rrv-vx5w",[1647,1648,1649,1650,1651,1652,1653,1654,1655,6411],{"id":301,"slug":6556,"dossier":47,"summary":6557,"aliases":6558,"sourceIds":6561,"published":6562,"modified":6563,"checkedAt":7,"severity":6564,"references":6569,"versionKeys":6584,"packageCount":32,"repositoryCount":1389},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[6559,6560],"CVE-2026-112902","PYSEC-2026-4363",[301,6560],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[6565,6567],{"type":1362,"score":6566},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1401,"score":6568},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[6570,6572,6574,6576,6578,6580,6582,6583],{"type":1467,"url":6571},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1369,"url":6573},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1366,"url":6575},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1467,"url":6577},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1467,"url":6579},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1366,"url":6581},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1374,"url":1375},{"type":1369,"url":1377},[1379,1380,1381,1382,1383,1384,1385,1386,1387,1388],{"id":302,"slug":6586,"dossier":47,"summary":84,"aliases":6587,"sourceIds":6590,"published":6591,"modified":6592,"checkedAt":7,"severity":6593,"references":6596,"versionKeys":6605,"packageCount":32,"repositoryCount":32},"pysec-2025-112-653e8a7c",[6588,6589],"CVE-2025-64429","GHSA-vmp8-hg63-v2hp",[302],"2025-11-12T22:15:49.813Z","2026-05-20T09:18:59.601738Z",[6594],{"type":1401,"score":6595},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[6597,6599,6601,6603],{"type":1366,"url":6598},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fblob\u002F029a5b87ff5b1cd22f7f9717d48cd8830d00807c\u002Fsrc\u002Fcommon\u002Frandom_engine.cpp#L20",{"type":1369,"url":6600},"https:\u002F\u002Fduckdb.org\u002F2025\u002F09\u002F16\u002Fannouncing-duckdb-140.html",{"type":1369,"url":6602},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fsecurity\u002Fadvisories\u002FGHSA-vmp8-hg63-v2hp",{"type":1467,"url":6604},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fpull\u002F17275",[6606],"pypi:duckdb@1.4.1",{"id":303,"slug":6608,"dossier":47,"summary":84,"aliases":6609,"sourceIds":6612,"published":6613,"modified":6614,"checkedAt":7,"severity":6615,"references":6617,"versionKeys":6626,"packageCount":32,"repositoryCount":480},"pysec-2025-198-62b25ed4",[6610,6611],"BIT-pytorch-2025-46148","CVE-2025-46148",[303],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[6616],{"type":1401,"score":2735},[6618,6620,6622,6624],{"type":1369,"url":6619},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1369,"url":6621},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1766,"url":6623},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1467,"url":6625},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1785,1786],{"id":304,"slug":6628,"dossier":47,"summary":84,"aliases":6629,"sourceIds":6632,"published":6633,"modified":6634,"checkedAt":7,"severity":6635,"references":6637,"versionKeys":6643,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[6630,6631],"BIT-pytorch-2025-46149","CVE-2025-46149",[304],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[6636],{"type":1401,"score":2735},[6638,6639,6641],{"type":1369,"url":6619},{"type":1766,"url":6640},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1467,"url":6642},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1786],{"id":305,"slug":6645,"dossier":47,"summary":84,"aliases":6646,"sourceIds":6649,"published":6650,"modified":6651,"checkedAt":7,"severity":6652,"references":6654,"versionKeys":6662,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[6647,6648],"BIT-pytorch-2025-46150","CVE-2025-46150",[305],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[6653],{"type":1401,"score":2735},[6655,6656,6658,6660],{"type":1369,"url":6619},{"type":1766,"url":6657},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1766,"url":6659},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1467,"url":6661},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1786],{"id":306,"slug":6664,"dossier":47,"summary":84,"aliases":6665,"sourceIds":6668,"published":6669,"modified":6670,"checkedAt":7,"severity":6671,"references":6673,"versionKeys":6679,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[6666,6667],"BIT-pytorch-2025-46152","CVE-2025-46152",[306],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[6672],{"type":1401,"score":1799},[6674,6675,6677],{"type":1369,"url":6619},{"type":1766,"url":6676},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1467,"url":6678},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1786],{"id":307,"slug":6681,"dossier":47,"summary":84,"aliases":6682,"sourceIds":6685,"published":6686,"modified":6687,"checkedAt":7,"severity":6688,"references":6690,"versionKeys":6700,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[6683,6684],"BIT-pytorch-2025-46153","CVE-2025-46153",[307],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[6689],{"type":1401,"score":2735},[6691,6693,6694,6696,6698],{"type":1366,"url":6692},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1369,"url":6619},{"type":1369,"url":6695},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1766,"url":6697},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1467,"url":6699},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1786],{"id":308,"slug":6702,"dossier":47,"summary":84,"aliases":6703,"sourceIds":6706,"published":6707,"modified":6708,"checkedAt":7,"severity":6709,"references":6711,"versionKeys":6716,"packageCount":32,"repositoryCount":3831},"pysec-2025-203-2febb201",[6704,6705],"BIT-pytorch-2025-55551","CVE-2025-55551",[308],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[6710],{"type":1401,"score":1543},[6712,6714],{"type":1369,"url":6713},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1766,"url":6715},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1785,1786,1787,2676,2677,2678],{"id":309,"slug":6718,"dossier":47,"summary":84,"aliases":6719,"sourceIds":6722,"published":6723,"modified":6724,"checkedAt":7,"severity":6725,"references":6727,"versionKeys":6731,"packageCount":32,"repositoryCount":3831},"pysec-2025-204-cdae47da",[6720,6721],"BIT-pytorch-2025-55552","CVE-2025-55552",[309],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[6726],{"type":1401,"score":1543},[6728,6729],{"type":1369,"url":6713},{"type":1766,"url":6730},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1785,1786,1787,2676,2677,2678],{"id":310,"slug":6733,"dossier":47,"summary":84,"aliases":6734,"sourceIds":6737,"published":6738,"modified":6739,"checkedAt":7,"severity":6740,"references":6742,"versionKeys":6748,"packageCount":32,"repositoryCount":470},"pysec-2025-205-fd5e58fd",[6735,6736],"BIT-pytorch-2025-55553","CVE-2025-55553",[310],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[6741],{"type":1401,"score":1543},[6743,6744,6746],{"type":1369,"url":6713},{"type":1766,"url":6745},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1467,"url":6747},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1785,1786,1787],{"id":311,"slug":6750,"dossier":47,"summary":84,"aliases":6751,"sourceIds":6754,"published":6755,"modified":6756,"checkedAt":7,"severity":6757,"references":6759,"versionKeys":6763,"packageCount":32,"repositoryCount":3831},"pysec-2025-206-58322476",[6752,6753],"BIT-pytorch-2025-55554","CVE-2025-55554",[311],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[6758],{"type":1401,"score":1799},[6760,6761],{"type":1369,"url":6713},{"type":1766,"url":6762},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1785,1786,1787,2676,2677,2678],{"id":312,"slug":6765,"dossier":47,"summary":84,"aliases":6766,"sourceIds":6769,"published":6770,"modified":6771,"checkedAt":7,"severity":6772,"references":6774,"versionKeys":6780,"packageCount":32,"repositoryCount":470},"pysec-2025-207-2abef3fc",[6767,6768],"BIT-pytorch-2025-55557","CVE-2025-55557",[312],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[6773],{"type":1401,"score":1543},[6775,6776,6778],{"type":1369,"url":6713},{"type":1766,"url":6777},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1467,"url":6779},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1785,1786,1787],{"id":313,"slug":6782,"dossier":47,"summary":84,"aliases":6783,"sourceIds":6786,"published":6787,"modified":6788,"checkedAt":7,"severity":6789,"references":6791,"versionKeys":6797,"packageCount":32,"repositoryCount":470},"pysec-2025-208-6e93fe9d",[6784,6785],"BIT-pytorch-2025-55558","CVE-2025-55558",[313],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[6790],{"type":1401,"score":1543},[6792,6793,6795],{"type":1369,"url":6713},{"type":1766,"url":6794},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1467,"url":6796},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1785,1786,1787],{"id":314,"slug":6799,"dossier":47,"summary":84,"aliases":6800,"sourceIds":6803,"published":6804,"modified":6805,"checkedAt":7,"severity":6806,"references":6808,"versionKeys":6814,"packageCount":32,"repositoryCount":470},"pysec-2025-209-e6f352b0",[6801,6802],"BIT-pytorch-2025-55560","CVE-2025-55560",[314],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[6807],{"type":1401,"score":1543},[6809,6810,6812],{"type":1369,"url":6713},{"type":1766,"url":6811},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1467,"url":6813},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1785,1786,1787],{"id":315,"slug":6816,"dossier":47,"summary":84,"aliases":6817,"sourceIds":6819,"published":6820,"modified":6821,"checkedAt":7,"severity":6822,"references":6824,"versionKeys":6827,"packageCount":32,"repositoryCount":2354},"pysec-2025-211-d8bd15de",[6818],"CVE-2025-14920",[315],"2025-12-23T21:15:47.183Z","2026-05-21T15:00:32.080516132Z",[6823],{"type":1401,"score":1634},[6825],{"type":1369,"url":6826},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1150\u002F",[1647,1648,1649,1650,1651],{"id":316,"slug":6829,"dossier":47,"summary":84,"aliases":6830,"sourceIds":6832,"published":6833,"modified":6834,"checkedAt":7,"severity":6835,"references":6837,"versionKeys":6840,"packageCount":32,"repositoryCount":2354},"pysec-2025-212-a011b97d",[6831],"CVE-2025-14921",[316],"2025-12-23T21:15:47.340Z","2026-05-21T15:00:32.052313357Z",[6836],{"type":1401,"score":1634},[6838],{"type":1369,"url":6839},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1149\u002F",[1647,1648,1649,1650,1651],{"id":317,"slug":6842,"dossier":47,"summary":84,"aliases":6843,"sourceIds":6845,"published":6846,"modified":6847,"checkedAt":7,"severity":6848,"references":6850,"versionKeys":6853,"packageCount":32,"repositoryCount":2354},"pysec-2025-213-9043dc9b",[6844],"CVE-2025-14924",[317],"2025-12-23T21:15:47.600Z","2026-05-21T15:00:32.048516839Z",[6849],{"type":1401,"score":1634},[6851],{"type":1369,"url":6852},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1141\u002F",[1647,1648,1649,1650,1651],{"id":318,"slug":6855,"dossier":47,"summary":84,"aliases":6856,"sourceIds":6858,"published":6859,"modified":6860,"checkedAt":7,"severity":6861,"references":6863,"versionKeys":6866,"packageCount":32,"repositoryCount":2354},"pysec-2025-214-eb241255",[6857],"CVE-2025-14926",[318],"2025-12-23T21:15:47.857Z","2026-05-21T15:00:32.929011749Z",[6862],{"type":1401,"score":1634},[6864],{"type":1369,"url":6865},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1147\u002F",[1647,1648,1649,1650,1651],{"id":319,"slug":6868,"dossier":47,"summary":84,"aliases":6869,"sourceIds":6871,"published":6872,"modified":6873,"checkedAt":7,"severity":6874,"references":6876,"versionKeys":6879,"packageCount":32,"repositoryCount":2354},"pysec-2025-215-6064f491",[6870],"CVE-2025-14927",[319],"2025-12-23T21:15:47.987Z","2026-05-21T15:00:32.888290877Z",[6875],{"type":1401,"score":1634},[6877],{"type":1369,"url":6878},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1148\u002F",[1647,1648,1649,1650,1651],{"id":320,"slug":6881,"dossier":47,"summary":84,"aliases":6882,"sourceIds":6884,"published":6885,"modified":6886,"checkedAt":7,"severity":6887,"references":6889,"versionKeys":6892,"packageCount":32,"repositoryCount":2354},"pysec-2025-216-5708ed01",[6883],"CVE-2025-14928",[320],"2025-12-23T21:15:48.110Z","2026-05-21T15:00:32.939311939Z",[6888],{"type":1401,"score":1634},[6890],{"type":1369,"url":6891},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1146\u002F",[1647,1648,1649,1650,1651],{"id":321,"slug":6894,"dossier":47,"summary":84,"aliases":6895,"sourceIds":6897,"published":6898,"modified":6899,"checkedAt":7,"severity":6900,"references":6902,"versionKeys":6905,"packageCount":32,"repositoryCount":66},"pysec-2025-217-2c1ad388",[6896],"CVE-2025-14929",[321],"2025-12-23T21:15:48.240Z","2026-05-21T15:00:24.271970226Z",[6901],{"type":1401,"score":1634},[6903],{"type":1369,"url":6904},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1144\u002F",[1647,1648,1649,1650,1651,1652,1653,1654,1655],{"id":322,"slug":6907,"dossier":47,"summary":84,"aliases":6908,"sourceIds":6910,"published":6911,"modified":6912,"checkedAt":7,"severity":6913,"references":6915,"versionKeys":6918,"packageCount":32,"repositoryCount":2107},"pysec-2025-218-39811fc3",[6909],"CVE-2025-14930",[322],"2025-12-23T21:15:48.367Z","2026-05-21T15:00:33.791364554Z",[6914],{"type":1401,"score":1634},[6916],{"type":1369,"url":6917},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1145\u002F",[1647,1648,1649,1650,1651,1652],{"id":323,"slug":6920,"dossier":47,"summary":84,"aliases":6921,"sourceIds":6924,"published":6925,"modified":6926,"checkedAt":7,"severity":6927,"references":6929,"versionKeys":6940,"packageCount":32,"repositoryCount":104},"pysec-2026-139-96951ff6",[6922,6923],"BIT-pytorch-2026-4538","CVE-2026-4538",[323],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[6928],{"type":1401,"score":3052},[6930,6932,6934,6936,6938],{"type":1366,"url":6931},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1369,"url":6933},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1369,"url":6935},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1766,"url":6937},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1467,"url":6939},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[5852,1785,1786,1787,2676,2677,2678,2679,2680,2681,2682],1794724255358]