[{"data":1,"prerenderedAt":2261},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-3608":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":41,"summary":60,"kind":75,"entity":76,"evidence":169,"related":177},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-08-13T02:29:21.454Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-08-13T02:28:06.466Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.28.0","2026-02-20T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":31,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":36,"parsedFileCount":30,"parseErrorCount":32,"unsupportedFileCount":37,"evaluatedVersionCount":38,"metadataResolvedCount":39,"metadataNotFoundCount":40,"osvEvaluatedVersionCount":38,"codeRadarRepositoryCount":30},31,30,1,18,4,21,32,0,3642,3632,10,{"componentParserSchemaVersion":42,"candidateBoundary":43,"resolvedVersionBoundary":44,"manifestRangesResolved":45,"latestVersionSubstitution":45,"containerTagsVulnerabilityChecked":45,"osvClaim":46,"depsDevLicenseSemantics":47,"providerSemantics":48,"generativeAiUsed":45,"scoreUsed":45,"treeEntryCeiling":49,"fileByteCeiling":50,"uniqueVersionCeiling":51,"observedFormats":52},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[53,54,55,56,57,58,59],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":61,"aiPackageCount":62,"resolvedComponentCount":63,"resolvedVersionCount":38,"providerExposureRepositoryCount":64,"licenseExpressionCount":65,"knownLicensePackageCount":66,"unknownLicensePackageCount":31,"advisoryCount":67,"matchedAdvisoryRepositoryCount":68,"topPackage":69},2274,44,5994,6,53,2244,640,26,{"id":70,"slug":71,"label":72,"repositoryCount":73,"repositoryShare":74},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",19,0.6129032258064516,"repository",{"id":77,"slug":78,"gitlabProjectId":79,"name":80,"pathWithNamespace":81,"description":82,"webUrl":83,"commitSha":84,"commitUrl":85,"lastActivityAt":86,"headCommittedAt":87,"tree":88,"files":91,"resolvedComponentCount":101,"artifactResolvedComponentCount":100,"exactManifestPinCount":102,"packageCount":100,"ecosystems":103,"aiPackageCount":102,"licenseExpressionCount":105,"unknownLicensePackageCount":37,"advisoryIds":106,"advisoryCount":164,"providers":165},"opencode:3608","opencode-3608",3608,"AI","iqsh\u002Fcollaboration-online-board\u002Fai",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fiqsh\u002Fcollaboration-online-board\u002Fai","7cc4cbe5064bc5ede2426caf6981c5e9d0509327","https:\u002F\u002Fgitlab.opencode.de\u002Fiqsh\u002Fcollaboration-online-board\u002Fai\u002F-\u002Fcommit\u002F7cc4cbe5064bc5ede2426caf6981c5e9d0509327","2026-04-27T07:50:08.292Z","2026-04-27T07:14:29.000Z",{"complete":89,"entryCount":90,"truncated":45},true,38,[92],{"path":93,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":84,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},"SPDX_v2.0.0.yml","spdx-yaml","e9e46566a2217346214d08f9dede99d8821b3c68","https:\u002F\u002Fgitlab.opencode.de\u002Fiqsh\u002Fcollaboration-online-board\u002Fai\u002F-\u002Fblob\u002F7cc4cbe5064bc5ede2426caf6981c5e9d0509327\u002FSPDX_v2.0.0.yml","e053bc3719cac7ca6a6b278c6593b5be1eef3090462cdd7398ae6d6ac3f21457",649189,"parsed",41,43,2,[104],"pypi",14,[107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163],"GHSA-248v-346w-9cwc","GHSA-29vq-49wr-vm6x","GHSA-2g68-c3qc-8985","GHSA-2xpw-w6gg-jr37","GHSA-38jv-5279-wg99","GHSA-43qf-4rqw-9q2g","GHSA-45hq-cxwh-f6vc","GHSA-48p4-8xcf-vxj5","GHSA-4x4j-2g7c-83w6","GHSA-5rjg-fvgr-3xxf","GHSA-5x94-69rx-g8h2","GHSA-5xmw-vc9v-4wf2","GHSA-62p4-gmf7-7g93","GHSA-65pc-fj4g-8rjx","GHSA-68rp-wp8r-4726","GHSA-6r8x-57c9-28j4","GHSA-6w46-j5rx-g56g","GHSA-7rxf-gvfg-47g4","GHSA-84pr-m4jr-85g5","GHSA-87hc-h4r5-73f7","GHSA-8rrh-rw8j-w5fx","GHSA-8v84-f9pq-wr9x","GHSA-8vgw-p6qm-5gr7","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9wx4-h78v-vm56","GHSA-cfh3-3jmp-rvhc","GHSA-cpwx-vrp4-4pq7","GHSA-cx63-2mw6-8hw5","GHSA-f9vj-2wh5-fj8j","GHSA-fj7v-r99m-22gq","GHSA-g7vv-2v7x-gj9p","GHSA-gc5v-m9x4-r6x2","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hgf8-39gv-g3f2","GHSA-hxwh-jpp2-84pm","GHSA-jjj6-mw9f-p565","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-pg7v-jwj7-p798","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pwv6-vv43-88gr","GHSA-q2x7-8rv6-6q7h","GHSA-q34m-jh98-gwm2","GHSA-qccp-gfcp-xxvc","GHSA-r73j-pqj5-w3x7","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-xg8h-j46f-w952","GHSA-xj96-63gp-2gmr","PYSEC-2026-2132",57,[166],{"id":167,"label":168},"openai","OpenAI",{"files":170,"occurrenceCount":101},[171,176],{"path":172,"kind":173,"sourceUrl":174,"commitSha":84,"blobSha":175,"state":99,"componentCount":102},"requirements.txt","exact-manifest-pin","https:\u002F\u002Fgitlab.opencode.de\u002Fiqsh\u002Fcollaboration-online-board\u002Fai\u002F-\u002Fblob\u002F7cc4cbe5064bc5ede2426caf6981c5e9d0509327\u002Frequirements.txt","84647a72af29d3827325b94a37d0aff74c461ac3",{"path":93,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":84,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},{"packages":178,"vulnerabilities":564},[179,188,198,210,221,231,241,250,260,269,279,288,297,306,315,324,333,343,352,361,370,379,388,397,405,414,423,434,443,452,461,470,479,489,498,507,516,525,535,545,554],{"id":70,"slug":71,"identity":180,"label":72,"aiRelevant":89,"provider":181,"advisoryCount":37,"licenseExpressions":182,"versions":184,"dossier":89,"occurrenceCount":102,"directOccurrenceCount":32,"evidenceFiles":187},"pypi:openai",{"id":167,"label":168},[183],"Apache-2.0",[185,186],"1.14.2","1.91.0",[93,172],{"id":189,"slug":190,"identity":191,"label":192,"aiRelevant":89,"provider":82,"advisoryCount":37,"licenseExpressions":193,"versions":195,"dossier":89,"occurrenceCount":102,"directOccurrenceCount":32,"evidenceFiles":197},"package:pypi:tiktoken","tiktoken-06b251a3","pypi:tiktoken","tiktoken",[194],"non-standard",[196],"0.7.0",[93,172],{"id":199,"slug":200,"identity":201,"label":202,"aiRelevant":45,"provider":82,"advisoryCount":203,"licenseExpressions":204,"versions":207,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":209},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",20,[205,206],"HPND","MIT-CMU",[208],"10.3.0",[93],{"id":211,"slug":212,"identity":213,"label":214,"aiRelevant":45,"provider":82,"advisoryCount":215,"licenseExpressions":216,"versions":218,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":220},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",7,[217],"MIT",[219],"2.2.2",[93],{"id":222,"slug":223,"identity":224,"label":225,"aiRelevant":45,"provider":82,"advisoryCount":64,"licenseExpressions":226,"versions":228,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":230},"package:pypi:werkzeug","werkzeug-b18d5b02","pypi:werkzeug","werkzeug",[227,194],"BSD-3-Clause",[229],"3.0.1",[93],{"id":232,"slug":233,"identity":234,"label":235,"aiRelevant":45,"provider":82,"advisoryCount":236,"licenseExpressions":237,"versions":238,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":240},"package:pypi:flask-cors","flask-cors-348fb6bb","pypi:flask-cors","flask-cors",5,[217],[239],"4.0.0",[93],{"id":242,"slug":243,"identity":244,"label":245,"aiRelevant":45,"provider":82,"advisoryCount":34,"licenseExpressions":246,"versions":247,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":249},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",[227,194],[248],"3.1.3",[93],{"id":251,"slug":252,"identity":253,"label":254,"aiRelevant":45,"provider":82,"advisoryCount":255,"licenseExpressions":256,"versions":257,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":259},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[183],[258],"2.32.3",[93],{"id":261,"slug":262,"identity":263,"label":264,"aiRelevant":45,"provider":82,"advisoryCount":255,"licenseExpressions":265,"versions":266,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":268},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[217],[267],"69.2.0",[93],{"id":270,"slug":271,"identity":272,"label":273,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":274,"versions":276,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":278},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[275],"MPL-2.0",[277],"2024.6.2",[93],{"id":280,"slug":281,"identity":282,"label":283,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":284,"versions":285,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":287},"package:pypi:click","click-ef97f731","pypi:click","click",[227,194],[286],"8.1.7",[93],{"id":289,"slug":290,"identity":291,"label":292,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":293,"versions":294,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":296},"package:pypi:flask","flask-734a8b3c","pypi:flask","flask",[227,194],[295],"3.0.2",[93],{"id":298,"slug":299,"identity":300,"label":301,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":302,"versions":303,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":305},"package:pypi:h11","h11-48165ab1","pypi:h11","h11",[217],[304],"0.14.0",[93],{"id":307,"slug":308,"identity":309,"label":310,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":311,"versions":312,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":314},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[227,194],[313],"3.7",[93],{"id":316,"slug":317,"identity":318,"label":319,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":320,"versions":321,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":323},"package:pypi:pytest","pytest-07c6f86c","pypi:pytest","pytest",[217],[322],"7.2.2",[93],{"id":325,"slug":326,"identity":327,"label":328,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":329,"versions":330,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":332},"package:pypi:python-dotenv","python-dotenv-27b12285","pypi:python-dotenv","python-dotenv",[227],[331],"1.0.1",[93],{"id":334,"slug":335,"identity":336,"label":337,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":338,"versions":340,"dossier":89,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":342},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[339],"MIT AND MPL-2.0",[341],"4.66.2",[93],{"id":344,"slug":345,"identity":346,"label":347,"aiRelevant":45,"provider":82,"advisoryCount":32,"licenseExpressions":348,"versions":349,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":351},"package:pypi:wheel","wheel-17857b9a","pypi:wheel","wheel",[217],[350],"0.43.0",[93],{"id":353,"slug":354,"identity":355,"label":356,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":357,"versions":358,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":360},"package:pypi:annotated-types","annotated-types-2304c38b","pypi:annotated-types","annotated-types",[217],[359],"0.6.0",[93],{"id":362,"slug":363,"identity":364,"label":365,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":366,"versions":367,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":369},"package:pypi:anyio","anyio-399e5280","pypi:anyio","anyio",[217],[368],"4.3.0",[93],{"id":371,"slug":372,"identity":373,"label":374,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":375,"versions":376,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":378},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[217],[377],"23.2.0",[93],{"id":380,"slug":381,"identity":382,"label":383,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":384,"versions":385,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":387},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[217],[386],"1.7.0",[93],{"id":389,"slug":390,"identity":391,"label":392,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":393,"versions":394,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":396},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[217],[395],"3.3.2",[93],{"id":398,"slug":399,"identity":400,"label":401,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":402,"versions":403,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":404},"package:pypi:coverage","coverage-7ba89558","pypi:coverage","coverage",[183],[322],[93],{"id":406,"slug":407,"identity":408,"label":409,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":410,"versions":411,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":413},"package:pypi:distro","distro-36b318e9","pypi:distro","distro",[183],[412],"1.9.0",[93],{"id":415,"slug":416,"identity":417,"label":418,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":419,"versions":420,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":422},"package:pypi:flask-sqlalchemy","flask-sqlalchemy-8ce83d8c","pypi:flask-sqlalchemy","flask-sqlalchemy",[194],[421],"3.1.1",[93],{"id":424,"slug":425,"identity":426,"label":427,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":428,"versions":431,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":433},"package:pypi:greenlet","greenlet-cd6f7934","pypi:greenlet","greenlet",[217,429,430],"MIT AND PSF-2.0","MIT AND Python-2.0",[432],"3.0.3",[93],{"id":435,"slug":436,"identity":437,"label":438,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":439,"versions":440,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":442},"package:pypi:httpcore","httpcore-ba6ae671","pypi:httpcore","httpcore",[227],[441],"1.0.4",[93],{"id":444,"slug":445,"identity":446,"label":447,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":448,"versions":449,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":451},"package:pypi:httpx","httpx-a512a166","pypi:httpx","httpx",[227],[450],"0.27.0",[93],{"id":453,"slug":454,"identity":455,"label":456,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":457,"versions":458,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":460},"package:pypi:iniconfig","iniconfig-1f66e358","pypi:iniconfig","iniconfig",[217],[459],"2.0.0",[93],{"id":462,"slug":463,"identity":464,"label":465,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":466,"versions":467,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":469},"package:pypi:itsdangerous","itsdangerous-4af70837","pypi:itsdangerous","itsdangerous",[227,194],[468],"2.1.2",[93],{"id":471,"slug":472,"identity":473,"label":474,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":475,"versions":476,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":478},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[227,194],[477],"2.1.5",[93],{"id":480,"slug":481,"identity":482,"label":483,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":484,"versions":486,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":488},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[485,194],"Apache-2.0 OR BSD-2-Clause",[487],"24.1",[93],{"id":490,"slug":491,"identity":492,"label":493,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":494,"versions":495,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":497},"package:pypi:pluggy","pluggy-24479aaf","pypi:pluggy","pluggy",[217],[496],"1.5.0",[93],{"id":499,"slug":500,"identity":501,"label":502,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":503,"versions":504,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":506},"package:pypi:psycopg2-binary","psycopg2-binary-128ab534","pypi:psycopg2-binary","psycopg2-binary",[194],[505],"2.9.9",[93],{"id":508,"slug":509,"identity":510,"label":511,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":512,"versions":513,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":515},"package:pypi:pydantic","pydantic-4ac148ca","pypi:pydantic","pydantic",[217],[514],"2.6.4",[93],{"id":517,"slug":518,"identity":519,"label":520,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":521,"versions":522,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":524},"package:pypi:pydantic-core","pydantic-core-f9814ebc","pypi:pydantic-core","pydantic-core",[217],[523],"2.16.3",[93],{"id":526,"slug":527,"identity":528,"label":529,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":530,"versions":532,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":534},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[531,194],"Apache-2.0 AND CNRI-Python",[533],"2024.5.15",[93],{"id":536,"slug":537,"identity":538,"label":539,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":540,"versions":542,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":544},"package:pypi:sniffio","sniffio-83f32c9d","pypi:sniffio","sniffio",[541],"Apache-2.0 OR MIT",[543],"1.3.1",[93],{"id":546,"slug":547,"identity":548,"label":549,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":550,"versions":551,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":553},"package:pypi:sqlalchemy","sqlalchemy-5de7c53b","pypi:sqlalchemy","sqlalchemy",[217],[552],"2.0.29",[93],{"id":555,"slug":556,"identity":557,"label":558,"aiRelevant":45,"provider":82,"advisoryCount":37,"licenseExpressions":559,"versions":561,"dossier":45,"occurrenceCount":32,"directOccurrenceCount":37,"evidenceFiles":563},"package:pypi:typing-extensions","typing-extensions-87d153eb","pypi:typing-extensions","typing-extensions",[560,194],"PSF-2.0",[562],"4.10.0",[93],[565,604,636,669,701,728,760,795,821,850,887,910,934,964,991,1021,1047,1083,1109,1137,1161,1194,1217,1243,1277,1303,1333,1389,1421,1453,1481,1509,1542,1570,1593,1621,1654,1688,1712,1753,1780,1802,1833,1860,1884,1908,1935,1962,1996,2017,2045,2073,2100,2152,2175,2203,2228],{"id":107,"slug":566,"dossier":45,"summary":567,"aliases":568,"sourceIds":571,"published":572,"modified":573,"checkedAt":7,"severity":574,"references":578,"versionKeys":602,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[569,570],"CVE-2024-39689","PYSEC-2024-230",[107,570],"2024-07-05T19:15:10Z","2026-06-10T17:14:18.786020835Z",[575],{"type":576,"score":577},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[579,582,584,587,590,593,596,598,600],{"type":580,"url":581},"ADVISORY","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":580,"url":583},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":585,"url":586},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":588,"url":589},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":591,"url":592},"WEB","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":594,"url":595},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":591,"url":597},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":580,"url":599},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":580,"url":601},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[603],"pypi:certifi@2024.6.2",{"id":108,"slug":605,"dossier":45,"summary":606,"aliases":607,"sourceIds":610,"published":611,"modified":612,"checkedAt":7,"severity":613,"references":619,"versionKeys":630,"packageCount":32,"repositoryCount":64},"ghsa-29vq-49wr-vm6x-7d88633b","Werkzeug safe_join() allows Windows special device names",[608,609],"CVE-2026-27199","PYSEC-2026-2320",[108,609],"2026-02-19T20:32:45Z","2026-07-13T07:26:55.904978535Z",[614,617],{"type":615,"score":616},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":576,"score":618},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[620,622,624,626,628],{"type":580,"url":621},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-29vq-49wr-vm6x",{"type":580,"url":623},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27199",{"type":585,"url":625},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002Ff407712fdc60a09c2b3f4fe7db557703e5d9338d",{"type":588,"url":627},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug",{"type":580,"url":629},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Freleases\u002Ftag\u002F3.1.6",[631,632,633,634,635],"pypi:werkzeug@3.0.1","pypi:werkzeug@3.0.6","pypi:werkzeug@3.1.1","pypi:werkzeug@3.1.3","pypi:werkzeug@3.1.5",{"id":109,"slug":637,"dossier":45,"summary":638,"aliases":639,"sourceIds":642,"published":643,"modified":644,"checkedAt":7,"severity":645,"references":648,"versionKeys":668,"packageCount":32,"repositoryCount":32},"ghsa-2g68-c3qc-8985-d6075eca","Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain",[640,641],"CVE-2024-34069","PYSEC-2026-2043",[109,641],"2024-05-06T14:21:27Z","2026-07-07T17:56:15.006571356Z",[646],{"type":576,"score":647},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[649,651,653,655,656,658,660,662,664,666],{"type":591,"url":650},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-2g68-c3qc-8985",{"type":580,"url":652},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34069",{"type":591,"url":654},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002F3386395b24c7371db11a5b8eaac0c91da5362692",{"type":588,"url":627},{"type":591,"url":657},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F02\u002Fmsg00026.html",{"type":591,"url":659},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FH4SH32AM3CTPMAAEOIDAN7VU565LO4IR",{"type":591,"url":661},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FHFERFN7PINV4MOGMGA3DPIXJPDCYOEJZ",{"type":591,"url":663},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20240614-0004",{"type":588,"url":665},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fwerkzeug",{"type":580,"url":667},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2g68-c3qc-8985",[631],{"id":110,"slug":670,"dossier":89,"summary":671,"aliases":672,"sourceIds":675,"published":676,"modified":677,"checkedAt":7,"severity":678,"references":681,"versionKeys":694,"packageCount":32,"repositoryCount":700},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[673,674],"CVE-2025-66471","PYSEC-2026-1994",[110,674],"2025-12-05T18:15:54Z","2026-07-07T17:56:33.872074196Z",[679],{"type":615,"score":680},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[682,684,686,688,690,692],{"type":591,"url":683},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":580,"url":685},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":585,"url":687},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":588,"url":689},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":588,"url":691},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",{"type":580,"url":693},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",[695,696,697,698,699],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",13,{"id":111,"slug":702,"dossier":89,"summary":703,"aliases":704,"sourceIds":707,"published":708,"modified":709,"checkedAt":7,"severity":710,"references":714,"versionKeys":727,"packageCount":32,"repositoryCount":700},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[705,706],"CVE-2026-21441","PYSEC-2026-1996",[111,706],"2026-01-07T19:18:14Z","2026-07-07T17:56:31.346111893Z",[711,713],{"type":576,"score":712},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":615,"score":680},[715,717,719,721,722,724,725],{"type":591,"url":716},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":580,"url":718},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":585,"url":720},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":588,"url":689},{"type":591,"url":723},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":588,"url":691},{"type":580,"url":726},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[695,696,697,698,699],{"id":112,"slug":729,"dossier":45,"summary":730,"aliases":731,"sourceIds":734,"published":735,"modified":736,"checkedAt":7,"severity":737,"references":740,"versionKeys":757,"packageCount":32,"repositoryCount":102},"ghsa-43qf-4rqw-9q2g-2b94f083","Flask-CORS vulnerable to Improper Handling of Case Sensitivity",[732,733],"CVE-2024-6866","PYSEC-2026-1383",[112,733],"2025-03-20T12:32:45Z","2026-07-07T17:57:18.348501785Z",[738],{"type":576,"score":739},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[741,743,745,747,749,751,753,755],{"type":580,"url":742},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6866",{"type":591,"url":744},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002Feb39516a3c96b90d0ae5f51293972395ec3ef358",{"type":588,"url":746},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors",{"type":591,"url":748},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fblob\u002F4.0.1\u002Fflask_cors\u002Fextension.py#L195",{"type":591,"url":750},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F808c11af-faee-43a8-824b-b5ab4f62b9e6",{"type":591,"url":752},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00049.html",{"type":588,"url":754},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fflask-cors",{"type":580,"url":756},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-43qf-4rqw-9q2g",[758,759],"pypi:flask-cors@4.0.0","pypi:flask-cors@5.0.1",{"id":113,"slug":761,"dossier":89,"summary":762,"aliases":763,"sourceIds":767,"published":768,"modified":769,"checkedAt":7,"severity":770,"references":772,"versionKeys":786,"packageCount":32,"repositoryCount":700},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[764,765,766],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[113,766],"2026-07-06T19:17:08.577Z","2026-07-22T02:59:39.058744123Z",[771],{"type":576,"score":712},[773,776,778,780,782,784],{"type":774,"url":775},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":580,"url":777},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":585,"url":779},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":591,"url":781},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":588,"url":783},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":580,"url":785},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[787,788,789,790,791,792,793,794],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1",{"id":114,"slug":796,"dossier":45,"summary":797,"aliases":798,"sourceIds":801,"published":802,"modified":803,"checkedAt":7,"severity":804,"references":807,"versionKeys":820,"packageCount":32,"repositoryCount":215},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[799,800],"CVE-2025-50182","PYSEC-2026-1997",[114,800],"2025-06-18T17:50:11Z","2026-07-07T17:57:08.881416805Z",[805],{"type":576,"score":806},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[808,810,812,814,815,817,818],{"type":591,"url":809},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":580,"url":811},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":585,"url":813},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":588,"url":689},{"type":591,"url":816},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":588,"url":691},{"type":580,"url":819},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[695,696,697,698],{"id":115,"slug":822,"dossier":89,"summary":823,"aliases":824,"sourceIds":828,"published":829,"modified":830,"checkedAt":7,"severity":831,"references":834,"versionKeys":849,"packageCount":32,"repositoryCount":700},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[825,826,827],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[115,827],"2026-07-06T19:17:08.830Z","2026-07-22T02:59:40.755856576Z",[832],{"type":576,"score":833},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[835,837,839,841,843,845,847,848],{"type":774,"url":836},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":580,"url":838},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":585,"url":840},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":585,"url":842},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":585,"url":844},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":591,"url":846},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":588,"url":783},{"type":580,"url":785},[787,788,789,790,791,792,793,794],{"id":116,"slug":851,"dossier":45,"summary":852,"aliases":853,"sourceIds":857,"published":858,"modified":859,"checkedAt":7,"severity":860,"references":865,"versionKeys":883,"packageCount":32,"repositoryCount":255},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[854,855,856],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[116,856],"2025-05-17T16:15:19Z","2026-05-11T00:26:34.671259971Z",[861,863],{"type":615,"score":862},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":576,"score":864},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[866,868,870,873,875,877,879,881],{"type":774,"url":867},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":580,"url":869},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":871,"url":872},"REPORT","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":585,"url":874},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":591,"url":876},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":588,"url":878},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":591,"url":880},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":594,"url":882},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[884,885,886],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0",{"id":117,"slug":888,"dossier":89,"summary":889,"aliases":890,"sourceIds":894,"published":895,"modified":896,"checkedAt":7,"severity":897,"references":899,"versionKeys":909,"packageCount":32,"repositoryCount":700},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[891,892,893],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[117,893],"2026-07-06T19:17:08.270Z","2026-07-22T02:59:38.824757212Z",[898],{"type":576,"score":712},[900,902,904,905,907,908],{"type":774,"url":901},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":580,"url":903},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":585,"url":779},{"type":591,"url":906},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":588,"url":783},{"type":580,"url":785},[787,788,789,790,791,792,793,794],{"id":118,"slug":911,"dossier":45,"summary":912,"aliases":913,"sourceIds":917,"published":918,"modified":919,"checkedAt":7,"severity":920,"references":925,"versionKeys":933,"packageCount":32,"repositoryCount":40},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[914,915,916],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[118,916],"2026-05-04T20:18:27Z","2026-07-13T07:26:28.768890335Z",[921,923],{"type":576,"score":922},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":615,"score":924},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[926,928,930,931],{"type":580,"url":927},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":580,"url":929},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":588,"url":783},{"type":580,"url":932},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[790,791,792,793,794],{"id":119,"slug":935,"dossier":89,"summary":936,"aliases":937,"sourceIds":941,"published":942,"modified":943,"checkedAt":7,"severity":944,"references":947,"versionKeys":963,"packageCount":32,"repositoryCount":700},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[938,939,940],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[119,940],"2026-07-20T21:08:13Z","2026-07-23T15:11:42.568996050Z",[945],{"type":615,"score":946},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[948,950,952,954,956,957,959,961],{"type":591,"url":949},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":580,"url":951},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":591,"url":953},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":591,"url":955},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":588,"url":783},{"type":591,"url":958},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":588,"url":960},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":580,"url":962},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[787,788,789,790,791,792,793,794],{"id":120,"slug":965,"dossier":89,"summary":966,"aliases":967,"sourceIds":970,"published":971,"modified":972,"checkedAt":7,"severity":973,"references":977,"versionKeys":986,"packageCount":32,"repositoryCount":990},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[968,969],"CVE-2026-45409","PYSEC-2026-215",[120,969],"2026-05-19T14:34:32Z","2026-07-08T17:45:15.021597323Z",[974,975],{"type":576,"score":618},{"type":615,"score":976},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[978,980,982,984],{"type":580,"url":979},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":580,"url":981},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":588,"url":983},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":591,"url":985},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[987,988,989],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.7",17,{"id":121,"slug":992,"dossier":45,"summary":993,"aliases":994,"sourceIds":997,"published":998,"modified":999,"checkedAt":7,"severity":1000,"references":1005,"versionKeys":1016,"packageCount":32,"repositoryCount":64},"ghsa-68rp-wp8r-4726-c59718b4","Flask session does not add `Vary: Cookie` header when accessed in some ways",[995,996],"CVE-2026-27205","PYSEC-2026-2151",[121,996],"2026-02-19T20:45:41Z","2026-07-13T07:26:21.445447696Z",[1001,1003],{"type":615,"score":1002},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":576,"score":1004},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[1006,1008,1010,1012,1014],{"type":580,"url":1007},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fflask\u002Fsecurity\u002Fadvisories\u002FGHSA-68rp-wp8r-4726",{"type":580,"url":1009},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-27205",{"type":585,"url":1011},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fflask\u002Fcommit\u002F089cb86dd22bff589a4eafb7ab8e42dc357623b4",{"type":588,"url":1013},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fflask",{"type":580,"url":1015},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fflask\u002Freleases\u002Ftag\u002F3.1.3",[1017,1018,1019,1020],"pypi:flask@3.0.2","pypi:flask@3.0.3","pypi:flask@3.1.1","pypi:flask@3.1.2",{"id":122,"slug":1022,"dossier":89,"summary":1023,"aliases":1024,"sourceIds":1028,"published":1029,"modified":1030,"checkedAt":7,"severity":1031,"references":1033,"versionKeys":1046,"packageCount":32,"repositoryCount":700},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[1025,1026,1027],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[122,1027],"2026-07-14T16:17:01.937Z","2026-07-22T02:59:40.188047466Z",[1032],{"type":576,"score":712},[1034,1036,1038,1040,1042,1044,1045],{"type":774,"url":1035},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":580,"url":1037},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":585,"url":1039},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":585,"url":1041},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":591,"url":1043},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":588,"url":783},{"type":580,"url":958},[787,788,789,790,791,792,793,794],{"id":123,"slug":1048,"dossier":45,"summary":1049,"aliases":1050,"sourceIds":1053,"published":1054,"modified":1055,"checkedAt":7,"severity":1056,"references":1059,"versionKeys":1078,"packageCount":32,"repositoryCount":64},"ghsa-6w46-j5rx-g56g-5324d549","pytest has vulnerable tmpdir handling",[1051,1052],"CVE-2025-71176","PYSEC-2026-1845",[123,1052],"2026-01-22T06:30:29Z","2026-07-07T17:56:26.471696626Z",[1057],{"type":576,"score":1058},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:L",[1060,1062,1064,1066,1068,1070,1072,1074,1076],{"type":580,"url":1061},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-71176",{"type":591,"url":1063},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fissues\u002F13669",{"type":591,"url":1065},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fpull\u002F14343",{"type":591,"url":1067},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Fcommit\u002F95d8423bd24992deea5b9df32555fa1741679e2c",{"type":588,"url":1069},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytes",{"type":591,"url":1071},"https:\u002F\u002Fgithub.com\u002Fpytest-dev\u002Fpytest\u002Freleases\u002Ftag\u002F9.0.3",{"type":591,"url":1073},"https:\u002F\u002Fwww.openwall.com\u002Flists\u002Foss-security\u002F2026\u002F01\u002F21\u002F5",{"type":588,"url":1075},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytest",{"type":580,"url":1077},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6w46-j5rx-g56g",[1079,1080,1081,1082],"pypi:pytest@7.2.2","pypi:pytest@7.4.4","pypi:pytest@8.3.2","pypi:pytest@9.0.2",{"id":124,"slug":1084,"dossier":45,"summary":1085,"aliases":1086,"sourceIds":1089,"published":735,"modified":1090,"checkedAt":7,"severity":1091,"references":1094,"versionKeys":1108,"packageCount":32,"repositoryCount":102},"ghsa-7rxf-gvfg-47g4-171801e8","Flask-CORS improper regex path matching vulnerability",[1087,1088],"CVE-2024-6839","PYSEC-2026-1384",[124,1088],"2026-07-07T17:57:28.129199523Z",[1092],{"type":576,"score":1093},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[1095,1097,1099,1100,1102,1104,1105,1106],{"type":580,"url":1096},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6839",{"type":591,"url":1098},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002Fe970988bea563e05e8b8f53fa7bcc134b5bf5c5f",{"type":588,"url":746},{"type":591,"url":1101},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fblob\u002F4.0.1\u002Fflask_cors\u002Fcore.py#L73",{"type":591,"url":1103},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F403eb1fc-86f4-4820-8eba-0f3dfae9f2b4",{"type":591,"url":752},{"type":588,"url":754},{"type":580,"url":1107},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7rxf-gvfg-47g4",[758,759],{"id":125,"slug":1110,"dossier":45,"summary":1111,"aliases":1112,"sourceIds":1115,"published":1116,"modified":1117,"checkedAt":7,"severity":1118,"references":1123,"versionKeys":1136,"packageCount":32,"repositoryCount":32},"ghsa-84pr-m4jr-85g5-4a9795ee","flask-cors vulnerable to log injection when the log level is set to debug",[1113,1114],"CVE-2024-1681","PYSEC-2024-271",[125,1114],"2024-04-19T20:15:09.273Z","2026-06-10T17:01:16.365143709Z",[1119,1121],{"type":576,"score":1120},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":576,"score":1122},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[1124,1126,1127,1129,1131,1133,1134],{"type":580,"url":1125},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-1681",{"type":588,"url":746},{"type":591,"url":1128},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fblob\u002F40acc8092332dfed4bb54d7a4f89a6d479466de7\u002Fflask_cors\u002Fextension.py#L194",{"type":591,"url":1130},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fflask-cors\u002FPYSEC-2024-271.yaml",{"type":774,"url":1132},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25a7a0ba-9fa2-4777-acb6-03e5539bb644",{"type":591,"url":752},{"type":580,"url":1135},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-84pr-m4jr-85g5",[758],{"id":126,"slug":1138,"dossier":45,"summary":1139,"aliases":1140,"sourceIds":1143,"published":1144,"modified":1145,"checkedAt":7,"severity":1146,"references":1149,"versionKeys":1160,"packageCount":32,"repositoryCount":236},"ghsa-87hc-h4r5-73f7-c5117ca2","Werkzeug safe_join() allows Windows special device names with compound extensions",[1141,1142],"CVE-2026-21860","PYSEC-2026-2044",[126,1142],"2026-01-08T19:51:21Z","2026-07-07T17:56:19.044748151Z",[1147,1148],{"type":576,"score":618},{"type":615,"score":616},[1150,1152,1154,1156,1157,1158],{"type":591,"url":1151},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-87hc-h4r5-73f7",{"type":580,"url":1153},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21860",{"type":591,"url":1155},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002F7ae1d254e04a0c33e241ac1cca4783ce6c875ca3",{"type":588,"url":627},{"type":588,"url":665},{"type":580,"url":1159},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-87hc-h4r5-73f7",[631,632,633,634],{"id":127,"slug":1162,"dossier":45,"summary":1163,"aliases":1164,"sourceIds":1167,"published":1168,"modified":1169,"checkedAt":7,"severity":1170,"references":1173,"versionKeys":1191,"packageCount":32,"repositoryCount":102},"ghsa-8rrh-rw8j-w5fx-eadd80fb","Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack",[1165,1166],"CVE-2026-24049","PYSEC-2026-2047",[127,1166],"2026-01-22T18:02:56Z","2026-07-07T17:56:06.063831091Z",[1171],{"type":576,"score":1172},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[1174,1176,1178,1180,1183,1185,1187,1189],{"type":591,"url":1175},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fwheel\u002Fsecurity\u002Fadvisories\u002FGHSA-8rrh-rw8j-w5fx",{"type":580,"url":1177},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24049",{"type":585,"url":1179},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fwheel\u002Fcommit\u002F7a7d2de96b22a9adf9208afcc9547e1001569fef",{"type":1181,"url":1182},"INTRODUCED","https:\u002F\u002Fgithub.com\u002Fpypa\u002Fwheel\u002Fcommit\u002F934fe177ff912c8e03d5ae951d3805e1fd90ba5e",{"type":588,"url":1184},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fwheel",{"type":591,"url":1186},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fwheel\u002Freleases\u002Ftag\u002F0.46.2",{"type":588,"url":1188},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fwheel",{"type":580,"url":1190},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8rrh-rw8j-w5fx",[1192,1193],"pypi:wheel@0.43.0","pypi:wheel@0.45.1",{"id":128,"slug":1195,"dossier":89,"summary":1196,"aliases":1197,"sourceIds":1201,"published":1202,"modified":1203,"checkedAt":7,"severity":1204,"references":1206,"versionKeys":1216,"packageCount":32,"repositoryCount":700},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[1198,1199,1200],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[128,1200],"2026-07-06T19:17:08.127Z","2026-07-22T02:59:41.148041376Z",[1205],{"type":576,"score":712},[1207,1209,1211,1212,1214,1215],{"type":774,"url":1208},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":580,"url":1210},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":585,"url":779},{"type":591,"url":1213},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":588,"url":783},{"type":580,"url":785},[787,788,789,790,791,792,793,794],{"id":129,"slug":1218,"dossier":45,"summary":1219,"aliases":1220,"sourceIds":1223,"published":735,"modified":1224,"checkedAt":7,"severity":1225,"references":1228,"versionKeys":1242,"packageCount":32,"repositoryCount":102},"ghsa-8vgw-p6qm-5gr7-be25d449","Flask-CORS allows for inconsistent CORS matching",[1221,1222],"CVE-2024-6844","PYSEC-2026-1385",[129,1222],"2026-07-07T17:57:07.966932476Z",[1226],{"type":576,"score":1227},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[1229,1231,1233,1234,1236,1238,1239,1240],{"type":580,"url":1230},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6844",{"type":591,"url":1232},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002F35d875319621bd129a38b2b823abf4a2f6cda536",{"type":588,"url":746},{"type":591,"url":1235},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fblob\u002Fmain\u002Fflask_cors\u002Fextension.py#L193",{"type":591,"url":1237},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F731a6cd4-d05f-4fe6-8f5b-fe088d7b34e0",{"type":591,"url":752},{"type":588,"url":754},{"type":580,"url":1241},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8vgw-p6qm-5gr7",[758,759],{"id":130,"slug":1244,"dossier":45,"summary":1245,"aliases":1246,"sourceIds":1249,"published":1250,"modified":1251,"checkedAt":7,"severity":1252,"references":1255,"versionKeys":1274,"packageCount":32,"repositoryCount":215},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[1247,1248],"CVE-2024-47081","PYSEC-2026-1872",[130,1248],"2025-06-09T19:06:08Z","2026-07-07T17:56:56.234172558Z",[1253],{"type":576,"score":1254},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1256,1258,1260,1262,1264,1266,1268,1270,1272],{"type":591,"url":1257},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":580,"url":1259},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":591,"url":1261},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":585,"url":1263},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":588,"url":1265},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":591,"url":1267},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":591,"url":1269},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",{"type":588,"url":1271},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":580,"url":1273},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",[1275,1276],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":131,"slug":1278,"dossier":89,"summary":1279,"aliases":1280,"sourceIds":1284,"published":1285,"modified":1286,"checkedAt":7,"severity":1287,"references":1289,"versionKeys":1302,"packageCount":32,"repositoryCount":700},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[1281,1282,1283],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[131,1283],"2026-07-14T16:17:02.370Z","2026-07-22T02:59:40.628222965Z",[1288],{"type":576,"score":712},[1290,1292,1294,1296,1298,1300,1301],{"type":774,"url":1291},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":580,"url":1293},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":585,"url":1295},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":585,"url":1297},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":591,"url":1299},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":588,"url":783},{"type":580,"url":958},[787,788,789,790,791,792,793,794],{"id":132,"slug":1304,"dossier":45,"summary":1305,"aliases":1306,"sourceIds":1309,"published":1310,"modified":1311,"checkedAt":7,"severity":1312,"references":1315,"versionKeys":1332,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[1307,1308],"CVE-2024-35195","PYSEC-2026-1873",[132,1308],"2024-05-20T20:15:00Z","2026-07-07T17:57:17.012984050Z",[1313],{"type":576,"score":1314},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[1316,1318,1320,1322,1324,1325,1327,1329,1330],{"type":591,"url":1317},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":580,"url":1319},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":591,"url":1321},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":585,"url":1323},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":588,"url":1265},{"type":591,"url":1326},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":591,"url":1328},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":588,"url":1271},{"type":580,"url":1331},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[1275],{"id":133,"slug":1334,"dossier":45,"summary":1335,"aliases":1336,"sourceIds":1340,"published":1341,"modified":1342,"checkedAt":7,"severity":1343,"references":1347,"versionKeys":1387,"packageCount":32,"repositoryCount":1388},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[1337,1338,1339],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[133,1339],"2026-02-11T14:22:50Z","2026-07-13T07:26:49.514806069Z",[1344,1346],{"type":615,"score":1345},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":576,"score":712},[1348,1350,1352,1354,1356,1358,1359,1361,1363,1365,1367,1369,1371,1373,1375,1377,1379,1381,1383,1385],{"type":591,"url":1349},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":580,"url":1351},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":591,"url":1353},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":591,"url":1355},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":591,"url":1357},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":588,"url":783},{"type":591,"url":1360},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":591,"url":1362},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":591,"url":1364},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":580,"url":1366},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":580,"url":1368},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":580,"url":1370},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":580,"url":1372},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":580,"url":1374},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":580,"url":1376},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":580,"url":1378},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":580,"url":1380},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":580,"url":1382},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":580,"url":1384},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":580,"url":1386},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[787,788,789,790,791,792,793],12,{"id":134,"slug":1390,"dossier":45,"summary":1391,"aliases":1392,"sourceIds":1395,"published":1396,"modified":1397,"checkedAt":7,"severity":1398,"references":1401,"versionKeys":1418,"packageCount":32,"repositoryCount":102},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[1393,1394],"CVE-2025-27516","PYSEC-2026-1471",[134,1394],"2025-03-05T20:40:14Z","2026-07-07T17:56:16.836141266Z",[1399],{"type":615,"score":1400},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1402,1404,1406,1408,1410,1412,1414,1416],{"type":591,"url":1403},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":580,"url":1405},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":585,"url":1407},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":588,"url":1409},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":591,"url":1411},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":591,"url":1413},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":588,"url":1415},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":580,"url":1417},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[1419,1420],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":135,"slug":1422,"dossier":45,"summary":1423,"aliases":1424,"sourceIds":1428,"published":1429,"modified":1430,"checkedAt":7,"severity":1431,"references":1436,"versionKeys":1452,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[1425,1426,1427],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[135,1427],"2024-07-15T03:30:57Z","2026-07-07T17:57:13.326243614Z",[1432,1434],{"type":576,"score":1433},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":615,"score":1435},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1437,1439,1441,1443,1444,1446,1448,1450],{"type":580,"url":1438},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":591,"url":1440},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":591,"url":1442},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":588,"url":878},{"type":591,"url":1445},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":591,"url":1447},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":588,"url":1449},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":580,"url":1451},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[884],{"id":136,"slug":1454,"dossier":45,"summary":1455,"aliases":1456,"sourceIds":1459,"published":1460,"modified":1461,"checkedAt":7,"severity":1462,"references":1465,"versionKeys":1480,"packageCount":32,"repositoryCount":32},"ghsa-f9vj-2wh5-fj8j-f0f29e2a","Werkzeug safe_join not safe on Windows",[1457,1458],"CVE-2024-49766","PYSEC-2026-2045",[136,1458],"2024-10-25T19:43:41Z","2026-07-07T17:56:25.762524663Z",[1463],{"type":615,"score":1464},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1466,1468,1470,1472,1473,1475,1477,1478],{"type":591,"url":1467},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-f9vj-2wh5-fj8j",{"type":580,"url":1469},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-49766",{"type":585,"url":1471},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002F2767bcb10a7dd1c297d812cc5e6d11a474c1f092",{"type":588,"url":627},{"type":591,"url":1474},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Freleases\u002Ftag\u002F3.0.6",{"type":591,"url":1476},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20250131-0005",{"type":588,"url":665},{"type":580,"url":1479},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-f9vj-2wh5-fj8j",[631],{"id":137,"slug":1482,"dossier":89,"summary":1483,"aliases":1484,"sourceIds":1488,"published":1489,"modified":1490,"checkedAt":7,"severity":1491,"references":1494,"versionKeys":1508,"packageCount":32,"repositoryCount":700},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[1485,1486,1487],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[137,1487],"2026-07-20T23:09:36Z","2026-07-23T15:11:28.382441947Z",[1492],{"type":576,"score":1493},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[1495,1497,1499,1501,1503,1504,1505,1506],{"type":591,"url":1496},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":580,"url":1498},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":591,"url":1500},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":591,"url":1502},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":588,"url":783},{"type":591,"url":958},{"type":588,"url":960},{"type":580,"url":1507},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[787,788,789,790,791,792,793,794],{"id":138,"slug":1510,"dossier":45,"summary":1511,"aliases":1512,"sourceIds":1515,"published":1516,"modified":1517,"checkedAt":7,"severity":1518,"references":1521,"versionKeys":1540,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[1513,1514],"CVE-2024-34062","PYSEC-2026-1976",[138,1514],"2024-05-03T19:33:28Z","2026-07-07T17:56:20.187915678Z",[1519],{"type":576,"score":1520},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[1522,1524,1526,1528,1530,1532,1534,1536,1538],{"type":591,"url":1523},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":580,"url":1525},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":591,"url":1527},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":588,"url":1529},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":591,"url":1531},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":591,"url":1533},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":591,"url":1535},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":588,"url":1537},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":580,"url":1539},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[1541],"pypi:tqdm@4.66.2",{"id":139,"slug":1543,"dossier":89,"summary":1544,"aliases":1545,"sourceIds":1548,"published":1549,"modified":1550,"checkedAt":7,"severity":1551,"references":1556,"versionKeys":1566,"packageCount":32,"repositoryCount":1569},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[1546,1547],"CVE-2026-25645","PYSEC-2026-2275",[139,1547],"2026-03-25T16:56:28Z","2026-07-13T07:26:34.091663004Z",[1552,1554],{"type":576,"score":1553},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":576,"score":1555},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1557,1559,1561,1563,1564],{"type":580,"url":1558},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":580,"url":1560},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":585,"url":1562},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":588,"url":1265},{"type":580,"url":1565},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[1275,1276,1567,1568],"pypi:requests@2.32.4","pypi:requests@2.32.5",15,{"id":140,"slug":1571,"dossier":89,"summary":1572,"aliases":1573,"sourceIds":1576,"published":1577,"modified":1578,"checkedAt":7,"severity":1579,"references":1581,"versionKeys":1592,"packageCount":32,"repositoryCount":700},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[1574,1575],"CVE-2025-66418","PYSEC-2026-1998",[140,1575],"2025-12-05T18:15:19Z","2026-07-07T17:57:28.931610368Z",[1580],{"type":615,"score":680},[1582,1584,1586,1588,1589,1590],{"type":591,"url":1583},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":580,"url":1585},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":585,"url":1587},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":588,"url":689},{"type":588,"url":691},{"type":580,"url":1591},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[695,696,697,698,699],{"id":141,"slug":1594,"dossier":45,"summary":1595,"aliases":1596,"sourceIds":1599,"published":1600,"modified":1601,"checkedAt":7,"severity":1602,"references":1605,"versionKeys":1620,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[1597,1598],"CVE-2024-56201","PYSEC-2026-1472",[141,1598],"2024-12-23T17:54:12Z","2026-07-07T17:56:55.074166933Z",[1603,1604],{"type":576,"score":864},{"type":615,"score":1400},[1606,1608,1610,1612,1614,1615,1617,1618],{"type":591,"url":1607},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":580,"url":1609},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":591,"url":1611},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":585,"url":1613},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":588,"url":1409},{"type":591,"url":1616},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":588,"url":1415},{"type":580,"url":1619},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[1419],{"id":142,"slug":1622,"dossier":89,"summary":1623,"aliases":1624,"sourceIds":1628,"published":1629,"modified":1630,"checkedAt":7,"severity":1631,"references":1634,"versionKeys":1646,"packageCount":32,"repositoryCount":105},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[1625,1626,1627],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[142,1627],"2026-07-08T17:17:27.020Z","2026-07-23T09:29:39.408842775Z",[1632],{"type":576,"score":1633},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[1635,1637,1639,1641,1643,1644],{"type":774,"url":1636},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":580,"url":1638},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":585,"url":1640},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":591,"url":1642},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":588,"url":878},{"type":580,"url":1645},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[884,885,886,1647,1648,1649,1650,1651,1652,1653],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@82.0.1",{"id":143,"slug":1655,"dossier":45,"summary":1656,"aliases":1657,"sourceIds":1660,"published":1661,"modified":1662,"checkedAt":7,"severity":1663,"references":1666,"versionKeys":1687,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[1658,1659],"CVE-2024-34064","PYSEC-2026-1474",[143,1659],"2024-05-06T14:20:59Z","2026-07-07T17:57:30.872296178Z",[1664],{"type":576,"score":1665},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[1667,1669,1671,1673,1674,1676,1678,1680,1682,1684,1685],{"type":591,"url":1668},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":580,"url":1670},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":585,"url":1672},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":588,"url":1409},{"type":591,"url":1675},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":591,"url":1677},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":591,"url":1679},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":591,"url":1681},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":591,"url":1683},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":588,"url":1415},{"type":580,"url":1686},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[1419],{"id":144,"slug":1689,"dossier":45,"summary":606,"aliases":1690,"sourceIds":1693,"published":1694,"modified":1695,"checkedAt":7,"severity":1696,"references":1698,"versionKeys":1711,"packageCount":32,"repositoryCount":236},"ghsa-hgf8-39gv-g3f2-0469b394",[1691,1692],"CVE-2025-66221","PYSEC-2026-2046",[144,1692],"2025-12-02T00:27:38Z","2026-07-07T17:57:36.044527736Z",[1697],{"type":615,"score":616},[1699,1701,1703,1705,1706,1708,1709],{"type":591,"url":1700},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-hgf8-39gv-g3f2",{"type":580,"url":1702},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66221",{"type":591,"url":1704},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002F4b833376a45c323a189cd11d2362bcffdb1c0c13",{"type":588,"url":627},{"type":591,"url":1707},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Freleases\u002Ftag\u002F3.1.4",{"type":588,"url":665},{"type":580,"url":1710},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hgf8-39gv-g3f2",[631,632,633,634],{"id":145,"slug":1713,"dossier":45,"summary":1714,"aliases":1715,"sourceIds":1718,"published":1719,"modified":1720,"checkedAt":7,"severity":1721,"references":1726,"versionKeys":1752,"packageCount":32,"repositoryCount":32},"ghsa-hxwh-jpp2-84pm-85ca3470","Flask-CORS allows the `Access-Control-Allow-Private-Network` CORS header to be set to true by default",[1716,1717],"CVE-2024-6221","PYSEC-2024-71",[145,1717],"2024-08-18T19:15:00Z","2026-07-09T16:56:25.795378335Z",[1722,1724],{"type":576,"score":1723},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":615,"score":1725},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1727,1729,1731,1733,1735,1737,1739,1741,1742,1744,1746,1748,1750],{"type":580,"url":1728},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6221",{"type":591,"url":1730},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fissues\u002F362",{"type":591,"url":1732},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fpull\u002F363",{"type":591,"url":1734},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fpull\u002F368",{"type":591,"url":1736},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002F03aa3f8e2256437f7bad96422a747b98ab5e31bf",{"type":591,"url":1738},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002F7ae310c56ac30e0b94fb42129aa377bf633256ec",{"type":591,"url":1740},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Fcommit\u002Fc8514760cf03fcce16d77f6db7007aad429c4548",{"type":588,"url":746},{"type":591,"url":1743},"https:\u002F\u002Fgithub.com\u002Fcorydolphin\u002Fflask-cors\u002Freleases",{"type":591,"url":1745},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fflask-cors\u002FPYSEC-2024-260.yaml",{"type":591,"url":1747},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fflask-cors\u002FPYSEC-2024-71.yaml",{"type":591,"url":1749},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fa42935fc-6f57-4818-bca4-3d528235df4d",{"type":580,"url":1751},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxwh-jpp2-84pm",[758],{"id":146,"slug":1754,"dossier":89,"summary":1755,"aliases":1756,"sourceIds":1760,"published":1761,"modified":1762,"checkedAt":7,"severity":1763,"references":1765,"versionKeys":1779,"packageCount":32,"repositoryCount":700},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[1757,1758,1759],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[146,1759],"2026-07-20T23:11:29Z","2026-07-23T15:11:28.034031834Z",[1764],{"type":576,"score":712},[1766,1768,1770,1772,1774,1775,1776,1777],{"type":591,"url":1767},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":580,"url":1769},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":591,"url":1771},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":591,"url":1773},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":588,"url":783},{"type":591,"url":958},{"type":588,"url":960},{"type":580,"url":1778},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[787,788,789,790,791,792,793,794],{"id":147,"slug":1781,"dossier":45,"summary":1782,"aliases":1783,"sourceIds":1786,"published":1787,"modified":1788,"checkedAt":7,"severity":1789,"references":1792,"versionKeys":1800,"packageCount":32,"repositoryCount":255},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[1784,1785],"CVE-2026-44432","PYSEC-2026-142",[147,1785],"2026-05-11T14:51:45Z","2026-06-08T20:00:12.284378628Z",[1790,1791],{"type":576,"score":712},{"type":615,"score":680},[1793,1795,1797,1799],{"type":580,"url":1794},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":580,"url":1796},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":591,"url":1798},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":588,"url":689},[1801],"pypi:urllib3@2.6.3",{"id":148,"slug":1803,"dossier":45,"summary":1804,"aliases":1805,"sourceIds":1808,"published":1809,"modified":1810,"checkedAt":7,"severity":1811,"references":1814,"versionKeys":1827,"packageCount":32,"repositoryCount":1832},"ghsa-mf9w-mj56-hr94-a492e0f4","python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback",[1806,1807],"CVE-2026-28684","PYSEC-2026-2270",[148,1807],"2026-04-20T17:16:33.087Z","2026-07-13T07:26:26.604845458Z",[1812],{"type":576,"score":1813},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[1815,1817,1819,1821,1823,1825],{"type":585,"url":1816},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9w-mj56-hr94",{"type":580,"url":1818},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28684",{"type":585,"url":1820},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311",{"type":591,"url":1822},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311.patch",{"type":588,"url":1824},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv",{"type":580,"url":1826},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Freleases\u002Ftag\u002Fv1.2.2",[1828,1829,1830,1831],"pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1",11,{"id":149,"slug":1834,"dossier":45,"summary":1835,"aliases":1836,"sourceIds":1840,"published":1841,"modified":1842,"checkedAt":7,"severity":1843,"references":1846,"versionKeys":1859,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[1837,1838,1839],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[149,1839],"2026-07-14T16:17:02.063Z","2026-07-22T02:59:40.501589790Z",[1844,1845],{"type":576,"score":618},{"type":576,"score":712},[1847,1849,1851,1853,1855,1857,1858],{"type":774,"url":1848},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":580,"url":1850},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":585,"url":1852},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":585,"url":1854},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":591,"url":1856},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":588,"url":783},{"type":580,"url":958},[792,793,794],{"id":150,"slug":1861,"dossier":89,"summary":1862,"aliases":1863,"sourceIds":1867,"published":1868,"modified":1869,"checkedAt":7,"severity":1870,"references":1872,"versionKeys":1883,"packageCount":32,"repositoryCount":700},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[1864,1865,1866],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[150,1866],"2026-07-06T19:17:08.703Z","2026-07-22T02:59:41.562749940Z",[1871],{"type":576,"score":712},[1873,1875,1877,1879,1881,1882],{"type":774,"url":1874},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":580,"url":1876},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":585,"url":1878},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":591,"url":1880},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":588,"url":783},{"type":580,"url":785},[787,788,789,790,791,792,793,794],{"id":151,"slug":1885,"dossier":45,"summary":1886,"aliases":1887,"sourceIds":1890,"published":1891,"modified":1892,"checkedAt":7,"severity":1893,"references":1895,"versionKeys":1907,"packageCount":32,"repositoryCount":215},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[1888,1889],"CVE-2025-50181","PYSEC-2026-1999",[151,1889],"2025-06-18T17:50:00Z","2026-07-07T17:56:41.872294653Z",[1894],{"type":576,"score":806},[1896,1898,1900,1902,1903,1904,1905],{"type":591,"url":1897},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":580,"url":1899},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":585,"url":1901},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":588,"url":689},{"type":591,"url":816},{"type":588,"url":691},{"type":580,"url":1906},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[695,696,697,698],{"id":152,"slug":1909,"dossier":89,"summary":1910,"aliases":1911,"sourceIds":1915,"published":1916,"modified":1917,"checkedAt":7,"severity":1918,"references":1922,"versionKeys":1934,"packageCount":32,"repositoryCount":700},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[1912,1913,1914],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[152,1914],"2026-05-04T20:20:31Z","2026-07-13T07:26:52.198871129Z",[1919,1920],{"type":615,"score":1345},{"type":576,"score":1921},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1923,1924,1926,1928,1930,1932,1933],{"type":591,"url":1349},{"type":585,"url":1925},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":580,"url":1927},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":585,"url":1929},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":585,"url":1931},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":588,"url":783},{"type":580,"url":932},[787,788,789,790,791,792,793,794],{"id":153,"slug":1936,"dossier":45,"summary":1937,"aliases":1938,"sourceIds":1941,"published":1942,"modified":1943,"checkedAt":7,"severity":1944,"references":1948,"versionKeys":1961,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[1939,1940],"CVE-2024-56326","PYSEC-2026-1475",[153,1940],"2024-12-23T17:56:08Z","2026-07-07T17:56:44.376174317Z",[1945,1947],{"type":576,"score":1946},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":615,"score":1400},[1949,1951,1953,1955,1956,1957,1958,1959],{"type":591,"url":1950},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":580,"url":1952},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":585,"url":1954},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":588,"url":1409},{"type":591,"url":1616},{"type":591,"url":1411},{"type":588,"url":1415},{"type":580,"url":1960},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[1419],{"id":154,"slug":1963,"dossier":45,"summary":1964,"aliases":1965,"sourceIds":1969,"published":1970,"modified":1971,"checkedAt":7,"severity":1972,"references":1975,"versionKeys":1995,"packageCount":32,"repositoryCount":32},"ghsa-q34m-jh98-gwm2-76f8ef0b","Werkzeug possible resource exhaustion when parsing file data in forms",[1966,1967,1968],"CVE-2024-49767","PYSEC-2026-1860","PYSEC-2026-3417",[154,1968],"2024-10-25T19:44:43Z","2026-07-13T16:43:34.482065524Z",[1973,1974],{"type":576,"score":712},{"type":615,"score":976},[1976,1978,1980,1982,1984,1986,1988,1989,1990,1992,1993],{"type":591,"url":1977},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fsecurity\u002Fadvisories\u002FGHSA-q34m-jh98-gwm2",{"type":580,"url":1979},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-49767",{"type":591,"url":1981},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fquart\u002Fcommit\u002F5e78c4169b8eb66b91ead3e62d44721b9e1644ee",{"type":591,"url":1983},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fquart\u002Fcommit\u002Fabb04a512496206de279225340ed022852fbf51f",{"type":591,"url":1985},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002F50cfeebcb0727e18cc52ffbeb125f4a66551179b",{"type":591,"url":1987},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fwerkzeug\u002Fcommit\u002Fcbb446fdcada7685fce936ded01b76c08dbd6eb5",{"type":588,"url":627},{"type":591,"url":1474},{"type":591,"url":1991},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20250103-0007",{"type":588,"url":665},{"type":580,"url":1994},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q34m-jh98-gwm2",[631],{"id":155,"slug":1997,"dossier":89,"summary":1998,"aliases":1999,"sourceIds":2002,"published":2003,"modified":2004,"checkedAt":7,"severity":2005,"references":2010,"versionKeys":2016,"packageCount":32,"repositoryCount":1569},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[2000,2001],"CVE-2026-44431","PYSEC-2026-141",[155,2001],"2026-05-11T14:51:20Z","2026-05-20T09:19:20.983812Z",[2006,2008],{"type":576,"score":2007},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"type":615,"score":2009},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2011,2013,2015],{"type":580,"url":2012},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":580,"url":2014},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":588,"url":689},[695,696,697,698,699,1801],{"id":156,"slug":2018,"dossier":45,"summary":2019,"aliases":2020,"sourceIds":2024,"published":2025,"modified":2026,"checkedAt":7,"severity":2027,"references":2030,"versionKeys":2044,"packageCount":32,"repositoryCount":700},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[2021,2022,2023],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[156,2023],"2026-05-04T20:19:30Z","2026-07-13T16:42:37.358429541Z",[2028,2029],{"type":576,"score":922},{"type":615,"score":924},[2031,2033,2035,2037,2039,2040,2041,2042],{"type":591,"url":2032},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":580,"url":2034},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":591,"url":2036},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":591,"url":2038},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":588,"url":783},{"type":591,"url":932},{"type":588,"url":960},{"type":580,"url":2043},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[787,788,789,790,791,792,793,794],{"id":157,"slug":2046,"dossier":45,"summary":2047,"aliases":2048,"sourceIds":2052,"published":2053,"modified":2054,"checkedAt":7,"severity":2055,"references":2058,"versionKeys":2072,"packageCount":32,"repositoryCount":700},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[2049,2050,2051],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[157,2051],"2026-07-20T23:18:32Z","2026-07-23T15:11:20.720915099Z",[2056],{"type":615,"score":2057},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2059,2061,2063,2065,2067,2068,2069,2070],{"type":591,"url":2060},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":580,"url":2062},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":591,"url":2064},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":591,"url":2066},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":588,"url":783},{"type":591,"url":958},{"type":588,"url":960},{"type":580,"url":2071},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[787,788,789,790,791,792,793,794],{"id":158,"slug":2074,"dossier":45,"summary":2075,"aliases":2076,"sourceIds":2079,"published":2080,"modified":2081,"checkedAt":7,"severity":2082,"references":2085,"versionKeys":2098,"packageCount":32,"repositoryCount":255},"ghsa-vqfr-h8mv-ghfj-49515033","h11 accepts some malformed Chunked-Encoding bodies",[2077,2078],"CVE-2025-43859","PYSEC-2026-348",[158,2078],"2025-04-24T16:07:56Z","2026-07-01T20:22:54.082067Z",[2083],{"type":576,"score":2084},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[2086,2088,2090,2092,2094,2096],{"type":591,"url":2087},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fsecurity\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",{"type":580,"url":2089},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-43859",{"type":591,"url":2091},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fcommit\u002F114803a29ce50116dc47951c690ad4892b1a36ed",{"type":588,"url":2093},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11",{"type":588,"url":2095},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fh11",{"type":580,"url":2097},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",[2099],"pypi:h11@0.14.0",{"id":159,"slug":2101,"dossier":45,"summary":2102,"aliases":2103,"sourceIds":2107,"published":2108,"modified":2109,"checkedAt":7,"severity":2110,"references":2113,"versionKeys":2151,"packageCount":32,"repositoryCount":700},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[2104,2105,2106],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[159,2106],"2026-04-13T19:22:35Z","2026-07-13T07:26:24.246094941Z",[2111,2112],{"type":576,"score":712},{"type":615,"score":2057},[2114,2116,2118,2120,2122,2123,2125,2127,2129,2131,2133,2135,2136,2138,2140,2142,2143,2145,2147,2149],{"type":591,"url":2115},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":580,"url":2117},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":591,"url":2119},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":591,"url":2121},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":588,"url":783},{"type":591,"url":2124},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":591,"url":2126},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":591,"url":2128},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":580,"url":2130},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":580,"url":2132},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":580,"url":2134},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":580,"url":1372},{"type":580,"url":2137},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":580,"url":2139},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":580,"url":2141},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":580,"url":1374},{"type":580,"url":2144},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":580,"url":2146},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":580,"url":2148},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":580,"url":2150},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[787,788,789,790,791,792,793,794],{"id":160,"slug":2153,"dossier":45,"summary":2154,"aliases":2155,"sourceIds":2159,"published":2160,"modified":2161,"checkedAt":7,"severity":2162,"references":2165,"versionKeys":2174,"packageCount":32,"repositoryCount":700},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[2156,2157,2158],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[160,2158],"2026-05-04T20:18:45Z","2026-06-08T23:45:16.414580348Z",[2163,2164],{"type":576,"score":922},{"type":615,"score":924},[2166,2168,2170,2172,2173],{"type":580,"url":2167},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":580,"url":2169},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":591,"url":2171},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":588,"url":783},{"type":580,"url":932},[787,788,789,790,791,792,793,794],{"id":161,"slug":2176,"dossier":45,"summary":2177,"aliases":2178,"sourceIds":2182,"published":2183,"modified":2184,"checkedAt":7,"severity":2185,"references":2188,"versionKeys":2202,"packageCount":32,"repositoryCount":34},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[2179,2180,2181],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[161,2181],"2025-07-01T17:29:37Z","2026-02-04T03:49:31.268130Z",[2186],{"type":576,"score":2187},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[2189,2191,2193,2195,2197,2199,2200],{"type":580,"url":2190},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":580,"url":2192},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":591,"url":2194},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":585,"url":2196},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":591,"url":2198},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":588,"url":783},{"type":591,"url":2201},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[790],{"id":162,"slug":2204,"dossier":45,"summary":2205,"aliases":2206,"sourceIds":2210,"published":2211,"modified":2212,"checkedAt":7,"severity":2213,"references":2216,"versionKeys":2227,"packageCount":32,"repositoryCount":700},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[2207,2208,2209],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[162,2209],"2026-07-14T17:17:14.487Z","2026-07-22T11:11:36.231472645Z",[2214],{"type":576,"score":2215},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[2217,2219,2221,2223,2225,2226],{"type":774,"url":2218},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":580,"url":2220},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":585,"url":2222},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":585,"url":2224},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":588,"url":783},{"type":580,"url":958},[787,788,789,790,791,792,793,794],{"id":163,"slug":2229,"dossier":89,"summary":82,"aliases":2230,"sourceIds":2233,"published":2234,"modified":2235,"checkedAt":7,"severity":2236,"references":2239,"versionKeys":2254,"packageCount":32,"repositoryCount":105},"pysec-2026-2132-627bf7c7",[2231,2232],"CVE-2026-7246","GHSA-47fr-3ffg-hgmw",[163],"2026-04-30T14:16:36.433Z","2026-07-13T07:15:21.899333658Z",[2237],{"type":576,"score":2238},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[2240,2242,2244,2246,2248,2250,2252],{"type":591,"url":2241},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-7246",{"type":591,"url":2243},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-7246.json",{"type":580,"url":2245},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24761",{"type":580,"url":2247},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24762",{"type":871,"url":2249},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2464121",{"type":585,"url":2251},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fclick\u002Freleases\u002Ftag\u002F8.3.3",{"type":774,"url":2253},"https:\u002F\u002Fgithub.com\u002Ftsigouris007\u002Fsecurity-advisories\u002Fsecurity\u002Fadvisories\u002FGHSA-47fr-3ffg-hgmw",[2255,2256,2257,2258,2259,2260],"pypi:click@8.1.7","pypi:click@8.1.8","pypi:click@8.2.0","pypi:click@8.2.1","pypi:click@8.3.0","pypi:click@8.3.1",1786588640165]