[{"data":1,"prerenderedAt":5347},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-11298":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":76,"entity":77,"evidence":261,"related":264},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-10-01T04:34:15.142Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-10-01T04:32:18.676Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},44,43,1,24,4,27,41,39,38,0,4135,4124,11,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":66,"licenseExpressionCount":67,"knownLicensePackageCount":68,"unknownLicensePackageCount":69,"advisoryCount":70,"matchedAdvisoryRepositoryCount":38,"topPackage":71},2467,50,7265,9,55,2433,34,852,{"id":72,"slug":73,"label":74,"repositoryCount":33,"repositoryShare":75},"package:pypi:openai","openai-0dd26ac5","OpenAI SDK",0.5454545454545454,"repository",{"id":78,"slug":79,"gitlabProjectId":80,"name":81,"pathWithNamespace":82,"description":83,"webUrl":84,"commitSha":85,"commitUrl":86,"lastActivityAt":87,"headCommittedAt":88,"tree":89,"files":92,"resolvedComponentCount":100,"artifactResolvedComponentCount":100,"exactManifestPinCount":39,"packageCount":100,"ecosystems":101,"aiPackageCount":103,"licenseExpressionCount":104,"unknownLicensePackageCount":32,"advisoryIds":105,"advisoryCount":259,"providers":260},"opencode:11298","opencode-11298",11298,"URBAN.KI Sovia","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban-ki-sovia",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban-ki-sovia","b961d043e77a4561b9f77c65c6818627c1f34c22","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban-ki-sovia\u002F-\u002Fcommit\u002Fb961d043e77a4561b9f77c65c6818627c1f34c22","2026-09-15T13:10:29.040Z","2026-09-14T08:20:12.000Z",{"complete":90,"entryCount":91,"truncated":47},true,70,[93],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},"uv-lock","ddc57ad0a634363d7ebefcbde0786b734f6f5f81","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban-ki-sovia\u002F-\u002Fblob\u002Fb961d043e77a4561b9f77c65c6818627c1f34c22\u002Fuv.lock","d444dfad7ad27a1821923a1fc11b3ae40b7e686a1c28dd4b750c45fa1cfa35b8",270188,"parsed",111,[102],"pypi",6,15,[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258],"GHSA-239g-whfq-7xj9","GHSA-248v-346w-9cwc","GHSA-284h-m62q-gf8w","GHSA-29pf-2h5f-8g72","GHSA-2f96-g7mh-g2hx","GHSA-2xpw-w6gg-jr37","GHSA-3749-ghw9-m3mg","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3f7w-8rr8-f37f","GHSA-3hv7-mjh2-fv65","GHSA-3rp5-jjmw-4wv2","GHSA-3wxw-xv34-2frg","GHSA-3x9g-8vmp-wqvf","GHSA-45hq-cxwh-f6vc","GHSA-48p4-8xcf-vxj5","GHSA-4gmw-gg2m-w46p","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-539m-9xh6-q6rr","GHSA-53q9-r3pm-6pq6","GHSA-59cr-6r3x-644w","GHSA-59p9-h35m-wg4g","GHSA-5rjg-fvgr-3xxf","GHSA-5x94-69rx-g8h2","GHSA-5xmw-vc9v-4wf2","GHSA-5xxx-qhh7-9287","GHSA-62p4-gmf7-7g93","GHSA-6497-prx7-gpmq","GHSA-65pc-fj4g-8rjx","GHSA-69w3-r845-3855","GHSA-6p8h-3wgx-97gf","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-7545-fcxq-7j24","GHSA-768j-98cg-p3fv","GHSA-7833-fr7j-v32q","GHSA-78cv-mqj4-43f7","GHSA-7cx3-6m66-7c5m","GHSA-7gcm-g887-7qv7","GHSA-7p48-42j8-8846","GHSA-8423-8fgw-73vq","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8mcc-hrx5-hvxc","GHSA-8qvm-5x2c-j2w7","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-94p4-4cq8-9g67","GHSA-956x-8gvw-wg5v","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9rj7-rf2p-w77r","GHSA-9wx4-h78v-vm56","GHSA-c2m8-h5v5-343r","GHSA-c678-jfcj-6jmf","GHSA-c98p-7wgm-6p64","GHSA-cfh3-3jmp-rvhc","GHSA-chx6-46f5-w4vp","GHSA-cpwx-vrp4-4pq7","GHSA-cx3h-4qpv-8hc9","GHSA-cx63-2mw6-8hw5","GHSA-f4hp-rmr7-r7v8","GHSA-fgcw-684q-jj6r","GHSA-fj7v-r99m-22gq","GHSA-fjr4-x663-mwxc","GHSA-fpwr-67px-3qhx","GHSA-g5vv-9gxw-82hx","GHSA-g7vv-2v7x-gj9p","GHSA-gc5v-m9x4-r6x2","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hh9p-6wh2-4mfc","GHSA-hmq2-w58f-27jc","GHSA-hxxf-235m-72v3","GHSA-jhmp-mqwm-3gq8","GHSA-jhr6-gm9c-rqjv","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jm78-9fvv-mhgr","GHSA-jw8x-6495-233v","GHSA-mf9v-mfxr-j63j","GHSA-mgf9-4vpg-hj56","GHSA-mpf4-983q-p7j4","GHSA-mv93-w799-cj2w","GHSA-p538-c434-8v24","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pq67-6m6q-mj2v","GHSA-pr2v-jx2c-wg9f","GHSA-pw6j-qg29-8w7f","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qjxf-f2mg-c6mc","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r73j-pqj5-w3x7","GHSA-r9mr-m37c-5fr3","GHSA-rcv9-qm8p-9p6j","GHSA-rgxp-2hwp-jwgg","GHSA-rpm5-65cw-6hj4","GHSA-rrmf-rvhw-rf47","GHSA-rwj8-pgh3-r573","GHSA-v87r-6q3f-2j67","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqwp-45wm-r9r5","GHSA-vxq7-64xx-v4gw","GHSA-w853-jp5j-5j7f","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wrfc-pvp9-mr9g","GHSA-wvpp-8hx9-p66j","GHSA-wwv5-g3v4-889x","GHSA-x2qx-6953-8485","GHSA-x3gm-94wq-g975","GHSA-x9r9-c232-4q39","GHSA-xg8h-j46f-w952","GHSA-xj96-63gp-2gmr","GHSA-xrqw-3rrv-vx5w","PYSEC-2025-112","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139","PYSEC-2026-2132","PYSEC-2026-2286",153,[],{"files":262,"occurrenceCount":100},[263],{"path":56,"kind":94,"blobSha":95,"sourceUrl":96,"commitSha":85,"contentSha256":97,"byteCount":98,"state":99,"componentCount":100},{"packages":265,"vulnerabilities":1287},[266,279,290,300,310,319,328,338,350,360,371,380,390,399,410,419,428,438,447,456,465,474,483,492,502,512,521,530,539,548,557,566,575,584,593,602,611,620,629,638,647,656,665,674,683,692,701,710,719,728,737,746,755,764,773,782,792,801,810,819,827,836,845,854,863,872,881,890,899,907,916,925,935,944,953,962,971,980,990,999,1008,1017,1026,1035,1044,1053,1062,1071,1081,1090,1099,1108,1117,1126,1135,1144,1152,1161,1170,1179,1188,1197,1206,1215,1224,1233,1242,1252,1260,1269,1278],{"id":267,"slug":268,"identity":269,"label":270,"aiRelevant":90,"provider":271,"advisoryCount":35,"licenseExpressions":274,"versions":276,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":278},"package:pypi:transformers","transformers-65289303","pypi:transformers","Transformers",{"id":272,"label":273},"hugging-face","Hugging Face",[275],"Apache-2.0",[277],"4.51.0",[56],{"id":280,"slug":281,"identity":282,"label":283,"aiRelevant":90,"provider":83,"advisoryCount":284,"licenseExpressions":285,"versions":287,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":289},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[286],"BSD-3-Clause",[288],"2.9.1",[56],{"id":291,"slug":292,"identity":293,"label":294,"aiRelevant":90,"provider":295,"advisoryCount":32,"licenseExpressions":296,"versions":297,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":299},"package:pypi:sentence-transformers","sentence-transformers-3f3d7a36","pypi:sentence-transformers","Sentence Transformers",{"id":272,"label":273},[275],[298],"4.0.2",[56],{"id":301,"slug":302,"identity":303,"label":304,"aiRelevant":90,"provider":83,"advisoryCount":32,"licenseExpressions":305,"versions":307,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":309},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",[286,306],"non-standard",[308],"1.6.1",[56],{"id":311,"slug":312,"identity":313,"label":314,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":315,"versions":316,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":318},"package:pypi:tokenizers","tokenizers-7ba00902","pypi:tokenizers","Hugging Face Tokenizers",[306],[317],"0.21.1",[56],{"id":320,"slug":321,"identity":322,"label":323,"aiRelevant":90,"provider":83,"advisoryCount":39,"licenseExpressions":324,"versions":325,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":327},"package:pypi:opencv-python","opencv-python-bfa06e24","pypi:opencv-python","OpenCV",[275],[326],"4.11.0.86",[56],{"id":329,"slug":330,"identity":331,"label":332,"aiRelevant":47,"provider":83,"advisoryCount":333,"licenseExpressions":334,"versions":335,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":337},"package:pypi:gitpython","gitpython-dcd13009","pypi:gitpython","gitpython",30,[286],[336],"3.1.45",[56],{"id":339,"slug":340,"identity":341,"label":342,"aiRelevant":47,"provider":83,"advisoryCount":343,"licenseExpressions":344,"versions":347,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":349},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",20,[345,346],"HPND","MIT-CMU",[348],"11.1.0",[56],{"id":351,"slug":352,"identity":353,"label":354,"aiRelevant":47,"provider":83,"advisoryCount":355,"licenseExpressions":356,"versions":357,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":359},"package:pypi:tornado","tornado-ab0f364e","pypi:tornado","tornado",16,[275],[358],"6.5.2",[56],{"id":361,"slug":362,"identity":363,"label":364,"aiRelevant":47,"provider":83,"advisoryCount":365,"licenseExpressions":366,"versions":368,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":370},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[367],"MIT",[369],"2.3.0",[56],{"id":372,"slug":373,"identity":374,"label":375,"aiRelevant":47,"provider":83,"advisoryCount":34,"licenseExpressions":376,"versions":377,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":379},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",[286,306],[378],"3.1.6",[56],{"id":381,"slug":382,"identity":383,"label":384,"aiRelevant":47,"provider":83,"advisoryCount":385,"licenseExpressions":386,"versions":387,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":389},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[275],[388],"2.32.3",[56],{"id":391,"slug":392,"identity":393,"label":394,"aiRelevant":47,"provider":83,"advisoryCount":385,"licenseExpressions":395,"versions":396,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":398},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[367],[397],"78.1.0",[56],{"id":400,"slug":401,"identity":402,"label":403,"aiRelevant":47,"provider":83,"advisoryCount":404,"licenseExpressions":405,"versions":407,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":409},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",2,[367,406],"Unlicense",[408],"3.18.0",[56],{"id":411,"slug":412,"identity":413,"label":414,"aiRelevant":47,"provider":83,"advisoryCount":404,"licenseExpressions":415,"versions":416,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":418},"package:pypi:protobuf","protobuf-6e30009a","pypi:protobuf","protobuf",[286],[417],"6.32.1",[56],{"id":420,"slug":421,"identity":422,"label":423,"aiRelevant":47,"provider":83,"advisoryCount":404,"licenseExpressions":424,"versions":425,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":427},"package:pypi:streamlit","streamlit-b61aa01e","pypi:streamlit","streamlit",[275],[426],"1.49.1",[56],{"id":429,"slug":430,"identity":431,"label":432,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":433,"versions":435,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":437},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[434],"MPL-2.0",[436],"2025.1.31",[56],{"id":439,"slug":440,"identity":441,"label":442,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":443,"versions":444,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":446},"package:pypi:click","click-ef97f731","pypi:click","click",[286,306],[445],"8.2.1",[56],{"id":448,"slug":449,"identity":450,"label":451,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":452,"versions":453,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":455},"package:pypi:duckdb","duckdb-8c0332c9","pypi:duckdb","duckdb",[367],[454],"1.3.2",[56],{"id":457,"slug":458,"identity":459,"label":460,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":461,"versions":462,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":464},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[367],[463],"4.55.8",[56],{"id":466,"slug":467,"identity":468,"label":469,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":470,"versions":471,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":473},"package:pypi:geopandas","geopandas-968b51b0","pypi:geopandas","geopandas",[286],[472],"1.0.1",[56],{"id":475,"slug":476,"identity":477,"label":478,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":479,"versions":480,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":482},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[286,306],[481],"3.10",[56],{"id":484,"slug":485,"identity":486,"label":487,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":488,"versions":489,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":491},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[275,306],[490],"21.0.0",[56],{"id":493,"slug":494,"identity":495,"label":496,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":497,"versions":499,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":501},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[498],"BSD-2-Clause",[500],"2.19.1",[56],{"id":503,"slug":504,"identity":505,"label":506,"aiRelevant":47,"provider":83,"advisoryCount":32,"licenseExpressions":507,"versions":509,"dossier":90,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":511},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[508],"MIT AND MPL-2.0",[510],"4.67.1",[56],{"id":513,"slug":514,"identity":515,"label":516,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":517,"versions":518,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":520},"package:pypi:altair","altair-01b7f976","pypi:altair","altair",[306],[519],"5.5.0",[56],{"id":522,"slug":523,"identity":524,"label":525,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":526,"versions":527,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":529},"package:pypi:asttokens","asttokens-c349c5f9","pypi:asttokens","asttokens",[275],[528],"3.0.0",[56],{"id":531,"slug":532,"identity":533,"label":534,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":535,"versions":536,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":538},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[367],[537],"25.3.0",[56],{"id":540,"slug":541,"identity":542,"label":543,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":544,"versions":545,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":547},"package:pypi:blinker","blinker-409e1445","pypi:blinker","blinker",[367],[546],"1.9.0",[56],{"id":549,"slug":550,"identity":551,"label":552,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":553,"versions":554,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":556},"package:pypi:branca","branca-e1a3550c","pypi:branca","branca",[367],[555],"0.8.1",[56],{"id":558,"slug":559,"identity":560,"label":561,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":562,"versions":563,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":565},"package:pypi:cachetools","cachetools-84fe6563","pypi:cachetools","cachetools",[367],[564],"6.2.0",[56],{"id":567,"slug":568,"identity":569,"label":570,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":571,"versions":572,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":574},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[367],[573],"3.4.1",[56],{"id":576,"slug":577,"identity":578,"label":579,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":580,"versions":581,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":583},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[306],[582],"0.4.6",[56],{"id":585,"slug":586,"identity":587,"label":588,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":589,"versions":590,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":592},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[306],[591],"1.3.1",[56],{"id":594,"slug":595,"identity":596,"label":597,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":598,"versions":599,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":601},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[306],[600],"0.12.1",[56],{"id":603,"slug":604,"identity":605,"label":606,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":607,"versions":608,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":610},"package:pypi:decorator","decorator-500c1fb8","pypi:decorator","decorator",[498,306],[609],"5.2.1",[56],{"id":612,"slug":613,"identity":614,"label":615,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":616,"versions":617,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":619},"package:pypi:executing","executing-36845a5b","pypi:executing","executing",[367],[618],"2.2.0",[56],{"id":621,"slug":622,"identity":623,"label":624,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":625,"versions":626,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":628},"package:pypi:folium","folium-6e89a148","pypi:folium","folium",[367],[627],"0.20.0",[56],{"id":630,"slug":631,"identity":632,"label":633,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":634,"versions":635,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":637},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[286,306],[636],"2025.3.2",[56],{"id":639,"slug":640,"identity":641,"label":642,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":643,"versions":644,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":646},"package:pypi:ftfy","ftfy-b3100e16","pypi:ftfy","ftfy",[275],[645],"6.3.1",[56],{"id":648,"slug":649,"identity":650,"label":651,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":652,"versions":653,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":655},"package:pypi:gitdb","gitdb-dac4580b","pypi:gitdb","gitdb",[306],[654],"4.0.12",[56],{"id":657,"slug":658,"identity":659,"label":660,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":661,"versions":662,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":664},"package:pypi:huggingface-hub","huggingface-hub-443ec6ef","pypi:huggingface-hub","huggingface-hub",[275,306],[663],"0.30.1",[56],{"id":666,"slug":667,"identity":668,"label":669,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":670,"versions":671,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":673},"package:pypi:ipython","ipython-7a140323","pypi:ipython","ipython",[286],[672],"9.2.0",[56],{"id":675,"slug":676,"identity":677,"label":678,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":679,"versions":680,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":682},"package:pypi:ipython-pygments-lexers","ipython-pygments-lexers-6216051e","pypi:ipython-pygments-lexers","ipython-pygments-lexers",[306],[681],"1.1.1",[56],{"id":684,"slug":685,"identity":686,"label":687,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":688,"versions":689,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":691},"package:pypi:jedi","jedi-9eb0c211","pypi:jedi","jedi",[367],[690],"0.19.2",[56],{"id":693,"slug":694,"identity":695,"label":696,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":697,"versions":698,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":700},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[286],[699],"1.4.2",[56],{"id":702,"slug":703,"identity":704,"label":705,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":706,"versions":707,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":709},"package:pypi:jsonschema","jsonschema-df23f5cd","pypi:jsonschema","jsonschema",[367],[708],"4.25.1",[56],{"id":711,"slug":712,"identity":713,"label":714,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":715,"versions":716,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":718},"package:pypi:jsonschema-specifications","jsonschema-specifications-5d87863a","pypi:jsonschema-specifications","jsonschema-specifications",[367],[717],"2025.9.1",[56],{"id":720,"slug":721,"identity":722,"label":723,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":724,"versions":725,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":727},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[306],[726],"1.4.8",[56],{"id":729,"slug":730,"identity":731,"label":732,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":733,"versions":734,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":736},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[286,306],[735],"3.0.2",[56],{"id":738,"slug":739,"identity":740,"label":741,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":742,"versions":743,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":745},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[306],[744],"3.10.0",[56],{"id":747,"slug":748,"identity":749,"label":750,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":751,"versions":752,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":754},"package:pypi:matplotlib-inline","matplotlib-inline-50f95e0d","pypi:matplotlib-inline","matplotlib-inline",[286,306],[753],"0.1.7",[56],{"id":756,"slug":757,"identity":758,"label":759,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":760,"versions":761,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":763},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[306],[762],"1.3.0",[56],{"id":765,"slug":766,"identity":767,"label":768,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":769,"versions":770,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":772},"package:pypi:narwhals","narwhals-24e2f721","pypi:narwhals","narwhals",[367,306],[771],"2.4.0",[56],{"id":774,"slug":775,"identity":776,"label":777,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":778,"versions":779,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":781},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[286,306],[780],"3.4.2",[56],{"id":783,"slug":784,"identity":785,"label":786,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":787,"versions":789,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":791},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[788,306],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[790],"2.3.2",[56],{"id":793,"slug":794,"identity":795,"label":796,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":797,"versions":798,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":800},"package:pypi:nvidia-cublas-cu12","nvidia-cublas-cu12-1d052261","pypi:nvidia-cublas-cu12","nvidia-cublas-cu12",[306],[799],"12.8.3.14",[56],{"id":802,"slug":803,"identity":804,"label":805,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":806,"versions":807,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":809},"package:pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12-973480f1","pypi:nvidia-cuda-cupti-cu12","nvidia-cuda-cupti-cu12",[306],[808],"12.8.57",[56],{"id":811,"slug":812,"identity":813,"label":814,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":815,"versions":816,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":818},"package:pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12-e32b7f38","pypi:nvidia-cuda-nvrtc-cu12","nvidia-cuda-nvrtc-cu12",[306],[817],"12.8.61",[56],{"id":820,"slug":821,"identity":822,"label":823,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":824,"versions":825,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":826},"package:pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12-2b875d2a","pypi:nvidia-cuda-runtime-cu12","nvidia-cuda-runtime-cu12",[306],[808],[56],{"id":828,"slug":829,"identity":830,"label":831,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":832,"versions":833,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":835},"package:pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12-a21dce6d","pypi:nvidia-cudnn-cu12","nvidia-cudnn-cu12",[306],[834],"9.7.1.26",[56],{"id":837,"slug":838,"identity":839,"label":840,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":841,"versions":842,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":844},"package:pypi:nvidia-cufft-cu12","nvidia-cufft-cu12-21ff54dd","pypi:nvidia-cufft-cu12","nvidia-cufft-cu12",[306],[843],"11.3.3.41",[56],{"id":846,"slug":847,"identity":848,"label":849,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":850,"versions":851,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":853},"package:pypi:nvidia-cufile-cu12","nvidia-cufile-cu12-14048140","pypi:nvidia-cufile-cu12","nvidia-cufile-cu12",[306],[852],"1.13.0.11",[56],{"id":855,"slug":856,"identity":857,"label":858,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":859,"versions":860,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":862},"package:pypi:nvidia-curand-cu12","nvidia-curand-cu12-2fed778b","pypi:nvidia-curand-cu12","nvidia-curand-cu12",[306],[861],"10.3.9.55",[56],{"id":864,"slug":865,"identity":866,"label":867,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":868,"versions":869,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":871},"package:pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12-7db0a33a","pypi:nvidia-cusolver-cu12","nvidia-cusolver-cu12",[306],[870],"11.7.2.55",[56],{"id":873,"slug":874,"identity":875,"label":876,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":877,"versions":878,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":880},"package:pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12-d7e6a309","pypi:nvidia-cusparse-cu12","nvidia-cusparse-cu12",[306],[879],"12.5.7.53",[56],{"id":882,"slug":883,"identity":884,"label":885,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":886,"versions":887,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":889},"package:pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12-97587f50","pypi:nvidia-cusparselt-cu12","nvidia-cusparselt-cu12",[306],[888],"0.6.3",[56],{"id":891,"slug":892,"identity":893,"label":894,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":895,"versions":896,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":898},"package:pypi:nvidia-nccl-cu12","nvidia-nccl-cu12-90361558","pypi:nvidia-nccl-cu12","nvidia-nccl-cu12",[286,306],[897],"2.26.2",[56],{"id":900,"slug":901,"identity":902,"label":903,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":904,"versions":905,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":906},"package:pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12-6d08af75","pypi:nvidia-nvjitlink-cu12","nvidia-nvjitlink-cu12",[306],[817],[56],{"id":908,"slug":909,"identity":910,"label":911,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":912,"versions":913,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":915},"package:pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12-9a2d0378","pypi:nvidia-nvtx-cu12","nvidia-nvtx-cu12",[275,306],[914],"12.8.55",[56],{"id":917,"slug":918,"identity":919,"label":920,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":921,"versions":922,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":924},"package:pypi:open-clip-torch","open-clip-torch-1f82ec28","pypi:open-clip-torch","open-clip-torch",[367],[923],"2.32.0",[56],{"id":926,"slug":927,"identity":928,"label":929,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":930,"versions":932,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":934},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[931,306],"Apache-2.0 OR BSD-2-Clause",[933],"24.2",[56],{"id":936,"slug":937,"identity":938,"label":939,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":940,"versions":941,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":943},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[306],[942],"2.2.3",[56],{"id":945,"slug":946,"identity":947,"label":948,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":949,"versions":950,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":952},"package:pypi:pandas-stubs","pandas-stubs-b4eaabf3","pypi:pandas-stubs","pandas-stubs",[286],[951],"2.3.2.250827",[56],{"id":954,"slug":955,"identity":956,"label":957,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":958,"versions":959,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":961},"package:pypi:parso","parso-fa59fdde","pypi:parso","parso",[367],[960],"0.8.4",[56],{"id":963,"slug":964,"identity":965,"label":966,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":967,"versions":968,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":970},"package:pypi:pexpect","pexpect-9ad65a0c","pypi:pexpect","pexpect",[306],[969],"4.9.0",[56],{"id":972,"slug":973,"identity":974,"label":975,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":976,"versions":977,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":979},"package:pypi:prompt-toolkit","prompt-toolkit-e6f4118a","pypi:prompt-toolkit","prompt-toolkit",[286,306],[978],"3.0.51",[56],{"id":981,"slug":982,"identity":983,"label":984,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":985,"versions":987,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":989},"package:pypi:ptyprocess","ptyprocess-ec2650c7","pypi:ptyprocess","ptyprocess",[986],"ISC",[988],"0.7.0",[56],{"id":991,"slug":992,"identity":993,"label":994,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":995,"versions":996,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":998},"package:pypi:pure-eval","pure-eval-24d2bc1c","pypi:pure-eval","pure-eval",[367],[997],"0.2.3",[56],{"id":1000,"slug":1001,"identity":1002,"label":1003,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1004,"versions":1005,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1007},"package:pypi:pydeck","pydeck-75380c92","pypi:pydeck","pydeck",[275],[1006],"0.9.1",[56],{"id":1009,"slug":1010,"identity":1011,"label":1012,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1013,"versions":1014,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1016},"package:pypi:pyogrio","pyogrio-ff34272a","pypi:pyogrio","pyogrio",[306],[1015],"0.10.0",[56],{"id":1018,"slug":1019,"identity":1020,"label":1021,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1022,"versions":1023,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1025},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[367],[1024],"3.2.1",[56],{"id":1027,"slug":1028,"identity":1029,"label":1030,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1031,"versions":1032,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1034},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[367],[1033],"3.7.0",[56],{"id":1036,"slug":1037,"identity":1038,"label":1039,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1040,"versions":1041,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1043},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[306],[1042],"2.9.0.post0",[56],{"id":1045,"slug":1046,"identity":1047,"label":1048,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1049,"versions":1050,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1052},"package:pypi:pytz","pytz-cbf1d95c","pypi:pytz","pytz",[367],[1051],"2025.1",[56],{"id":1054,"slug":1055,"identity":1056,"label":1057,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1058,"versions":1059,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1061},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[367],[1060],"6.0.2",[56],{"id":1063,"slug":1064,"identity":1065,"label":1066,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1067,"versions":1068,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1070},"package:pypi:referencing","referencing-b8d98ce1","pypi:referencing","referencing",[367],[1069],"0.36.2",[56],{"id":1072,"slug":1073,"identity":1074,"label":1075,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1076,"versions":1078,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1080},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[1077,306],"Apache-2.0 AND CNRI-Python",[1079],"2024.11.6",[56],{"id":1082,"slug":1083,"identity":1084,"label":1085,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1086,"versions":1087,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1089},"package:pypi:rpds-py","rpds-py-67c64be8","pypi:rpds-py","rpds-py",[367],[1088],"0.27.1",[56],{"id":1091,"slug":1092,"identity":1093,"label":1094,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1095,"versions":1096,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1098},"package:pypi:safetensors","safetensors-2a32c77a","pypi:safetensors","safetensors",[306],[1097],"0.5.3",[56],{"id":1100,"slug":1101,"identity":1102,"label":1103,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1104,"versions":1105,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1107},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[306],[1106],"1.15.2",[56],{"id":1109,"slug":1110,"identity":1111,"label":1112,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1113,"versions":1114,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1116},"package:pypi:seaborn","seaborn-1018de9a","pypi:seaborn","seaborn",[306],[1115],"0.13.2",[56],{"id":1118,"slug":1119,"identity":1120,"label":1121,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1122,"versions":1123,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1125},"package:pypi:shapely","shapely-1cd2f2ba","pypi:shapely","shapely",[286],[1124],"2.0.7",[56],{"id":1127,"slug":1128,"identity":1129,"label":1130,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1131,"versions":1132,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1134},"package:pypi:six","six-3c3888bd","pypi:six","six",[367],[1133],"1.17.0",[56],{"id":1136,"slug":1137,"identity":1138,"label":1139,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1140,"versions":1141,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1143},"package:pypi:smmap","smmap-943fc5aa","pypi:smmap","smmap",[286],[1142],"5.0.2",[56],{"id":1145,"slug":1146,"identity":1147,"label":1148,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1149,"versions":1150,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1151},"package:pypi:stack-data","stack-data-d640fe0e","pypi:stack-data","stack-data",[367],[888],[56],{"id":1153,"slug":1154,"identity":1155,"label":1156,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1157,"versions":1158,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1160},"package:pypi:streamlit-folium","streamlit-folium-e76fb4ea","pypi:streamlit-folium","streamlit-folium",[],[1159],"0.25.1",[56],{"id":1162,"slug":1163,"identity":1164,"label":1165,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1166,"versions":1167,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1169},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[306],[1168],"1.14.0",[56],{"id":1171,"slug":1172,"identity":1173,"label":1174,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1175,"versions":1176,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1178},"package:pypi:tenacity","tenacity-415454f8","pypi:tenacity","tenacity",[275],[1177],"9.1.2",[56],{"id":1180,"slug":1181,"identity":1182,"label":1183,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1184,"versions":1185,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1187},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[286],[1186],"3.6.0",[56],{"id":1189,"slug":1190,"identity":1191,"label":1192,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1193,"versions":1194,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1196},"package:pypi:timm","timm-4594fb75","pypi:timm","timm",[275],[1195],"1.0.15",[56],{"id":1198,"slug":1199,"identity":1200,"label":1201,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1202,"versions":1203,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1205},"package:pypi:toml","toml-490ac3c8","pypi:toml","toml",[367],[1204],"0.10.2",[56],{"id":1207,"slug":1208,"identity":1209,"label":1210,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1211,"versions":1212,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1214},"package:pypi:torchvision","torchvision-7f85cafa","pypi:torchvision","torchvision",[306],[1213],"0.24.1",[56],{"id":1216,"slug":1217,"identity":1218,"label":1219,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1220,"versions":1221,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1223},"package:pypi:traitlets","traitlets-52bd6ddb","pypi:traitlets","traitlets",[306],[1222],"5.14.3",[56],{"id":1225,"slug":1226,"identity":1227,"label":1228,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1229,"versions":1230,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1232},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[367],[1231],"3.3.0",[56],{"id":1234,"slug":1235,"identity":1236,"label":1237,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1238,"versions":1239,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1241},"package:pypi:types-pytz","types-pytz-327ed57f","pypi:types-pytz","types-pytz",[275],[1240],"2025.2.0.20250809",[56],{"id":1243,"slug":1244,"identity":1245,"label":1246,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1247,"versions":1249,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1251},"package:pypi:typing-extensions","typing-extensions-87d153eb","pypi:typing-extensions","typing-extensions",[1248,306],"PSF-2.0",[1250],"4.13.1",[56],{"id":1253,"slug":1254,"identity":1255,"label":1256,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1257,"versions":1258,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1259},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[275],[1051],[56],{"id":1261,"slug":1262,"identity":1263,"label":1264,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1265,"versions":1266,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1268},"package:pypi:watchdog","watchdog-55ddb444","pypi:watchdog","watchdog",[275],[1267],"6.0.0",[56],{"id":1270,"slug":1271,"identity":1272,"label":1273,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1274,"versions":1275,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1277},"package:pypi:wcwidth","wcwidth-038a8957","pypi:wcwidth","wcwidth",[367],[1276],"0.2.13",[56],{"id":1279,"slug":1280,"identity":1281,"label":1282,"aiRelevant":47,"provider":83,"advisoryCount":39,"licenseExpressions":1283,"versions":1284,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1286},"package:pypi:xyzservices","xyzservices-a1955a18","pypi:xyzservices","xyzservices",[286],[1285],"2025.4.0",[56],[1288,1329,1364,1391,1424,1455,1490,1533,1560,1587,1614,1644,1669,1699,1722,1758,1785,1814,1840,1869,1907,1931,1955,1977,2000,2036,2059,2083,2106,2136,2173,2201,2228,2254,2280,2303,2326,2359,2391,2421,2446,2487,2516,2539,2578,2607,2639,2671,2694,2719,2746,2774,2808,2834,2861,2891,2912,2944,2968,3022,3046,3078,3102,3133,3167,3206,3234,3257,3280,3305,3338,3366,3386,3409,3437,3471,3504,3531,3563,3593,3615,3653,3680,3705,3729,3758,3779,3800,3825,3846,3873,3900,3925,3949,3973,3998,4014,4040,4062,4088,4108,4145,4172,4204,4231,4258,4286,4309,4336,4366,4386,4420,4450,4470,4498,4525,4568,4588,4618,4670,4693,4718,4745,4769,4792,4824,4848,4875,4900,4926,4948,4968,4985,5004,5021,5042,5058,5073,5090,5105,5122,5139,5156,5170,5183,5196,5209,5222,5235,5248,5261,5284,5317],{"id":106,"slug":1289,"dossier":47,"summary":1290,"aliases":1291,"sourceIds":1294,"published":1295,"modified":1296,"checkedAt":7,"severity":1297,"references":1304,"versionKeys":1325,"packageCount":32,"repositoryCount":103},"ghsa-239g-whfq-7xj9-ede3fcd6","GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution",[1292,1293],"CVE-2026-87817","PYSEC-2026-3982",[106,1293],"2026-09-09T12:17:16.830Z","2026-09-30T23:45:04.022111787Z",[1298,1301],{"type":1299,"score":1300},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1302,"score":1303},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1305,1308,1311,1314,1316,1319,1321,1323],{"type":1306,"url":1307},"EVIDENCE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-239g-whfq-7xj9",{"type":1309,"url":1310},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-87817",{"type":1312,"url":1313},"WEB","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2218",{"type":1312,"url":1315},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fc7cf4d13b1ed0a2e70f2a1f3c6b4fc6c2652cf0b",{"type":1317,"url":1318},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython",{"type":1312,"url":1320},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.60",{"type":1312,"url":1322},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3982.yaml",{"type":1309,"url":1324},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-remote-code-execution-via-git-directory-impersonation",[1326,1327,1328],"pypi:gitpython@3.1.44","pypi:gitpython@3.1.45","pypi:gitpython@3.1.46",{"id":107,"slug":1330,"dossier":47,"summary":1331,"aliases":1332,"sourceIds":1335,"published":1336,"modified":1337,"checkedAt":7,"severity":1338,"references":1341,"versionKeys":1362,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1333,1334],"CVE-2024-39689","PYSEC-2024-230",[107,1334],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1339],{"type":1299,"score":1340},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1342,1344,1346,1349,1351,1353,1356,1358,1360],{"type":1309,"url":1343},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1309,"url":1345},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1347,"url":1348},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1317,"url":1350},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1312,"url":1352},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1354,"url":1355},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1312,"url":1357},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1309,"url":1359},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1309,"url":1361},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1363],"pypi:certifi@2024.6.2",{"id":108,"slug":1365,"dossier":47,"summary":1366,"aliases":1367,"sourceIds":1370,"published":1371,"modified":1372,"checkedAt":7,"severity":1373,"references":1380,"versionKeys":1390,"packageCount":32,"repositoryCount":103},"ghsa-284h-m62q-gf8w-da9acb0c","GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE",[1368,1369],"CVE-2026-78676","PYSEC-2026-3786",[108,1369],"2026-08-25T02:16:52.030Z","2026-09-08T19:00:06.885837775Z",[1374,1376,1378],{"type":1299,"score":1375},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1302,"score":1377},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1302,"score":1379},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1381,1383,1385,1386,1388],{"type":1306,"url":1382},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-284h-m62q-gf8w",{"type":1309,"url":1384},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78676",{"type":1317,"url":1318},{"type":1312,"url":1387},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3786.yaml",{"type":1309,"url":1389},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-config-injection",[1326,1327,1328],{"id":109,"slug":1392,"dossier":47,"summary":1393,"aliases":1394,"sourceIds":1397,"published":1398,"modified":1399,"checkedAt":7,"severity":1400,"references":1403,"versionKeys":1414,"packageCount":32,"repositoryCount":42},"ghsa-29pf-2h5f-8g72-1d83ebb4","HuggingFace transformers vulnerable to remote code execution",[1395,1396],"CVE-2026-4372","PYSEC-2026-2289",[109,1396],"2026-05-24T14:16:16.917Z","2026-09-10T03:50:45.254378086Z",[1401],{"type":1299,"score":1402},"CVSS:3.0\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1404,1406,1408,1410,1412],{"type":1309,"url":1405},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4372",{"type":1347,"url":1407},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fa7f8e7ff37d87d1a1a0c8cf607971c607741452f",{"type":1317,"url":1409},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers",{"type":1306,"url":1411},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F1f693a6e-6836-4b8b-a0bd-ca036fba8884",{"type":1309,"url":1413},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-29pf-2h5f-8g72",[1415,1416,1417,1418,1419,1420,1421,1422,1423],"pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6",{"id":110,"slug":1425,"dossier":47,"summary":1426,"aliases":1427,"sourceIds":1430,"published":1431,"modified":1432,"checkedAt":7,"severity":1433,"references":1436,"versionKeys":1454,"packageCount":32,"repositoryCount":103},"ghsa-2f96-g7mh-g2hx-dd7ec02d","GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist",[1428,1429],"CVE-2026-67325","PYSEC-2026-3836",[110,1429],"2026-07-21T19:43:43Z","2026-09-23T05:15:05.950374846Z",[1434],{"type":1299,"score":1435},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1437,1439,1441,1443,1445,1446,1448,1450,1452],{"type":1312,"url":1438},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",{"type":1309,"url":1440},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67325",{"type":1312,"url":1442},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2161",{"type":1312,"url":1444},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F56806080c1348749b07daa4a2024ce47b3cad285",{"type":1317,"url":1318},{"type":1312,"url":1447},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.51",{"type":1312,"url":1449},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-option-prefix-abbreviation",{"type":1317,"url":1451},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fgitpython",{"type":1309,"url":1453},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2f96-g7mh-g2hx",[1326,1327,1328],{"id":111,"slug":1456,"dossier":90,"summary":1457,"aliases":1458,"sourceIds":1461,"published":1462,"modified":1463,"checkedAt":7,"severity":1464,"references":1467,"versionKeys":1484,"packageCount":32,"repositoryCount":355},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1459,1460],"CVE-2025-66471","PYSEC-2026-1994",[111,1460],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1465],{"type":1302,"score":1466},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1468,1470,1472,1474,1476,1478,1480,1482],{"type":1312,"url":1469},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1309,"url":1471},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1347,"url":1473},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1312,"url":1475},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1309,"url":1477},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1312,"url":1479},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1317,"url":1481},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1317,"url":1483},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1485,1486,1487,1488,1489],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",{"id":112,"slug":1491,"dossier":47,"summary":1492,"aliases":1493,"sourceIds":1497,"published":1498,"modified":1499,"checkedAt":7,"severity":1500,"references":1507,"versionKeys":1529,"packageCount":32,"repositoryCount":385},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1494,1495,1496],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[112,1496],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1501,1503,1505],{"type":1299,"score":1502},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1302,"score":1504},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1299,"score":1506},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1508,1510,1513,1515,1517,1519,1521,1523,1525,1527],{"type":1309,"url":1509},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1511,"url":1512},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1511,"url":1514},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1312,"url":1516},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1317,"url":1518},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1312,"url":1520},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1511,"url":1522},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1309,"url":1524},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1309,"url":1526},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1309,"url":1528},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1530,1531,1532],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":113,"slug":1534,"dossier":47,"summary":1535,"aliases":1536,"sourceIds":1539,"published":1540,"modified":1541,"checkedAt":7,"severity":1542,"references":1545,"versionKeys":1559,"packageCount":32,"repositoryCount":385},"ghsa-37mw-44qp-f5jm-fb05555e","Transformers is vulnerable to ReDoS attack through its DonutProcessor class",[1537,1538],"CVE-2025-3933","PYSEC-2026-1977",[113,1538],"2025-07-11T12:30:32Z","2026-09-10T03:50:57.888142744Z",[1543],{"type":1299,"score":1544},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1546,1548,1550,1552,1553,1555,1557],{"type":1309,"url":1547},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3933",{"type":1312,"url":1549},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F37788",{"type":1312,"url":1551},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Febbe9b12dd75b69f92100d684c47f923ee262a93",{"type":1317,"url":1409},{"type":1312,"url":1554},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25282953-5827-4384-bb6f-5790d275721b",{"type":1317,"url":1556},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftransformers",{"type":1309,"url":1558},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-37mw-44qp-f5jm",[1415,1416,1417],{"id":114,"slug":1561,"dossier":47,"summary":1562,"aliases":1563,"sourceIds":1566,"published":1567,"modified":1568,"checkedAt":7,"severity":1569,"references":1573,"versionKeys":1586,"packageCount":32,"repositoryCount":355},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1564,1565],"CVE-2026-21441","PYSEC-2026-1996",[114,1565],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1570,1572],{"type":1299,"score":1571},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1302,"score":1466},[1574,1576,1578,1580,1581,1583,1584],{"type":1312,"url":1575},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1309,"url":1577},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1347,"url":1579},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1317,"url":1481},{"type":1312,"url":1582},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1317,"url":1483},{"type":1309,"url":1585},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1485,1486,1487,1488,1489],{"id":115,"slug":1588,"dossier":47,"summary":1589,"aliases":1590,"sourceIds":1593,"published":1594,"modified":1595,"checkedAt":7,"severity":1596,"references":1601,"versionKeys":1613,"packageCount":32,"repositoryCount":103},"ghsa-3f7w-8rr8-f37f-9cab61a6","GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read",[1591,1592],"CVE-2026-73620","PYSEC-2026-3949",[115,1592],"2026-08-03T20:09:56Z","2026-09-10T13:10:44.075529324Z",[1597,1599],{"type":1299,"score":1598},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1302,"score":1600},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1602,1604,1606,1608,1609,1611],{"type":1306,"url":1603},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3f7w-8rr8-f37f",{"type":1312,"url":1605},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2193",{"type":1312,"url":1607},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F3af0c2516c5e18c829da30338614688f6b69b49c",{"type":1317,"url":1318},{"type":1312,"url":1610},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.57",{"type":1309,"url":1612},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-and-read",[1326,1327,1328],{"id":116,"slug":1615,"dossier":47,"summary":1616,"aliases":1617,"sourceIds":1618,"published":1619,"modified":1620,"checkedAt":7,"severity":1621,"references":1623,"versionKeys":1636,"packageCount":32,"repositoryCount":42},"ghsa-3hv7-mjh2-fv65-5be6c7b0","Tornado: Unbounded query-string argument count allows event-loop-stalling DoS",[],[116],"2026-09-30T23:49:25Z","2026-10-01T00:00:04.690479804Z",[1622],{"type":1299,"score":1544},[1624,1626,1628,1630,1632,1634],{"type":1312,"url":1625},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3hv7-mjh2-fv65",{"type":1312,"url":1627},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3719",{"type":1312,"url":1629},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F03945136ea9746eccf61caf88edae39642e59c93",{"type":1312,"url":1631},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8a61dd6005f42733015160f3c23a2bcffe200542",{"type":1317,"url":1633},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado",{"type":1312,"url":1635},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.9",[1637,1638,1639,1640,1641,1642,1643],"pypi:tornado@6.4.2","pypi:tornado@6.5.1","pypi:tornado@6.5.2","pypi:tornado@6.5.4","pypi:tornado@6.5.5","pypi:tornado@6.5.7","pypi:tornado@6.5.8",{"id":117,"slug":1645,"dossier":47,"summary":1646,"aliases":1647,"sourceIds":1650,"published":1651,"modified":1652,"checkedAt":7,"severity":1653,"references":1658,"versionKeys":1668,"packageCount":32,"repositoryCount":103},"ghsa-3rp5-jjmw-4wv2-6d7352e6","GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)",[1648,1649],"CVE-2026-69097","PYSEC-2026-3981",[117,1649],"2026-07-24T16:22:02Z","2026-09-17T09:10:35.253135365Z",[1654,1656],{"type":1299,"score":1655},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1299,"score":1657},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1659,1661,1663,1664,1666],{"type":1306,"url":1660},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3rp5-jjmw-4wv2",{"type":1312,"url":1662},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed1b924f4e2d2ee7bab296df77b978af21853f1",{"type":1317,"url":1318},{"type":1312,"url":1665},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.53",{"type":1309,"url":1667},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-submodule-names",[1326,1327,1328],{"id":118,"slug":1670,"dossier":47,"summary":1671,"aliases":1672,"sourceIds":1675,"published":1676,"modified":1677,"checkedAt":7,"severity":1678,"references":1681,"versionKeys":1698,"packageCount":32,"repositoryCount":103},"ghsa-3wxw-xv34-2frg-c013ae2d","GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)",[1673,1674],"CVE-2026-78679","PYSEC-2026-3837",[118,1674],"2026-09-08T19:42:22Z","2026-09-23T05:15:05.925079070Z",[1679],{"type":1299,"score":1680},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1682,1684,1686,1688,1690,1691,1693,1695,1696],{"type":1312,"url":1683},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",{"type":1309,"url":1685},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78679",{"type":1312,"url":1687},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2208",{"type":1312,"url":1689},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1b0d2d9b91575f7db44ef4ff58ac37fc9335e5f6",{"type":1317,"url":1318},{"type":1312,"url":1692},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.59",{"type":1312,"url":1694},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-tagreference-create",{"type":1317,"url":1451},{"type":1309,"url":1697},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3wxw-xv34-2frg",[1326,1327,1328],{"id":119,"slug":1700,"dossier":47,"summary":1701,"aliases":1702,"sourceIds":1705,"published":1706,"modified":1707,"checkedAt":7,"severity":1708,"references":1711,"versionKeys":1721,"packageCount":32,"repositoryCount":66},"ghsa-3x9g-8vmp-wqvf-6d03bf5f","Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient",[1703,1704],"CVE-2026-49853","PYSEC-2026-3387",[119,1704],"2026-06-15T20:20:00Z","2026-09-10T03:50:55.306087854Z",[1709],{"type":1299,"score":1710},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[1712,1714,1715,1717,1719],{"type":1312,"url":1713},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1317,"url":1633},{"type":1317,"url":1716},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftornado",{"type":1309,"url":1718},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3x9g-8vmp-wqvf",{"type":1309,"url":1720},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49853",[1637,1638,1639,1640,1641],{"id":120,"slug":1723,"dossier":90,"summary":1724,"aliases":1725,"sourceIds":1729,"published":1730,"modified":1731,"checkedAt":7,"severity":1732,"references":1734,"versionKeys":1747,"packageCount":32,"repositoryCount":1757},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[1726,1727,1728],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[120,1728],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[1733],{"type":1299,"score":1571},[1735,1737,1739,1741,1743,1745],{"type":1306,"url":1736},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1309,"url":1738},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1347,"url":1740},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1312,"url":1742},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1317,"url":1744},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1309,"url":1746},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1748,1749,1750,1751,1752,1753,1754,1755,1756],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0",17,{"id":121,"slug":1759,"dossier":47,"summary":1760,"aliases":1761,"sourceIds":1764,"published":1765,"modified":1766,"checkedAt":7,"severity":1767,"references":1770,"versionKeys":1783,"packageCount":32,"repositoryCount":1784},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[1762,1763],"CVE-2025-50182","PYSEC-2026-1997",[121,1763],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[1768],{"type":1299,"score":1769},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1771,1773,1775,1777,1778,1780,1781],{"type":1312,"url":1772},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1309,"url":1774},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1347,"url":1776},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1317,"url":1481},{"type":1312,"url":1779},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1317,"url":1483},{"type":1309,"url":1782},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1485,1486,1487,1488],8,{"id":122,"slug":1786,"dossier":47,"summary":1787,"aliases":1788,"sourceIds":1791,"published":1792,"modified":1793,"checkedAt":7,"severity":1794,"references":1796,"versionKeys":1813,"packageCount":32,"repositoryCount":103},"ghsa-4gmw-gg2m-w46p-58f27cb8","GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree\u002Freset\u002Fmerge_tree enables arbitrary file overwrite",[1789,1790],"CVE-2026-76219","PYSEC-2026-3838",[122,1790],"2026-08-07T15:33:57Z","2026-09-10T12:25:42.767166279Z",[1795],{"type":1299,"score":1598},[1797,1799,1801,1803,1805,1806,1808,1810,1811],{"type":1312,"url":1798},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",{"type":1309,"url":1800},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76219",{"type":1312,"url":1802},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2204",{"type":1312,"url":1804},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F9b5dcaf85da5946dbf69dcd53f9edba08f760b32",{"type":1317,"url":1318},{"type":1312,"url":1807},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.58",{"type":1312,"url":1809},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-read-tree",{"type":1317,"url":1451},{"type":1309,"url":1812},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4gmw-gg2m-w46p",[1326,1327,1328],{"id":123,"slug":1815,"dossier":47,"summary":1816,"aliases":1817,"sourceIds":1820,"published":1821,"modified":1822,"checkedAt":7,"severity":1823,"references":1826,"versionKeys":1839,"packageCount":32,"repositoryCount":34},"ghsa-4w7r-h757-3r74-ca8973bc","Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer",[1818,1819],"CVE-2025-6921","PYSEC-2026-1980",[123,1819],"2025-09-23T15:31:09Z","2026-09-10T03:50:27.867584538Z",[1824],{"type":1299,"score":1825},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1827,1829,1831,1833,1834,1836,1837],{"type":1309,"url":1828},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6921",{"type":1312,"url":1830},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F47c34fba5c303576560cb29767efb452ff12b8be",{"type":1312,"url":1832},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fd37f7517972f67e3f2194c000ed0f87f064e5099",{"type":1317,"url":1409},{"type":1312,"url":1835},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F287d15a7-6e7c-45d2-8c05-11e305776f1f",{"type":1317,"url":1556},{"type":1309,"url":1838},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4w7r-h757-3r74",[1415,1416,1417,1418],{"id":124,"slug":1841,"dossier":90,"summary":1842,"aliases":1843,"sourceIds":1847,"published":1848,"modified":1849,"checkedAt":7,"severity":1850,"references":1853,"versionKeys":1868,"packageCount":32,"repositoryCount":1757},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[1844,1845,1846],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[124,1846],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[1851],{"type":1299,"score":1852},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[1854,1856,1858,1860,1862,1864,1866,1867],{"type":1306,"url":1855},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1309,"url":1857},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1347,"url":1859},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1347,"url":1861},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1347,"url":1863},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1312,"url":1865},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1317,"url":1744},{"type":1309,"url":1746},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":125,"slug":1870,"dossier":47,"summary":1871,"aliases":1872,"sourceIds":1875,"published":1876,"modified":1877,"checkedAt":7,"severity":1878,"references":1881,"versionKeys":1904,"packageCount":32,"repositoryCount":104},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[1873,1874],"CVE-2026-4539","PYSEC-2026-2987",[125,1874],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[1879,1880],{"type":1299,"score":1502},{"type":1302,"score":1504},[1882,1884,1886,1888,1890,1892,1894,1896,1898,1900,1902],{"type":1309,"url":1883},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1312,"url":1885},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1312,"url":1887},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1312,"url":1889},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1317,"url":1891},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1312,"url":1893},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1312,"url":1895},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1312,"url":1897},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1312,"url":1899},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1317,"url":1901},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1309,"url":1903},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[1905,1906],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",{"id":126,"slug":1908,"dossier":47,"summary":1909,"aliases":1910,"sourceIds":1913,"published":1914,"modified":1915,"checkedAt":7,"severity":1916,"references":1920,"versionKeys":1930,"packageCount":32,"repositoryCount":103},"ghsa-539m-9xh6-q6rr-c4575e3c","GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file \u002F --add-virtual-file, enabling arbitrary file read via Repo.archive()",[1911,1912],"CVE-2026-73619","PYSEC-2026-3948",[126,1912],"2026-08-03T20:14:28Z","2026-09-10T13:11:01.695990206Z",[1917,1918],{"type":1299,"score":1680},{"type":1302,"score":1919},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1921,1923,1924,1926,1927,1928],{"type":1306,"url":1922},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-539m-9xh6-q6rr",{"type":1312,"url":1605},{"type":1312,"url":1925},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F7a4f5dcb7bf3cbcbf6e438017efcdfe0bc0d36ca",{"type":1317,"url":1318},{"type":1312,"url":1610},{"type":1309,"url":1929},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-archive",[1326,1327,1328],{"id":127,"slug":1932,"dossier":47,"summary":1933,"aliases":1934,"sourceIds":1938,"published":1939,"modified":1940,"checkedAt":7,"severity":1941,"references":1944,"versionKeys":1954,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[1935,1936,1937],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[127,1937],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[1942,1943],{"type":1302,"score":1377},{"type":1299,"score":1375},[1945,1947,1949,1951,1953],{"type":1309,"url":1946},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1309,"url":1948},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1312,"url":1950},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1312,"url":1952},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1317,"url":1518},[1530],{"id":128,"slug":1956,"dossier":47,"summary":1957,"aliases":1958,"sourceIds":1960,"published":1961,"modified":1962,"checkedAt":7,"severity":1963,"references":1966,"versionKeys":1976,"packageCount":32,"repositoryCount":103},"ghsa-59cr-6r3x-644w-a8ec12fb","GitPython submodule update path traversal can write outside the repository",[1959],"CVE-2026-100689",[128],"2026-09-30T23:47:12Z","2026-10-01T00:00:05.754996881Z",[1964],{"type":1302,"score":1965},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1967,1969,1971,1973,1974],{"type":1312,"url":1968},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-59cr-6r3x-644w",{"type":1312,"url":1970},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2225",{"type":1312,"url":1972},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1ed0ebc2f2e74d979cdc367a4864a7731fdcc093",{"type":1317,"url":1318},{"type":1312,"url":1975},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.62",[1326,1327,1328],{"id":129,"slug":1978,"dossier":47,"summary":1979,"aliases":1980,"sourceIds":1983,"published":1984,"modified":1985,"checkedAt":7,"severity":1986,"references":1988,"versionKeys":1999,"packageCount":32,"repositoryCount":34},"ghsa-59p9-h35m-wg4g-68657c65","Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer",[1981,1982],"CVE-2025-6638","PYSEC-2026-1981",[129,1982],"2025-09-12T12:30:23Z","2026-09-10T03:50:58.113501288Z",[1987],{"type":1299,"score":1825},[1989,1991,1992,1993,1994,1996,1997],{"type":1309,"url":1990},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6638",{"type":1312,"url":1830},{"type":1312,"url":1832},{"type":1317,"url":1409},{"type":1312,"url":1995},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F6a6c933f-9ce8-4ded-8b3b-2c1444c61f36",{"type":1317,"url":1556},{"type":1309,"url":1998},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59p9-h35m-wg4g",[1415,1416,1417,1418],{"id":130,"slug":2001,"dossier":47,"summary":2002,"aliases":2003,"sourceIds":2007,"published":2008,"modified":2009,"checkedAt":7,"severity":2010,"references":2014,"versionKeys":2031,"packageCount":32,"repositoryCount":34},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[2004,2005,2006],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[130,2006],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[2011,2013],{"type":1302,"score":2012},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1299,"score":1435},[2015,2017,2019,2021,2023,2025,2027,2029],{"type":1306,"url":2016},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1309,"url":2018},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1511,"url":2020},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1347,"url":2022},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1312,"url":2024},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1317,"url":2026},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1312,"url":2028},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1354,"url":2030},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2032,2033,2034,2035],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":131,"slug":2037,"dossier":90,"summary":2038,"aliases":2039,"sourceIds":2043,"published":2044,"modified":2045,"checkedAt":7,"severity":2046,"references":2048,"versionKeys":2058,"packageCount":32,"repositoryCount":1757},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2040,2041,2042],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[131,2042],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2047],{"type":1299,"score":1571},[2049,2051,2053,2054,2056,2057],{"type":1306,"url":2050},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1309,"url":2052},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1347,"url":1740},{"type":1312,"url":2055},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1317,"url":1744},{"type":1309,"url":1746},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":132,"slug":2060,"dossier":47,"summary":2061,"aliases":2062,"sourceIds":2066,"published":2067,"modified":2068,"checkedAt":7,"severity":2069,"references":2073,"versionKeys":2081,"packageCount":32,"repositoryCount":2082},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2063,2064,2065],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[132,2065],"2026-05-04T20:18:27Z","2026-09-10T03:51:04.701007027Z",[2070,2071],{"type":1299,"score":1506},{"type":1302,"score":2072},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2074,2076,2078,2079],{"type":1309,"url":2075},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1309,"url":2077},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1317,"url":1744},{"type":1309,"url":2080},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1751,1752,1753,1754,1755],12,{"id":133,"slug":2084,"dossier":47,"summary":2085,"aliases":2086,"sourceIds":2089,"published":2090,"modified":2091,"checkedAt":7,"severity":2092,"references":2095,"versionKeys":2105,"packageCount":32,"repositoryCount":103},"ghsa-5xxx-qhh7-9287-87d91b3e","GitPython: Incomplete unsafe_git_revision_options denylist omits --contents\u002F-S, enabling arbitrary file read via Repo.blame()",[2087,2088],"CVE-2026-78678","PYSEC-2026-3788",[133,2088],"2026-08-25T02:16:52.313Z","2026-09-08T19:00:06.904435463Z",[2093,2094],{"type":1299,"score":1680},{"type":1302,"score":1919},[2096,2098,2100,2101,2103],{"type":1306,"url":2097},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-5xxx-qhh7-9287",{"type":1309,"url":2099},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78678",{"type":1317,"url":1318},{"type":1312,"url":2102},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3788.yaml",{"type":1309,"url":2104},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-repo-blame",[1326,1327,1328],{"id":134,"slug":2107,"dossier":90,"summary":2108,"aliases":2109,"sourceIds":2113,"published":2114,"modified":2115,"checkedAt":7,"severity":2116,"references":2119,"versionKeys":2135,"packageCount":32,"repositoryCount":1757},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2110,2111,2112],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[134,2112],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2117],{"type":1302,"score":2118},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2120,2122,2124,2126,2128,2129,2131,2133],{"type":1312,"url":2121},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1309,"url":2123},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1312,"url":2125},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1312,"url":2127},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1317,"url":1744},{"type":1312,"url":2130},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1317,"url":2132},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1309,"url":2134},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":135,"slug":2137,"dossier":47,"summary":2138,"aliases":2139,"sourceIds":2142,"published":2143,"modified":2144,"checkedAt":7,"severity":2145,"references":2148,"versionKeys":2171,"packageCount":32,"repositoryCount":404},"ghsa-6497-prx7-gpmq-2b8ee85d","geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure",[2140,2141],"CVE-2025-69662","PYSEC-2026-62",[135,2141],"2026-01-30T19:16:11.967Z","2026-06-10T17:01:18.172032507Z",[2146],{"type":1299,"score":2147},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:H\u002FI:N\u002FA:N",[2149,2151,2153,2155,2157,2159,2161,2163,2165,2167,2169],{"type":1309,"url":2150},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69662",{"type":1312,"url":2152},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fissues\u002F3679",{"type":1347,"url":2154},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fpull\u002F3681",{"type":1312,"url":2156},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Fcommit\u002F6aa8ef14ffdee4ba1044349ab948e1a1fbfaf419",{"type":1312,"url":2158},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas",{"type":1317,"url":2160},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas",{"type":1312,"url":2162},"https:\u002F\u002Fgithub.com\u002Fgeopandas\u002Fgeopandas\u002Freleases\u002Ftag\u002Fv1.1.2",{"type":1312,"url":2164},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgeopandas\u002FPYSEC-2026-62.yaml",{"type":1312,"url":2166},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00025.html",{"type":1306,"url":2168},"https:\u002F\u002Faydinnyunus.github.io\u002F2025\u002F12\u002F27\u002Fsql-injection-geopandas\u002F",{"type":1309,"url":2170},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6497-prx7-gpmq",[2172],"pypi:geopandas@1.0.1",{"id":136,"slug":2174,"dossier":90,"summary":2175,"aliases":2176,"sourceIds":2179,"published":2180,"modified":2181,"checkedAt":7,"severity":2182,"references":2186,"versionKeys":2195,"packageCount":32,"repositoryCount":2200},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2177,2178],"CVE-2026-45409","PYSEC-2026-215",[136,2178],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2183,2184],{"type":1299,"score":1544},{"type":1302,"score":2185},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2187,2189,2191,2193],{"type":1309,"url":2188},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1309,"url":2190},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1317,"url":2192},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1312,"url":2194},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2196,2197,2198,2199],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",21,{"id":137,"slug":2202,"dossier":47,"summary":2203,"aliases":2204,"sourceIds":2207,"published":2208,"modified":2209,"checkedAt":7,"severity":2210,"references":2215,"versionKeys":2227,"packageCount":32,"repositoryCount":42},"ghsa-69w3-r845-3855-1b4edc28","HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class",[2205,2206],"CVE-2026-1839","PYSEC-2026-2288",[137,2206],"2026-04-07T06:16:41.490Z","2026-09-10T03:50:43.300048881Z",[2211,2213],{"type":1299,"score":2212},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:H",{"type":1299,"score":2214},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2216,2218,2220,2221,2223,2225],{"type":1309,"url":2217},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1839",{"type":1347,"url":2219},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396",{"type":1317,"url":1409},{"type":1312,"url":2222},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Freleases\u002Ftag\u002Fv5.0.0rc3",{"type":1306,"url":2224},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c77bb97-e493-493d-9a88-c57f5c536485",{"type":1309,"url":2226},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69w3-r845-3855",[1415,1416,1417,1418,1419,1420,1421,1422,1423],{"id":138,"slug":2229,"dossier":47,"summary":2230,"aliases":2231,"sourceIds":2234,"published":2235,"modified":2236,"checkedAt":7,"severity":2237,"references":2241,"versionKeys":2253,"packageCount":32,"repositoryCount":103},"ghsa-6p8h-3wgx-97gf-635a010c","GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks",[2232,2233],"CVE-2026-73623","PYSEC-2026-3952",[138,2233],"2026-07-24T16:42:09Z","2026-09-10T13:11:03.995690741Z",[2238,2240],{"type":1299,"score":2239},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1299,"score":1435},[2242,2244,2246,2248,2249,2251],{"type":1306,"url":2243},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-6p8h-3wgx-97gf",{"type":1312,"url":2245},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2180",{"type":1312,"url":2247},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fffcb5359e87619f4fe4a70a4aff5f08c5580ba97",{"type":1317,"url":1318},{"type":1312,"url":2250},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.54",{"type":1309,"url":2252},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-template",[1326,1327,1328],{"id":139,"slug":2255,"dossier":90,"summary":2256,"aliases":2257,"sourceIds":2261,"published":2262,"modified":2263,"checkedAt":7,"severity":2264,"references":2266,"versionKeys":2279,"packageCount":32,"repositoryCount":1757},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[2258,2259,2260],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[139,2260],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[2265],{"type":1299,"score":1571},[2267,2269,2271,2273,2275,2277,2278],{"type":1306,"url":2268},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1309,"url":2270},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1347,"url":2272},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1347,"url":2274},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1312,"url":2276},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1317,"url":1744},{"type":1309,"url":2130},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":140,"slug":2281,"dossier":47,"summary":2282,"aliases":2283,"sourceIds":2286,"published":2287,"modified":2288,"checkedAt":7,"severity":2289,"references":2291,"versionKeys":2302,"packageCount":32,"repositoryCount":32},"ghsa-6rvg-6v2m-4j46-e04ee614","Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[2284,2285],"CVE-2024-12720","PYSEC-2026-1982",[140,2285],"2025-03-20T12:32:43Z","2026-08-13T20:11:58.209202163Z",[2290],{"type":1299,"score":1825},[2292,2294,2296,2297,2299,2300],{"type":1309,"url":2293},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-12720",{"type":1312,"url":2295},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fdeac971c469bcbb182c2e52da0b82fb3bf54cccf",{"type":1317,"url":1409},{"type":1312,"url":2298},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F4bed1214-7835-4252-a853-22bbad891f98",{"type":1317,"url":1556},{"type":1309,"url":2301},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6rvg-6v2m-4j46",[1415],{"id":141,"slug":2304,"dossier":47,"summary":2305,"aliases":2306,"sourceIds":2309,"published":2310,"modified":2311,"checkedAt":7,"severity":2312,"references":2317,"versionKeys":2325,"packageCount":32,"repositoryCount":103},"ghsa-7545-fcxq-7j24-84dd19fd","GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository",[2307,2308],"CVE-2026-44243","PYSEC-2026-2162",[141,2308],"2026-05-06T19:38:48Z","2026-09-10T03:50:45.903378498Z",[2313,2315],{"type":1299,"score":2314},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1302,"score":2316},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[2318,2320,2322,2323],{"type":1306,"url":2319},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7545-fcxq-7j24",{"type":1309,"url":2321},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44243",{"type":1317,"url":1318},{"type":1347,"url":2324},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.48",[1326,1327,1328],{"id":142,"slug":2327,"dossier":47,"summary":2328,"aliases":2329,"sourceIds":2332,"published":2333,"modified":2334,"checkedAt":7,"severity":2335,"references":2338,"versionKeys":2351,"packageCount":32,"repositoryCount":2358},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[2330,2331],"CVE-2025-66034","PYSEC-2026-1389",[142,2331],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[2336],{"type":1299,"score":2337},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[2339,2341,2343,2345,2347,2349],{"type":1312,"url":2340},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1309,"url":2342},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1312,"url":2344},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1317,"url":2346},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1317,"url":2348},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1309,"url":2350},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[2352,2353,2354,2355,2356,2357],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",7,{"id":143,"slug":2360,"dossier":47,"summary":2361,"aliases":2362,"sourceIds":2365,"published":2366,"modified":2367,"checkedAt":7,"severity":2368,"references":2375,"versionKeys":2390,"packageCount":32,"repositoryCount":103},"ghsa-7833-fr7j-v32q-fd003872","GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)",[2363,2364],"CVE-2026-78675","PYSEC-2026-3785",[143,2364],"2026-08-25T02:16:51.887Z","2026-09-23T05:15:05.931147061Z",[2369,2371,2373],{"type":1299,"score":2370},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1302,"score":2372},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1299,"score":2374},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2376,2378,2380,2382,2384,2385,2386,2388],{"type":1306,"url":2377},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-7833-fr7j-v32q",{"type":1309,"url":2379},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78675",{"type":1312,"url":2381},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2211",{"type":1312,"url":2383},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fef7568e3b317ce617eacda39b8b54dcdff8c3b5c",{"type":1317,"url":1318},{"type":1312,"url":1692},{"type":1312,"url":2387},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3785.yaml",{"type":1309,"url":2389},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-local-file-content-disclosure-via-gitmodules",[1326,1327,1328],{"id":144,"slug":2392,"dossier":47,"summary":2393,"aliases":2394,"sourceIds":2398,"published":2399,"modified":2400,"checkedAt":7,"severity":2401,"references":2408,"versionKeys":2420,"packageCount":32,"repositoryCount":66},"ghsa-78cv-mqj4-43f7-2021f695","Tornado has incomplete validation of cookie attributes",[2395,2396,2397],"CVE-2026-35536","GHSA-fqwm-6jpj-5wxc","PYSEC-2026-2287",[144,2396,2397],"2026-03-11T22:17:00Z","2026-09-10T03:50:44.255695398Z",[2402,2404,2406],{"type":1299,"score":2403},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",{"type":1299,"score":2405},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1299,"score":2407},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2409,2411,2413,2414,2416,2418],{"type":1309,"url":2410},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-78cv-mqj4-43f7",{"type":1312,"url":2412},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F24a2d96ea115f663b223887deb0060f13974c104",{"type":1317,"url":1633},{"type":1312,"url":2415},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.5",{"type":1309,"url":2417},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-35536",{"type":1309,"url":2419},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fqwm-6jpj-5wxc",[1637,1638,1639,1640],{"id":145,"slug":2422,"dossier":47,"summary":2423,"aliases":2424,"sourceIds":2427,"published":2428,"modified":2429,"checkedAt":7,"severity":2430,"references":2432,"versionKeys":2445,"packageCount":32,"repositoryCount":404},"ghsa-7cx3-6m66-7c5m-cde5125c","Tornado vulnerable to excessive logging caused by malformed multipart form data",[2425,2426],"CVE-2025-47287","PYSEC-2026-1974",[145,2426],"2025-05-16T14:12:40Z","2026-09-10T03:50:24.284224963Z",[2431],{"type":1299,"score":1571},[2433,2435,2437,2439,2440,2442,2443],{"type":1312,"url":2434},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",{"type":1309,"url":2436},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47287",{"type":1312,"url":2438},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fb39b892bf78fe8fea01dd45199aa88307e7162f3",{"type":1317,"url":1633},{"type":1312,"url":2441},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00038.html",{"type":1317,"url":1716},{"type":1309,"url":2444},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7cx3-6m66-7c5m",[1637],{"id":146,"slug":2447,"dossier":47,"summary":2448,"aliases":2449,"sourceIds":2452,"published":2453,"modified":2454,"checkedAt":7,"severity":2455,"references":2458,"versionKeys":2475,"packageCount":32,"repositoryCount":2486},"ghsa-7gcm-g887-7qv7-55bb9ff1","protobuf affected by a JSON recursion depth bypass",[2450,2451],"CVE-2026-0994","PYSEC-2026-1805",[146,2451],"2026-01-23T15:31:35Z","2026-09-10T03:50:32.795512159Z",[2456],{"type":1302,"score":2457},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:L",[2459,2461,2463,2465,2467,2469,2471,2473],{"type":1309,"url":2460},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-0994",{"type":1312,"url":2462},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fissues\u002F25070",{"type":1312,"url":2464},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fpull\u002F25239",{"type":1312,"url":2466},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F5ebddcb1bcbe51d1fe323baa145e85f4f23128cf",{"type":1312,"url":2468},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002Fd2b001626d137c62dfee6c88c87324102531868b",{"type":1317,"url":2470},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf",{"type":1317,"url":2472},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fprotobuf",{"type":1309,"url":2474},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7gcm-g887-7qv7",[2476,2477,2478,2479,2480,2481,2482,2483,2484,2485],"pypi:protobuf@4.25.7","pypi:protobuf@4.25.8","pypi:protobuf@5.29.3","pypi:protobuf@5.29.4","pypi:protobuf@6.31.1","pypi:protobuf@6.32.0","pypi:protobuf@6.32.1","pypi:protobuf@6.33.0","pypi:protobuf@6.33.1","pypi:protobuf@6.33.4",13,{"id":147,"slug":2488,"dossier":47,"summary":2489,"aliases":2490,"sourceIds":2493,"published":2494,"modified":2495,"checkedAt":7,"severity":2496,"references":2501,"versionKeys":2512,"packageCount":32,"repositoryCount":385},"ghsa-7p48-42j8-8846-584b0522","Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)",[2491,2492],"CVE-2026-33682","PYSEC-2026-2285",[147,2492],"2026-03-25T21:20:52Z","2026-07-13T07:26:25.253864212Z",[2497,2499],{"type":1299,"score":2498},"CVSS:3.1\u002FAV:A\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N",{"type":1299,"score":2500},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[2502,2504,2506,2508,2510],{"type":1309,"url":2503},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fsecurity\u002Fadvisories\u002FGHSA-7p48-42j8-8846",{"type":1309,"url":2505},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-33682",{"type":1347,"url":2507},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002F23692ca70b2f2ac720c72d1feb4f190c9d6eed76",{"type":1317,"url":2509},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit",{"type":1309,"url":2511},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Freleases\u002Ftag\u002F1.54.0",[2513,2514,2515],"pypi:streamlit@1.49.0","pypi:streamlit@1.49.1","pypi:streamlit@1.51.0",{"id":148,"slug":2517,"dossier":47,"summary":2518,"aliases":2519,"sourceIds":2521,"published":2522,"modified":2523,"checkedAt":7,"severity":2524,"references":2526,"versionKeys":2538,"packageCount":32,"repositoryCount":365},"ghsa-8423-8fgw-73vq-142b238e","tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)",[2520],"CVE-2026-91990",[148],"2026-09-01T20:17:38Z","2026-09-16T03:56:01.992806508Z",[2525],{"type":1302,"score":2185},[2527,2529,2531,2533,2535,2536],{"type":1312,"url":2528},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-8423-8fgw-73vq",{"type":1312,"url":2530},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3704",{"type":1312,"url":2532},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fde85b3f87446e323e881bbaa3d5a74f4b76e5f05",{"type":1312,"url":2534},"https:\u002F\u002Fgist.github.com\u002Fafldl\u002F649861f25d39b53b7edbe0298e171617",{"type":1317,"url":1633},{"type":1312,"url":2537},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.8",[1637,1638,1639,1640,1641,1642],{"id":149,"slug":2540,"dossier":47,"summary":2541,"aliases":2542,"sourceIds":2546,"published":2547,"modified":2548,"checkedAt":7,"severity":2549,"references":2553,"versionKeys":2575,"packageCount":32,"repositoryCount":1784},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[2543,2544,2545],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[149,2545],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[2550,2551],{"type":1299,"score":1502},{"type":1302,"score":2552},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2554,2556,2558,2560,2562,2564,2565,2567,2569,2571,2573],{"type":1309,"url":2555},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1312,"url":2557},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1312,"url":2559},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1312,"url":2561},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1312,"url":2563},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1317,"url":1518},{"type":1312,"url":2566},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1312,"url":2568},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1312,"url":2570},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1317,"url":2572},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1309,"url":2574},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1530,1531,1532,2576,2577],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu",{"id":150,"slug":2579,"dossier":90,"summary":2580,"aliases":2581,"sourceIds":2583,"published":2584,"modified":2585,"checkedAt":7,"severity":2586,"references":2589,"versionKeys":2603,"packageCount":32,"repositoryCount":2606},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[2582],"CVE-2026-97687",[150],"2026-09-30T14:46:04Z","2026-09-30T15:00:05.369237042Z",[2587],{"type":1302,"score":2588},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2590,2592,2594,2596,2598,2600,2601],{"type":1312,"url":2591},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1309,"url":2593},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1312,"url":2595},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1312,"url":2597},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1312,"url":2599},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1317,"url":1481},{"type":1312,"url":2602},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",[1485,1486,1487,1488,1489,2604,2605],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",22,{"id":151,"slug":2608,"dossier":47,"summary":2609,"aliases":2610,"sourceIds":2613,"published":2614,"modified":2615,"checkedAt":7,"severity":2616,"references":2623,"versionKeys":2638,"packageCount":32,"repositoryCount":103},"ghsa-8mcc-hrx5-hvxc-9da62a9f","GitPython: clone_from()\u002Fclone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination",[2611,2612],"CVE-2026-78677","PYSEC-2026-3787",[151,2612],"2026-08-25T02:16:52.173Z","2026-09-08T19:00:06.914140693Z",[2617,2619,2621],{"type":1299,"score":2618},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1302,"score":2620},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1302,"score":2622},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2624,2626,2628,2630,2632,2633,2634,2636],{"type":1306,"url":2625},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-8mcc-hrx5-hvxc",{"type":1309,"url":2627},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-78677",{"type":1312,"url":2629},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2210",{"type":1312,"url":2631},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fb68afff45af0f49e79a3e2d2162018986b37ad5d",{"type":1317,"url":1318},{"type":1312,"url":1692},{"type":1312,"url":2635},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3787.yaml",{"type":1309,"url":2637},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-separate-git-dir",[1326,1327,1328],{"id":152,"slug":2640,"dossier":47,"summary":2641,"aliases":2642,"sourceIds":2645,"published":2646,"modified":2647,"checkedAt":7,"severity":2648,"references":2651,"versionKeys":2670,"packageCount":32,"repositoryCount":385},"ghsa-8qvm-5x2c-j2w7-8a075519","protobuf-python has a potential Denial of Service issue",[2643,2644],"CVE-2025-4565","PYSEC-2026-1806",[152,2644],"2025-06-16T16:02:58Z","2026-09-10T03:50:25.255076549Z",[2649],{"type":1302,"score":2650},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2652,2654,2656,2658,2660,2661,2663,2665,2667,2668],{"type":1312,"url":2653},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-735f-pc8j-v9w8",{"type":1312,"url":2655},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fsecurity\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",{"type":1309,"url":2657},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-4565",{"type":1312,"url":2659},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fcommit\u002F17838beda2943d08b8a9d4df5b68f5f04f26d901",{"type":1317,"url":2470},{"type":1312,"url":2662},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fdecoder_test.py#L87-L98",{"type":1312,"url":2664},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Fblob\u002Fmain\u002Fpython\u002Fgoogle\u002Fprotobuf\u002Finternal\u002Fmessage_test.py#L1436-L1478",{"type":1312,"url":2666},"https:\u002F\u002Fgithub.com\u002Fprotocolbuffers\u002Fprotobuf\u002Ftree\u002Fmain\u002Fpython#implementation-backends",{"type":1317,"url":2472},{"type":1309,"url":2669},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8qvm-5x2c-j2w7",[2476,2478,2479],{"id":153,"slug":2672,"dossier":90,"summary":2673,"aliases":2674,"sourceIds":2678,"published":2679,"modified":2680,"checkedAt":7,"severity":2681,"references":2683,"versionKeys":2693,"packageCount":32,"repositoryCount":1757},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[2675,2676,2677],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[153,2677],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[2682],{"type":1299,"score":1571},[2684,2686,2688,2689,2691,2692],{"type":1306,"url":2685},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1309,"url":2687},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1347,"url":1740},{"type":1312,"url":2690},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1317,"url":1744},{"type":1309,"url":1746},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":154,"slug":2695,"dossier":47,"summary":2696,"aliases":2697,"sourceIds":2700,"published":2701,"modified":2702,"checkedAt":7,"severity":2703,"references":2705,"versionKeys":2718,"packageCount":32,"repositoryCount":34},"ghsa-9356-575x-2w9m-908a1f8c","Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[2698,2699],"CVE-2025-5197","PYSEC-2026-1983",[154,2699],"2025-08-06T12:31:20Z","2026-09-10T03:50:26.988216861Z",[2704],{"type":1299,"score":1825},[2706,2708,2710,2712,2713,2715,2716],{"type":1309,"url":2707},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-5197",{"type":1312,"url":2709},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F701caef704e356dc2f9331cc3fd5df0eccb4720a",{"type":1312,"url":2711},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F944b56000be5e9b61af8301aa340838770ad8a0b",{"type":1317,"url":1409},{"type":1312,"url":2714},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3f8b3fd0-166b-46e7-b60f-60dd9d2678bf",{"type":1317,"url":1556},{"type":1309,"url":2717},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9356-575x-2w9m",[1415,1416,1417,1418],{"id":155,"slug":2720,"dossier":47,"summary":2721,"aliases":2722,"sourceIds":2725,"published":2726,"modified":2727,"checkedAt":7,"severity":2728,"references":2731,"versionKeys":2745,"packageCount":32,"repositoryCount":103},"ghsa-94p4-4cq8-9g67-9a288a09","GitPython: Environment-variable exfiltration via Repo.create_remote() \u002F Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)",[2723,2724],"CVE-2026-73622","PYSEC-2026-3951",[155,2724],"2026-07-24T21:45:16Z","2026-09-24T14:45:07.411775302Z",[2729,2730],{"type":1299,"score":2618},{"type":1302,"score":2622},[2732,2734,2736,2738,2739,2741,2743],{"type":1306,"url":2733},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-94p4-4cq8-9g67",{"type":1312,"url":2735},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F863417457a0633db7ea5aed4fd01e0b291a41162",{"type":1347,"url":2737},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F8ac5a30519b6f4af85398b9b9d7064ff4d452da2",{"type":1317,"url":1318},{"type":1312,"url":2740},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.55",{"type":1312,"url":2742},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3951.yaml",{"type":1309,"url":2744},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-remote-add",[1326,1327,1328],{"id":156,"slug":2747,"dossier":47,"summary":2748,"aliases":2749,"sourceIds":2752,"published":2753,"modified":2754,"checkedAt":7,"severity":2755,"references":2757,"versionKeys":2773,"packageCount":32,"repositoryCount":103},"ghsa-956x-8gvw-wg5v-f5d32b2d","GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` \u002F `Repo.blame()`",[2750,2751],"CVE-2026-67323","PYSEC-2026-3839",[156,2751],"2026-07-21T20:10:06Z","2026-09-10T12:25:39.217544351Z",[2756],{"type":1299,"score":2370},[2758,2760,2762,2764,2766,2767,2768,2770,2771],{"type":1312,"url":2759},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",{"type":1309,"url":2761},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67323",{"type":1312,"url":2763},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2163",{"type":1312,"url":2765},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F701ce32fe5ba8cb622c0e0342a376a6beb47d738",{"type":1317,"url":1318},{"type":1312,"url":1447},{"type":1312,"url":2769},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-injection-via-unguarded-git-options",{"type":1317,"url":1451},{"type":1309,"url":2772},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-956x-8gvw-wg5v",[1326,1327,1328],{"id":157,"slug":2775,"dossier":47,"summary":2776,"aliases":2777,"sourceIds":2780,"published":2781,"modified":2782,"checkedAt":7,"severity":2783,"references":2786,"versionKeys":2805,"packageCount":32,"repositoryCount":1784},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[2778,2779],"CVE-2024-47081","PYSEC-2026-1872",[157,2779],"2025-06-09T19:06:08Z","2026-09-10T03:50:25.139398550Z",[2784],{"type":1299,"score":2785},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[2787,2789,2791,2793,2795,2797,2799,2801,2803],{"type":1312,"url":2788},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1309,"url":2790},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1312,"url":2792},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1347,"url":2794},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1317,"url":2796},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1312,"url":2798},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1312,"url":2800},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",{"type":1317,"url":2802},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1309,"url":2804},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",[2806,2807],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":158,"slug":2809,"dossier":90,"summary":2810,"aliases":2811,"sourceIds":2815,"published":2816,"modified":2817,"checkedAt":7,"severity":2818,"references":2820,"versionKeys":2833,"packageCount":32,"repositoryCount":1757},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[2812,2813,2814],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[158,2814],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[2819],{"type":1299,"score":1571},[2821,2823,2825,2827,2829,2831,2832],{"type":1306,"url":2822},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1309,"url":2824},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1347,"url":2826},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1347,"url":2828},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1312,"url":2830},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1317,"url":1744},{"type":1309,"url":2130},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":159,"slug":2835,"dossier":47,"summary":2836,"aliases":2837,"sourceIds":2840,"published":2841,"modified":2842,"checkedAt":7,"severity":2843,"references":2845,"versionKeys":2860,"packageCount":32,"repositoryCount":103},"ghsa-9rj7-rf2p-w77r-996a0359","GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks",[2838,2839],"CVE-2026-76218","PYSEC-2026-3840",[159,2839],"2026-08-07T15:36:43Z","2026-09-10T12:25:55.324487522Z",[2844],{"type":1299,"score":2239},[2846,2848,2850,2851,2853,2854,2855,2857,2858],{"type":1312,"url":2847},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",{"type":1309,"url":2849},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76218",{"type":1312,"url":1802},{"type":1312,"url":2852},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fd9ddb55bdc66",{"type":1317,"url":1318},{"type":1312,"url":1807},{"type":1312,"url":2856},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-repo-init",{"type":1317,"url":1451},{"type":1309,"url":2859},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9rj7-rf2p-w77r",[1326,1327,1328],{"id":160,"slug":2862,"dossier":47,"summary":2863,"aliases":2864,"sourceIds":2867,"published":2868,"modified":2869,"checkedAt":7,"severity":2870,"references":2873,"versionKeys":2890,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[2865,2866],"CVE-2024-35195","PYSEC-2026-1873",[160,2866],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[2871],{"type":1299,"score":2872},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[2874,2876,2878,2880,2882,2883,2885,2887,2888],{"type":1312,"url":2875},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1309,"url":2877},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1312,"url":2879},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1347,"url":2881},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1317,"url":2796},{"type":1312,"url":2884},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1312,"url":2886},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1317,"url":2802},{"type":1309,"url":2889},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[2806],{"id":161,"slug":2892,"dossier":47,"summary":2893,"aliases":2894,"sourceIds":2895,"published":2896,"modified":2897,"checkedAt":7,"severity":2898,"references":2901,"versionKeys":2911,"packageCount":32,"repositoryCount":42},"ghsa-c2m8-h5v5-343r-dd3a7510","Tornado: StaticFileHandler follows symlinks outside static root (path traversal)",[],[161],"2026-09-30T23:48:55Z","2026-10-01T00:00:05.755450749Z",[2899],{"type":1302,"score":2900},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2902,2904,2905,2907,2909,2910],{"type":1312,"url":2903},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c2m8-h5v5-343r",{"type":1312,"url":1627},{"type":1312,"url":2906},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F437ab5f76565403b3403438d2e555d11f8128d32",{"type":1312,"url":2908},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Ff9f50b8bab265a2abf9f2415a3d2da6264a5450b",{"type":1317,"url":1633},{"type":1312,"url":1635},[1637,1638,1639,1640,1641,1642,1643],{"id":162,"slug":2913,"dossier":47,"summary":2914,"aliases":2915,"sourceIds":2919,"published":2920,"modified":2921,"checkedAt":7,"severity":2922,"references":2927,"versionKeys":2943,"packageCount":32,"repositoryCount":404},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[2916,2917,2918],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[162],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[2923,2925],{"type":1299,"score":2924},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1302,"score":2926},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2928,2930,2932,2934,2935,2937,2939,2941],{"type":1309,"url":2929},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1312,"url":2931},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1312,"url":2933},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1317,"url":1518},{"type":1312,"url":2936},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1312,"url":2938},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1312,"url":2940},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1312,"url":2942},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1530,1531],{"id":163,"slug":2945,"dossier":47,"summary":2946,"aliases":2947,"sourceIds":2950,"published":2951,"modified":2952,"checkedAt":7,"severity":2953,"references":2955,"versionKeys":2967,"packageCount":32,"repositoryCount":1784},"ghsa-c98p-7wgm-6p64-ef7ac7e3","Tornado: Quadratic DoS via Repeated Header Coalescing",[2948,2949],"CVE-2025-67725","PYSEC-2025-266",[163,2949],"2025-12-12T06:15:41.380Z","2026-07-20T19:15:27.567094965Z",[2954],{"type":1299,"score":1571},[2956,2958,2960,2962,2964,2965],{"type":1309,"url":2957},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-c98p-7wgm-6p64",{"type":1309,"url":2959},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67725",{"type":1347,"url":2961},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F771472cfdaeebc0d89a9cc46e249f8891a6b29cd",{"type":1312,"url":2963},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-266.yaml",{"type":1317,"url":1633},{"type":1309,"url":2966},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.3",[1637,1638,1639],{"id":164,"slug":2969,"dossier":47,"summary":2970,"aliases":2971,"sourceIds":2975,"published":2976,"modified":2977,"checkedAt":7,"severity":2978,"references":2981,"versionKeys":3021,"packageCount":32,"repositoryCount":104},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[2972,2973,2974],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[164,2974],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[2979,2980],{"type":1302,"score":2372},{"type":1299,"score":1571},[2982,2984,2986,2988,2990,2992,2993,2995,2997,2999,3001,3003,3005,3007,3009,3011,3013,3015,3017,3019],{"type":1312,"url":2983},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1309,"url":2985},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1312,"url":2987},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1312,"url":2989},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1312,"url":2991},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1317,"url":1744},{"type":1312,"url":2994},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1312,"url":2996},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1312,"url":2998},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1309,"url":3000},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1309,"url":3002},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1309,"url":3004},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1309,"url":3006},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1309,"url":3008},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1309,"url":3010},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1309,"url":3012},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1309,"url":3014},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1309,"url":3016},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1309,"url":3018},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1309,"url":3020},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1748,1749,1750,1751,1752,1753,1754],{"id":165,"slug":3023,"dossier":47,"summary":3024,"aliases":3025,"sourceIds":3026,"published":3027,"modified":3028,"checkedAt":7,"severity":3029,"references":3031,"versionKeys":3045,"packageCount":32,"repositoryCount":42},"ghsa-chx6-46f5-w4vp-dd54bdb8","tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM",[],[165],"2026-09-30T23:49:13Z","2026-10-01T00:00:05.755453229Z",[3030],{"type":1299,"score":1571},[3032,3034,3035,3037,3039,3041,3043,3044],{"type":1312,"url":3033},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-chx6-46f5-w4vp",{"type":1312,"url":1627},{"type":1312,"url":3036},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F15f056080d8e456f92cca8ad0c33e5a5480414ac",{"type":1312,"url":3038},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6564e0a0922c16f239d3a18adccd04736e380c89",{"type":1312,"url":3040},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Faa2eb0d989716ac00fe8d7a9919b81c1eccd6ec4",{"type":1312,"url":3042},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fe412435febba4569c552c5c9054f1bf92bd171a9",{"type":1317,"url":1633},{"type":1312,"url":1635},[1637,1638,1639,1640,1641,1642,1643],{"id":166,"slug":3047,"dossier":47,"summary":3048,"aliases":3049,"sourceIds":3052,"published":3053,"modified":3054,"checkedAt":7,"severity":3055,"references":3058,"versionKeys":3075,"packageCount":32,"repositoryCount":404},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3050,3051],"CVE-2025-27516","PYSEC-2026-1471",[166,3051],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3056],{"type":1302,"score":3057},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3059,3061,3063,3065,3067,3069,3071,3073],{"type":1312,"url":3060},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1309,"url":3062},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1347,"url":3064},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1317,"url":3066},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1312,"url":3068},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1312,"url":3070},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1317,"url":3072},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1309,"url":3074},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3076,3077],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":167,"slug":3079,"dossier":47,"summary":3080,"aliases":3081,"sourceIds":3084,"published":3085,"modified":3086,"checkedAt":7,"severity":3087,"references":3090,"versionKeys":3101,"packageCount":32,"repositoryCount":66},"ghsa-cx3h-4qpv-8hc9-3078b6fa","Tornado has out-of-bounds memory access via C extension",[3082,3083],"CVE-2026-49854","PYSEC-2026-3388",[167,3083],"2026-06-12T18:30:19Z","2026-09-10T03:50:49.232529305Z",[3088],{"type":1299,"score":3089},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[3091,3093,3094,3096,3097,3099],{"type":1312,"url":3092},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1317,"url":1633},{"type":1312,"url":3095},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Freleases\u002Ftag\u002Fv6.5.6",{"type":1317,"url":1716},{"type":1309,"url":3098},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx3h-4qpv-8hc9",{"type":1309,"url":3100},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49854",[1637,1638,1639,1640,1641],{"id":168,"slug":3103,"dossier":47,"summary":3104,"aliases":3105,"sourceIds":3109,"published":3110,"modified":3111,"checkedAt":7,"severity":3112,"references":3116,"versionKeys":3132,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3106,3107,3108],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[168,3108],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3113,3114],{"type":1299,"score":1300},{"type":1302,"score":3115},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3117,3119,3121,3123,3124,3126,3128,3130],{"type":1309,"url":3118},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1312,"url":3120},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1312,"url":3122},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1317,"url":2026},{"type":1312,"url":3125},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1312,"url":3127},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1317,"url":3129},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1309,"url":3131},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2032],{"id":169,"slug":3134,"dossier":47,"summary":3135,"aliases":3136,"sourceIds":3140,"published":3141,"modified":3142,"checkedAt":7,"severity":3143,"references":3148,"versionKeys":3166,"packageCount":32,"repositoryCount":404},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[3137,3138,3139],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[169],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[3144,3146],{"type":1299,"score":3145},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1302,"score":3147},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3149,3151,3153,3155,3157,3159,3160,3162,3164],{"type":1309,"url":3150},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1312,"url":3152},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1312,"url":3154},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1312,"url":3156},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1312,"url":3158},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1317,"url":1518},{"type":1312,"url":3161},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1312,"url":3163},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1312,"url":3165},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1530,1531],{"id":170,"slug":3168,"dossier":47,"summary":3169,"aliases":3170,"sourceIds":3173,"published":3174,"modified":3175,"checkedAt":7,"severity":3176,"references":3181,"versionKeys":3205,"packageCount":32,"repositoryCount":42},"ghsa-fgcw-684q-jj6r-9fe55ba1","huggingface\u002Ftransformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path",[3171,3172],"CVE-2026-5241","PYSEC-2026-2290",[170,3172],"2026-06-03T14:16:46.337Z","2026-09-10T03:50:49.345942449Z",[3177,3179],{"type":1299,"score":3178},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",{"type":1299,"score":3180},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[3182,3184,3186,3188,3190,3192,3194,3196,3197,3199,3201,3203],{"type":1309,"url":3183},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-5241",{"type":1347,"url":3185},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F676559d5022b74aaa0cee1cee0842b7f27c5320e",{"type":1309,"url":3187},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34456",{"type":1309,"url":3189},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1312,"url":3191},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",{"type":1312,"url":3193},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-5241",{"type":1511,"url":3195},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484384",{"type":1317,"url":1409},{"type":1312,"url":3198},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2026-2290.yaml",{"type":1306,"url":3200},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fceb3ce1a-4c45-497a-b25e-cb9a7685e619",{"type":1312,"url":3202},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-5241.json",{"type":1309,"url":3204},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fgcw-684q-jj6r",[1415,1416,1417,1418,1419,1420,1421,1422,1423],{"id":171,"slug":3207,"dossier":90,"summary":3208,"aliases":3209,"sourceIds":3213,"published":3214,"modified":3215,"checkedAt":7,"severity":3216,"references":3219,"versionKeys":3233,"packageCount":32,"repositoryCount":1757},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[3210,3211,3212],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[171,3212],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[3217],{"type":1299,"score":3218},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[3220,3222,3224,3226,3228,3229,3230,3231],{"type":1312,"url":3221},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1309,"url":3223},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1312,"url":3225},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1312,"url":3227},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1317,"url":1744},{"type":1312,"url":2130},{"type":1317,"url":2132},{"type":1309,"url":3232},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":172,"slug":3235,"dossier":47,"summary":3236,"aliases":3237,"sourceIds":3240,"published":3241,"modified":3242,"checkedAt":7,"severity":3243,"references":3246,"versionKeys":3256,"packageCount":32,"repositoryCount":103},"ghsa-fjr4-x663-mwxc-324b7aa5","GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)",[3238,3239],"CVE-2026-73624","PYSEC-2026-3995",[172,3239],"2026-07-24T16:41:20Z","2026-09-29T09:10:55.738617943Z",[3244,3245],{"type":1299,"score":1598},{"type":1302,"score":1600},[3247,3249,3250,3252,3253,3254],{"type":1306,"url":3248},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-fjr4-x663-mwxc",{"type":1312,"url":2245},{"type":1312,"url":3251},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F1d51b891d7f236044a6aa17498ec682b63dad6e6",{"type":1317,"url":1318},{"type":1312,"url":2250},{"type":1309,"url":3255},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-overwrite-via-diff",[1326,1327,1328],{"id":173,"slug":3258,"dossier":47,"summary":2282,"aliases":3259,"sourceIds":3262,"published":3263,"modified":3264,"checkedAt":7,"severity":3265,"references":3268,"versionKeys":3279,"packageCount":32,"repositoryCount":32},"ghsa-fpwr-67px-3qhx-94f30126",[3260,3261],"CVE-2025-1194","PYSEC-2026-1984",[173,3261],"2025-04-29T12:30:21Z","2026-08-13T20:11:58.399313771Z",[3266],{"type":1299,"score":3267},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[3269,3271,3273,3274,3276,3277],{"type":1309,"url":3270},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1194",{"type":1312,"url":3272},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F92c5ca9dd70de3ade2af2eb835c96215cc50e815",{"type":1317,"url":1409},{"type":1312,"url":3275},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F86f58dcd-683f-4adc-a735-849f51e9abb2",{"type":1317,"url":1556},{"type":1309,"url":3278},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fpwr-67px-3qhx",[1415],{"id":174,"slug":3281,"dossier":47,"summary":3282,"aliases":3283,"sourceIds":3286,"published":3287,"modified":3288,"checkedAt":7,"severity":3289,"references":3291,"versionKeys":3304,"packageCount":32,"repositoryCount":103},"ghsa-g5vv-9gxw-82hx-203070a6","GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author\u002Fcommitter field parsing",[3284,3285],"CVE-2026-87819","PYSEC-2026-3984",[174,3285],"2026-09-09T12:17:17.120Z","2026-09-30T23:45:04.037560336Z",[3290],{"type":1299,"score":1571},[3292,3294,3296,3298,3299,3300,3302],{"type":1306,"url":3293},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-g5vv-9gxw-82hx",{"type":1312,"url":3295},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2215",{"type":1312,"url":3297},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F751473a5f3221d6f989291cbebcc404353fd3ba8",{"type":1317,"url":1318},{"type":1312,"url":1320},{"type":1312,"url":3301},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3984.yaml",{"type":1309,"url":3303},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-3.1.60-denial-of-service-via-redos",[1326,1327,1328],{"id":175,"slug":3306,"dossier":47,"summary":3307,"aliases":3308,"sourceIds":3311,"published":3312,"modified":3313,"checkedAt":7,"severity":3314,"references":3317,"versionKeys":3336,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[3309,3310],"CVE-2024-34062","PYSEC-2026-1976",[175,3310],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[3315],{"type":1299,"score":3316},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[3318,3320,3322,3324,3326,3328,3330,3332,3334],{"type":1312,"url":3319},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1309,"url":3321},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1312,"url":3323},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1317,"url":3325},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1312,"url":3327},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1312,"url":3329},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1312,"url":3331},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1317,"url":3333},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1309,"url":3335},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[3337],"pypi:tqdm@4.66.2",{"id":176,"slug":3339,"dossier":90,"summary":3340,"aliases":3341,"sourceIds":3344,"published":3345,"modified":3346,"checkedAt":7,"severity":3347,"references":3352,"versionKeys":3362,"packageCount":32,"repositoryCount":3365},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[3342,3343],"CVE-2026-25645","PYSEC-2026-2275",[176,3343],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[3348,3350],{"type":1299,"score":3349},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1299,"score":3351},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[3353,3355,3357,3359,3360],{"type":1309,"url":3354},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1309,"url":3356},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1347,"url":3358},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1317,"url":2796},{"type":1309,"url":3361},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[2806,2807,3363,3364],"pypi:requests@2.32.4","pypi:requests@2.32.5",18,{"id":177,"slug":3367,"dossier":47,"summary":3368,"aliases":3369,"sourceIds":3371,"published":3372,"modified":3373,"checkedAt":7,"severity":3374,"references":3376,"versionKeys":3385,"packageCount":32,"repositoryCount":2358},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[3370],"CVE-2026-97688",[177],"2026-09-30T15:00:38Z","2026-09-30T15:15:04.066660799Z",[3375],{"type":1302,"score":2185},[3377,3379,3381,3383,3384],{"type":1312,"url":3378},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1309,"url":3380},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1312,"url":3382},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1317,"url":1481},{"type":1312,"url":2602},[2604,2605],{"id":178,"slug":3387,"dossier":47,"summary":3388,"aliases":3389,"sourceIds":3392,"published":3393,"modified":3394,"checkedAt":7,"severity":3395,"references":3397,"versionKeys":3408,"packageCount":32,"repositoryCount":355},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[3390,3391],"CVE-2025-66418","PYSEC-2026-1998",[178,3391],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[3396],{"type":1302,"score":1466},[3398,3400,3402,3404,3405,3406],{"type":1312,"url":3399},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1309,"url":3401},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1347,"url":3403},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1317,"url":1481},{"type":1317,"url":1483},{"type":1309,"url":3407},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1485,1486,1487,1488,1489],{"id":179,"slug":3410,"dossier":47,"summary":3411,"aliases":3412,"sourceIds":3415,"published":3416,"modified":3417,"checkedAt":7,"severity":3418,"references":3421,"versionKeys":3436,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[3413,3414],"CVE-2024-56201","PYSEC-2026-1472",[179,3414],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[3419,3420],{"type":1299,"score":1435},{"type":1302,"score":3057},[3422,3424,3426,3428,3430,3431,3433,3434],{"type":1312,"url":3423},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1309,"url":3425},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1312,"url":3427},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1347,"url":3429},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1317,"url":3066},{"type":1312,"url":3432},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1317,"url":3072},{"type":1309,"url":3435},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3076],{"id":180,"slug":3438,"dossier":90,"summary":3439,"aliases":3440,"sourceIds":3444,"published":3445,"modified":3446,"checkedAt":7,"severity":3447,"references":3450,"versionKeys":3462,"packageCount":32,"repositoryCount":3365},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[3441,3442,3443],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[180,3443],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[3448],{"type":1299,"score":3449},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[3451,3453,3455,3457,3459,3460],{"type":1306,"url":3452},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1309,"url":3454},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1347,"url":3456},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1312,"url":3458},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1317,"url":2026},{"type":1309,"url":3461},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2032,2033,2034,2035,3463,3464,3465,3466,3467,3468,3469,3470],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":181,"slug":3472,"dossier":47,"summary":3473,"aliases":3474,"sourceIds":3477,"published":3478,"modified":3479,"checkedAt":7,"severity":3480,"references":3482,"versionKeys":3503,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[3475,3476],"CVE-2024-34064","PYSEC-2026-1474",[181,3476],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[3481],{"type":1299,"score":2403},[3483,3485,3487,3489,3490,3492,3494,3496,3498,3500,3501],{"type":1312,"url":3484},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1309,"url":3486},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1347,"url":3488},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1317,"url":3066},{"type":1312,"url":3491},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1312,"url":3493},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1312,"url":3495},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1312,"url":3497},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1312,"url":3499},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1317,"url":3072},{"type":1309,"url":3502},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3076],{"id":182,"slug":3505,"dossier":47,"summary":3506,"aliases":3507,"sourceIds":3510,"published":3511,"modified":3512,"checkedAt":7,"severity":3513,"references":3515,"versionKeys":3530,"packageCount":32,"repositoryCount":103},"ghsa-hh9p-6wh2-4mfc-8e33cff1","GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()",[3508,3509],"CVE-2026-76217","PYSEC-2026-3841",[182,3509],"2026-08-07T15:43:56Z","2026-09-10T12:26:07.095223621Z",[3514],{"type":1299,"score":1680},[3516,3518,3520,3521,3523,3524,3525,3527,3528],{"type":1312,"url":3517},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",{"type":1309,"url":3519},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76217",{"type":1312,"url":1802},{"type":1312,"url":3522},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Ff2550b65bf60ca087190981e2c7b6865e201f40c",{"type":1317,"url":1318},{"type":1312,"url":1807},{"type":1312,"url":3526},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-read-via-pathspec-from-file",{"type":1317,"url":1451},{"type":1309,"url":3529},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hh9p-6wh2-4mfc",[1326,1327,1328],{"id":183,"slug":3532,"dossier":47,"summary":3533,"aliases":3534,"sourceIds":3537,"published":3538,"modified":3539,"checkedAt":7,"severity":3540,"references":3545,"versionKeys":3562,"packageCount":32,"repositoryCount":103},"ghsa-hmq2-w58f-27jc-f0b0fe70","GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython",[3535,3536],"CVE-2026-76222","PYSEC-2026-3784",[183,3536],"2026-08-07T15:45:39Z","2026-09-08T21:00:05.149418166Z",[3541,3543],{"type":1299,"score":3542},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",{"type":1302,"score":3544},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:H\u002FVA:L\u002FSC:N\u002FSI:H\u002FSA:L\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3546,3548,3550,3552,3554,3556,3557,3558,3560],{"type":1306,"url":3547},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-hmq2-w58f-27jc",{"type":1309,"url":3549},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76222",{"type":1312,"url":3551},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2202",{"type":1312,"url":3553},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F4299c990e1ca21896f9485277caf7bb0ae5b404c",{"type":1312,"url":3555},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe4b8e7d026ca6abb4cf604f8e77093432ce23c06",{"type":1317,"url":1318},{"type":1312,"url":1807},{"type":1312,"url":3559},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3784.yaml",{"type":1309,"url":3561},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-path-traversal-via-gitmodules-submodule-name",[1326,1327,1328],{"id":184,"slug":3564,"dossier":47,"summary":3565,"aliases":3566,"sourceIds":3569,"published":3570,"modified":3571,"checkedAt":7,"severity":3572,"references":3576,"versionKeys":3592,"packageCount":32,"repositoryCount":32},"ghsa-hxxf-235m-72v3-21da19b0","Deserialization of Untrusted Data in Hugging Face Transformers",[3567,3568],"CVE-2024-11394","PYSEC-2024-229",[184,3568],"2024-11-22T22:15:07Z","2026-09-10T03:50:20.811665084Z",[3573,3575],{"type":1299,"score":3574},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1299,"score":1300},[3577,3579,3581,3583,3584,3586,3588,3590],{"type":1309,"url":3578},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11394",{"type":1312,"url":3580},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fissues\u002F34840",{"type":1312,"url":3582},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F35296",{"type":1317,"url":1409},{"type":1312,"url":3585},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-229.yaml",{"type":1312,"url":3587},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515",{"type":1309,"url":3589},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515\u002F",{"type":1309,"url":3591},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxxf-235m-72v3",[1415],{"id":185,"slug":3594,"dossier":47,"summary":3595,"aliases":3596,"sourceIds":3599,"published":3600,"modified":3601,"checkedAt":7,"severity":3602,"references":3604,"versionKeys":3614,"packageCount":32,"repositoryCount":1784},"ghsa-jhmp-mqwm-3gq8-3b1c10a9","Tornado: Quadratic DoS via Crafted Multipart Parameters",[3597,3598],"CVE-2025-67726","PYSEC-2025-267",[185,3598],"2025-12-12T07:15:44.920Z","2026-07-20T19:15:27.583657512Z",[3603],{"type":1299,"score":1571},[3605,3607,3609,3610,3612,3613],{"type":1309,"url":3606},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-jhmp-mqwm-3gq8",{"type":1309,"url":3608},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67726",{"type":1347,"url":2961},{"type":1312,"url":3611},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-267.yaml",{"type":1317,"url":1633},{"type":1309,"url":2966},[1637,1638,1639],{"id":186,"slug":3616,"dossier":47,"summary":3617,"aliases":3618,"sourceIds":3620,"published":3621,"modified":3622,"checkedAt":7,"severity":3623,"references":3626,"versionKeys":3647,"packageCount":32,"repositoryCount":103},"ghsa-jhr6-gm9c-rqjv-a6fbec2f","sentence-transformers local model loading bypasses trust_remote_code and executes custom Python",[3619],"CVE-2026-68770",[186],"2026-07-31T21:31:59Z","2026-09-30T23:30:05.978616569Z",[3624,3625],{"type":1299,"score":1375},{"type":1302,"score":1377},[3627,3629,3631,3633,3635,3637,3639,3641,3643,3645],{"type":1309,"url":3628},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-68770",{"type":1312,"url":3630},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fissues\u002F3801",{"type":1312,"url":3632},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3807",{"type":1312,"url":3634},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fpull\u002F3935",{"type":1312,"url":3636},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002F626eb602b088878a8173bcab69225f68411b99e1",{"type":1312,"url":3638},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Fcommit\u002Fae1acc3fb2aa2004577b297eb4a915ce7a03316a",{"type":1317,"url":3640},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers",{"type":1312,"url":3642},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv5.6.0",{"type":1312,"url":3644},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fsentence-transformers\u002Freleases\u002Ftag\u002Fv6.0.0",{"type":1312,"url":3646},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fsentence-transformers-arbitrary-code-execution-on-local-model-load-despite-trust-remote-code-false",[3648,3649,3650,3651,3652],"pypi:sentence-transformers@3.3.1","pypi:sentence-transformers@4.0.2","pypi:sentence-transformers@4.1.0","pypi:sentence-transformers@5.0.0","pypi:sentence-transformers@5.2.0",{"id":187,"slug":3654,"dossier":90,"summary":3655,"aliases":3656,"sourceIds":3660,"published":3661,"modified":3662,"checkedAt":7,"severity":3663,"references":3665,"versionKeys":3679,"packageCount":32,"repositoryCount":1757},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[3657,3658,3659],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[187,3659],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[3664],{"type":1299,"score":1571},[3666,3668,3670,3672,3674,3675,3676,3677],{"type":1312,"url":3667},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1309,"url":3669},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1312,"url":3671},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1312,"url":3673},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1317,"url":1744},{"type":1312,"url":2130},{"type":1317,"url":2132},{"type":1309,"url":3678},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":188,"slug":3681,"dossier":47,"summary":3682,"aliases":3683,"sourceIds":3686,"published":3687,"modified":3688,"checkedAt":7,"severity":3689,"references":3691,"versionKeys":3704,"packageCount":32,"repositoryCount":32},"ghsa-jjph-296x-mrcr-0f661d67","Transformers vulnerable to ReDoS attack through its get_imports() function",[3684,3685],"CVE-2025-3264","PYSEC-2026-1985",[188,3685],"2025-07-07T12:30:22Z","2026-07-07T17:56:51.899728258Z",[3690],{"type":1299,"score":1825},[3692,3694,3696,3698,3699,3701,3702],{"type":1309,"url":3693},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3264",{"type":1312,"url":3695},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F0720e206c6ba28887e4d60ef60a6a089f6c1cc76",{"type":1312,"url":3697},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F126abe3461762e5fc180e7e614391d1b4ab051ca",{"type":1317,"url":1409},{"type":1312,"url":3700},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c6f7822-9992-476d-8cf0-b0b1623427df",{"type":1317,"url":1556},{"type":1309,"url":3703},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjph-296x-mrcr",[1415],{"id":189,"slug":3706,"dossier":47,"summary":3707,"aliases":3708,"sourceIds":3711,"published":3712,"modified":3713,"checkedAt":7,"severity":3714,"references":3718,"versionKeys":3728,"packageCount":32,"repositoryCount":103},"ghsa-jm78-9fvv-mhgr-2c167ddc","GitPython: git-config OPTION-name injection via =\u002F#\u002Fwhitespace bypasses name validator, enabling forged core.sshCommand\u002FhooksPath (RCE)",[3709,3710],"CVE-2026-76221","PYSEC-2026-3783",[189,3710],"2026-08-07T15:46:35Z","2026-09-10T03:51:14.296736368Z",[3715,3716],{"type":1299,"score":1435},{"type":1302,"score":3717},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3719,3721,3722,3724,3725,3726],{"type":1306,"url":3720},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-jm78-9fvv-mhgr",{"type":1312,"url":1802},{"type":1312,"url":3723},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fa495ccd3b547ccd60b2187215823b72a9c0188bf",{"type":1317,"url":1318},{"type":1312,"url":1807},{"type":1309,"url":3727},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-config-injection-via-option-name",[1326,1327,1328],{"id":190,"slug":3730,"dossier":47,"summary":3731,"aliases":3732,"sourceIds":3735,"published":3736,"modified":3737,"checkedAt":7,"severity":3738,"references":3743,"versionKeys":3756,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[3733,3734],"CVE-2024-5206","PYSEC-2024-110",[190,3734],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[3739,3741],{"type":1299,"score":3740},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1299,"score":3742},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3744,3746,3748,3750,3752,3754],{"type":1309,"url":3745},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1347,"url":3747},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1312,"url":3749},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1317,"url":3751},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1312,"url":3753},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1309,"url":3755},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[3757],"pypi:scikit-learn@1.3.2",{"id":191,"slug":3759,"dossier":47,"summary":3760,"aliases":3761,"sourceIds":3764,"published":3765,"modified":3766,"checkedAt":7,"severity":3767,"references":3770,"versionKeys":3778,"packageCount":32,"repositoryCount":385},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[3762,3763],"CVE-2026-44432","PYSEC-2026-142",[191,3763],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[3768,3769],{"type":1299,"score":1571},{"type":1302,"score":1466},[3771,3773,3775,3777],{"type":1309,"url":3772},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1309,"url":3774},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1312,"url":3776},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1317,"url":1481},[2604],{"id":192,"slug":3780,"dossier":47,"summary":3781,"aliases":3782,"sourceIds":3785,"published":3786,"modified":3787,"checkedAt":7,"severity":3788,"references":3790,"versionKeys":3799,"packageCount":32,"repositoryCount":66},"ghsa-mgf9-4vpg-hj56-00729355","tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)",[3783,3784],"CVE-2026-49855","PYSEC-2026-3389",[192,3784],"2026-06-15T20:19:28Z","2026-09-10T03:51:09.080081033Z",[3789],{"type":1299,"score":1571},[3791,3793,3794,3795,3797],{"type":1312,"url":3792},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1317,"url":1633},{"type":1317,"url":1716},{"type":1309,"url":3796},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mgf9-4vpg-hj56",{"type":1309,"url":3798},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-49855",[1637,1638,1639,1640,1641],{"id":193,"slug":3801,"dossier":47,"summary":3802,"aliases":3803,"sourceIds":3806,"published":3807,"modified":3808,"checkedAt":7,"severity":3809,"references":3811,"versionKeys":3824,"packageCount":32,"repositoryCount":365},"ghsa-mpf4-983q-p7j4-9fb72bc8","Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop",[3804,3805],"CVE-2026-82397","PYSEC-2026-3928",[193,3805],"2026-09-02T14:38:43Z","2026-09-10T12:25:33.492830390Z",[3810],{"type":1299,"score":1571},[3812,3814,3816,3817,3819,3820,3821,3822],{"type":1312,"url":3813},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",{"type":1309,"url":3815},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-82397",{"type":1312,"url":2530},{"type":1312,"url":3818},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F8d6363ed7b69d5f0da806efe34d256627a2191de",{"type":1317,"url":1633},{"type":1312,"url":2537},{"type":1317,"url":1716},{"type":1309,"url":3823},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mpf4-983q-p7j4",[1637,1638,1639,1640,1641,1642],{"id":194,"slug":3826,"dossier":47,"summary":3827,"aliases":3828,"sourceIds":3831,"published":3832,"modified":3833,"checkedAt":7,"severity":3834,"references":3837,"versionKeys":3845,"packageCount":32,"repositoryCount":103},"ghsa-mv93-w799-cj2w-4413137a","GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath",[3829,3830],"CVE-2026-67326","PYSEC-2026-3980",[194,3830],"2026-05-08T23:19:02Z","2026-09-17T09:10:55.928803360Z",[3835,3836],{"type":1299,"score":1655},{"type":1299,"score":2374},[3838,3840,3842,3843],{"type":1306,"url":3839},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-mv93-w799-cj2w",{"type":1309,"url":3841},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1317,"url":1318},{"type":1309,"url":3844},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-newline-injection-via-config-writer-section",[1326,1327,1328],{"id":195,"slug":3847,"dossier":47,"summary":3848,"aliases":3849,"sourceIds":3852,"published":3853,"modified":3854,"checkedAt":7,"severity":3855,"references":3860,"versionKeys":3872,"packageCount":32,"repositoryCount":103},"ghsa-p538-c434-8v24-c303e516","GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count",[3850,3851],"CVE-2026-73621","PYSEC-2026-3950",[195,3851],"2026-08-03T20:23:17Z","2026-09-10T13:10:55.177009469Z",[3856,3858],{"type":1299,"score":3857},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1302,"score":3859},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[3861,3863,3865,3867,3868,3870],{"type":1306,"url":3862},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-p538-c434-8v24",{"type":1312,"url":3864},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2184",{"type":1312,"url":3866},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F38553b6fddc7f6a667cdb45a6762343a08fc72b2",{"type":1317,"url":1318},{"type":1312,"url":3869},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.56",{"type":1309,"url":3871},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-arbitrary-file-truncation-via-commit-count",[1326,1327,1328],{"id":196,"slug":3874,"dossier":47,"summary":3875,"aliases":3876,"sourceIds":3880,"published":3881,"modified":3882,"checkedAt":7,"severity":3883,"references":3886,"versionKeys":3899,"packageCount":32,"repositoryCount":103},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[3877,3878,3879],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[196,3879],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[3884,3885],{"type":1299,"score":1544},{"type":1299,"score":1571},[3887,3889,3891,3893,3895,3897,3898],{"type":1306,"url":3888},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1309,"url":3890},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1347,"url":3892},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1347,"url":3894},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1312,"url":3896},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1317,"url":1744},{"type":1309,"url":2130},[1753,1754,1755,1756],{"id":197,"slug":3901,"dossier":47,"summary":3902,"aliases":3903,"sourceIds":3906,"published":3687,"modified":3907,"checkedAt":7,"severity":3908,"references":3911,"versionKeys":3924,"packageCount":32,"repositoryCount":385},"ghsa-phhr-52qp-3mj4-6f5d82e3","Transformers's Improper Input Validation vulnerability can be exploited through username injection",[3904,3905],"CVE-2025-3777","PYSEC-2026-1986",[197,3905],"2026-09-10T03:50:26.198077196Z",[3909],{"type":1299,"score":3910},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[3912,3914,3916,3917,3919,3921,3922],{"type":1309,"url":3913},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3777",{"type":1312,"url":3915},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F4dda5f71b35fb70cf602187eef84bb17a50b9082",{"type":1317,"url":1409},{"type":1312,"url":3918},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fblame\u002Fa7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4\u002Fsrc\u002Ftransformers\u002Fimage_utils.py",{"type":1312,"url":3920},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fccba0730-9248-4853-b7ff-5c20e6364f09",{"type":1317,"url":1556},{"type":1309,"url":3923},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-phhr-52qp-3mj4",[1415,1416,1417],{"id":198,"slug":3926,"dossier":90,"summary":3927,"aliases":3928,"sourceIds":3932,"published":3933,"modified":3934,"checkedAt":7,"severity":3935,"references":3937,"versionKeys":3948,"packageCount":32,"repositoryCount":1757},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[3929,3930,3931],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[198,3931],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[3936],{"type":1299,"score":1571},[3938,3940,3942,3944,3946,3947],{"type":1306,"url":3939},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1309,"url":3941},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1347,"url":3943},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1312,"url":3945},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1317,"url":1744},{"type":1309,"url":1746},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":199,"slug":3950,"dossier":47,"summary":3951,"aliases":3952,"sourceIds":3955,"published":3956,"modified":3957,"checkedAt":7,"severity":3958,"references":3960,"versionKeys":3972,"packageCount":32,"repositoryCount":1784},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[3953,3954],"CVE-2025-50181","PYSEC-2026-1999",[199,3954],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[3959],{"type":1299,"score":1769},[3961,3963,3965,3967,3968,3969,3970],{"type":1312,"url":3962},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1309,"url":3964},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1347,"url":3966},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1317,"url":1481},{"type":1312,"url":1779},{"type":1317,"url":1483},{"type":1309,"url":3971},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1485,1486,1487,1488],{"id":200,"slug":3974,"dossier":47,"summary":3975,"aliases":3976,"sourceIds":3979,"published":3980,"modified":3981,"checkedAt":7,"severity":3982,"references":3986,"versionKeys":3997,"packageCount":32,"repositoryCount":1784},"ghsa-pr2v-jx2c-wg9f-1ca6d67c","Tornado vulnerable to Header Injection and XSS via reason argument",[3977,3978],"CVE-2025-67724","PYSEC-2025-265",[200,3978],"2025-12-12T06:15:41.213Z","2026-07-20T19:00:24.953994999Z",[3983,3984],{"type":1299,"score":2403},{"type":1299,"score":3985},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[3987,3989,3991,3993,3995,3996],{"type":1309,"url":3988},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pr2v-jx2c-wg9f",{"type":1309,"url":3990},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67724",{"type":1347,"url":3992},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F9c163aebeaad9e6e7d28bac1f33580eb00b0e421",{"type":1312,"url":3994},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2025-265.yaml",{"type":1317,"url":1633},{"type":1309,"url":2966},[1637,1638,1639],{"id":201,"slug":3999,"dossier":47,"summary":4000,"aliases":4001,"sourceIds":4003,"published":4004,"modified":4005,"checkedAt":7,"severity":4006,"references":4009,"versionKeys":4013,"packageCount":32,"repositoryCount":66},"ghsa-pw6j-qg29-8w7f-fb4d7ed6","Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse",[4002],"CVE-2026-91992",[201],"2026-06-15T20:37:24Z","2026-09-16T03:56:01.290461498Z",[4007],{"type":1299,"score":4008},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4010,4012],{"type":1312,"url":4011},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-pw6j-qg29-8w7f",{"type":1317,"url":1633},[1637,1638,1639,1640,1641],{"id":202,"slug":4015,"dossier":47,"summary":4016,"aliases":4017,"sourceIds":4021,"published":4022,"modified":4023,"checkedAt":7,"severity":4024,"references":4027,"versionKeys":4039,"packageCount":32,"repositoryCount":355},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[4018,4019,4020],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[202,4020],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[4025,4026],{"type":1302,"score":2372},{"type":1299,"score":2214},[4028,4029,4031,4033,4035,4037,4038],{"type":1312,"url":2983},{"type":1347,"url":4030},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1309,"url":4032},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1347,"url":4034},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1347,"url":4036},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1317,"url":1744},{"type":1309,"url":2080},[1748,1749,1750,1751,1752,1753,1754,1755],{"id":203,"slug":4041,"dossier":47,"summary":4042,"aliases":4043,"sourceIds":4046,"published":3687,"modified":4047,"checkedAt":7,"severity":4048,"references":4050,"versionKeys":4061,"packageCount":32,"repositoryCount":32},"ghsa-q2wp-rjmx-x6x9-43135d3d","Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking",[4044,4045],"CVE-2025-3263","PYSEC-2026-1987",[203,4045],"2026-07-07T17:56:57.889099913Z",[4049],{"type":1299,"score":1825},[4051,4053,4054,4055,4056,4058,4059],{"type":1309,"url":4052},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3263",{"type":1312,"url":3695},{"type":1312,"url":3697},{"type":1317,"url":1409},{"type":1312,"url":4057},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fc7a69150-54f8-4e81-8094-791e7a2a0f29",{"type":1317,"url":1556},{"type":1309,"url":4060},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2wp-rjmx-x6x9",[1415],{"id":204,"slug":4063,"dossier":47,"summary":4064,"aliases":4065,"sourceIds":4068,"published":4069,"modified":4070,"checkedAt":7,"severity":4071,"references":4074,"versionKeys":4087,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[4066,4067],"CVE-2024-56326","PYSEC-2026-1475",[204,4067],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[4072,4073],{"type":1299,"score":2374},{"type":1302,"score":3057},[4075,4077,4079,4081,4082,4083,4084,4085],{"type":1312,"url":4076},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1309,"url":4078},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1347,"url":4080},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1317,"url":3066},{"type":1312,"url":3432},{"type":1312,"url":3068},{"type":1317,"url":3072},{"type":1309,"url":4086},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3076],{"id":205,"slug":4089,"dossier":90,"summary":4090,"aliases":4091,"sourceIds":4094,"published":4095,"modified":4096,"checkedAt":7,"severity":4097,"references":4101,"versionKeys":4107,"packageCount":32,"repositoryCount":3365},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[4092,4093],"CVE-2026-44431","PYSEC-2026-141",[205,4093],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[4098,4100],{"type":1299,"score":4099},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",{"type":1302,"score":2900},[4102,4104,4106],{"type":1309,"url":4103},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1309,"url":4105},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1317,"url":1481},[1485,1486,1487,1488,1489,2604],{"id":206,"slug":4109,"dossier":47,"summary":4110,"aliases":4111,"sourceIds":4115,"published":4116,"modified":4117,"checkedAt":7,"severity":4118,"references":4122,"versionKeys":4140,"packageCount":32,"repositoryCount":2486},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[4112,4113,4114],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[206],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[4119,4120],{"type":1299,"score":3145},{"type":1302,"score":4121},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[4123,4125,4127,4129,4131,4133,4134,4136,4138],{"type":1309,"url":4124},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1312,"url":4126},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1312,"url":4128},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1312,"url":4130},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1312,"url":4132},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1317,"url":1518},{"type":1312,"url":4135},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1312,"url":4137},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1312,"url":4139},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1530,1531,1532,2576,2577,4141,4142,4143,4144],"pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu",{"id":207,"slug":4146,"dossier":47,"summary":4147,"aliases":4148,"sourceIds":4151,"published":4152,"modified":4153,"checkedAt":7,"severity":4154,"references":4158,"versionKeys":4171,"packageCount":32,"repositoryCount":66},"ghsa-qjxf-f2mg-c6mc-58d52008","Tornado is vulnerable to DoS due to too many multipart parts",[4149,4150],"CVE-2026-31958","PYSEC-2026-140",[207,4150],"2026-03-11T20:16:16.617Z","2026-09-10T03:50:40.522968763Z",[4155,4156],{"type":1299,"score":1571},{"type":1302,"score":4157},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4159,4161,4163,4165,4167,4168,4169],{"type":1309,"url":4160},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-qjxf-f2mg-c6mc",{"type":1309,"url":4162},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-31958",{"type":1312,"url":4164},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F119a195e290c43ad2d63a2cf012c29d43d6ed839",{"type":1312,"url":4166},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftornado\u002FPYSEC-2026-140.yaml",{"type":1317,"url":1633},{"type":1312,"url":2415},{"type":1312,"url":4170},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F04\u002Fmsg00000.html",[1637,1638,1639,1640],{"id":208,"slug":4173,"dossier":47,"summary":4174,"aliases":4175,"sourceIds":4178,"published":4179,"modified":4180,"checkedAt":7,"severity":4181,"references":4184,"versionKeys":4199,"packageCount":32,"repositoryCount":2486},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[4176,4177],"CVE-2026-22701","PYSEC-2026-1374",[208,4177],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[4182],{"type":1299,"score":4183},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[4185,4187,4189,4191,4193,4195,4197],{"type":1312,"url":4186},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1309,"url":4188},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1312,"url":4190},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1312,"url":4192},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1317,"url":4194},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1317,"url":4196},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1309,"url":4198},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[4200,4201,4202,4203],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0",{"id":209,"slug":4205,"dossier":47,"summary":4206,"aliases":4207,"sourceIds":4210,"published":4211,"modified":4212,"checkedAt":7,"severity":4213,"references":4216,"versionKeys":4230,"packageCount":32,"repositoryCount":32},"ghsa-qq3j-4f4f-9583-cd76c72c","Hugging Face Transformers Regular Expression Denial of Service",[4208,4209],"CVE-2025-2099","PYSEC-2025-40",[209,4209],"2025-05-19T12:15:19Z","2026-06-10T17:02:48.111891265Z",[4214,4215],{"type":1299,"score":1825},{"type":1299,"score":1571},[4217,4219,4221,4223,4224,4226,4228],{"type":1309,"url":4218},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2099",{"type":1312,"url":4220},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F36648",{"type":1347,"url":4222},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F8cb522b4190bd556ce51be04942720650b1a3e57",{"type":1317,"url":1409},{"type":1312,"url":4225},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2025-40.yaml",{"type":1312,"url":4227},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F97b780f3-ffca-424f-ad5d-0e1c57a5bde4",{"type":1309,"url":4229},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qq3j-4f4f-9583",[1415],{"id":210,"slug":4232,"dossier":47,"summary":3565,"aliases":4233,"sourceIds":4236,"published":4237,"modified":4238,"checkedAt":7,"severity":4239,"references":4243,"versionKeys":4257,"packageCount":32,"repositoryCount":32},"ghsa-qxrp-vhvm-j765-63c6e9a2",[4234,4235],"CVE-2024-11392","PYSEC-2024-227",[210,4235],"2024-11-22T22:15:06Z","2026-09-10T03:50:21.016710762Z",[4240,4242],{"type":1299,"score":4241},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1299,"score":1300},[4244,4246,4247,4248,4249,4251,4253,4255],{"type":1309,"url":4245},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11392",{"type":1312,"url":3580},{"type":1312,"url":3582},{"type":1317,"url":1409},{"type":1312,"url":4250},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-227.yaml",{"type":1312,"url":4252},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513",{"type":1309,"url":4254},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513\u002F",{"type":1309,"url":4256},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qxrp-vhvm-j765",[1415],{"id":211,"slug":4259,"dossier":47,"summary":4260,"aliases":4261,"sourceIds":4265,"published":4266,"modified":4267,"checkedAt":7,"severity":4268,"references":4271,"versionKeys":4285,"packageCount":32,"repositoryCount":355},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[4262,4263,4264],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[211,4264],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[4269,4270],{"type":1299,"score":1506},{"type":1302,"score":2072},[4272,4274,4276,4278,4280,4281,4282,4283],{"type":1312,"url":4273},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1309,"url":4275},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1312,"url":4277},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1312,"url":4279},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1317,"url":1744},{"type":1312,"url":2080},{"type":1317,"url":2132},{"type":1309,"url":4284},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1748,1749,1750,1751,1752,1753,1754,1755],{"id":212,"slug":4287,"dossier":47,"summary":4288,"aliases":4289,"sourceIds":4292,"published":4293,"modified":4294,"checkedAt":7,"severity":4295,"references":4298,"versionKeys":4308,"packageCount":32,"repositoryCount":103},"ghsa-r9mr-m37c-5fr3-d43000fc","GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution",[4290,4291],"CVE-2026-73625","PYSEC-2026-3953",[212,4291],"2026-07-24T16:42:57Z","2026-09-10T13:10:47.448946391Z",[4296,4297],{"type":1299,"score":1435},{"type":1302,"score":3717},[4299,4301,4302,4304,4305,4306],{"type":1306,"url":4300},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-r9mr-m37c-5fr3",{"type":1312,"url":2245},{"type":1312,"url":4303},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002Fe8d0fbf774d1f6baa3b481adfe48bd262e43b453",{"type":1317,"url":1318},{"type":1312,"url":2250},{"type":1309,"url":4307},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-remote-code-execution-via-kwarg-value-smuggling",[1326,1327,1328],{"id":213,"slug":4310,"dossier":47,"summary":4311,"aliases":4312,"sourceIds":4315,"published":4316,"modified":4317,"checkedAt":7,"severity":4318,"references":4320,"versionKeys":4335,"packageCount":32,"repositoryCount":34},"ghsa-rcv9-qm8p-9p6j-edc1db04","Hugging Face Transformers library has Regular Expression Denial of Service",[4313,4314],"CVE-2025-6051","PYSEC-2026-1988",[213,4314],"2025-09-14T18:30:26Z","2026-09-10T03:50:28.694224028Z",[4319],{"type":1299,"score":1825},[4321,4323,4325,4327,4329,4330,4332,4333],{"type":1309,"url":4322},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6051",{"type":1312,"url":4324},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F38844",{"type":1312,"url":4326},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F54a02160eb030da9be18231c77791f2eb3a52216",{"type":1312,"url":4328},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fba8eaba9865618253f997784aa565b96206426f0",{"type":1317,"url":1409},{"type":1312,"url":4331},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Faf929523-7b59-418a-bf55-301830b2ac9d",{"type":1317,"url":1556},{"type":1309,"url":4334},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rcv9-qm8p-9p6j",[1415,1416,1417,1418],{"id":214,"slug":4337,"dossier":47,"summary":4338,"aliases":4339,"sourceIds":4342,"published":4343,"modified":4344,"checkedAt":7,"severity":4345,"references":4348,"versionKeys":4361,"packageCount":32,"repositoryCount":2486},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[4340,4341],"CVE-2026-25087","PYSEC-2026-113",[214,4341],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[4346],{"type":1299,"score":4347},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[4349,4351,4353,4355,4357,4359],{"type":1309,"url":4350},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1347,"url":4352},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1317,"url":4354},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1312,"url":4356},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1309,"url":4358},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1309,"url":4360},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[4362,4363,4364,4365],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":215,"slug":4367,"dossier":47,"summary":4368,"aliases":4369,"sourceIds":4372,"published":4373,"modified":4374,"checkedAt":7,"severity":4375,"references":4377,"versionKeys":4385,"packageCount":32,"repositoryCount":103},"ghsa-rpm5-65cw-6hj4-6c97dd77","GitPython has Command Injection via Git options bypass",[4370,4371],"CVE-2026-42215","PYSEC-2026-2160",[215,4371],"2026-04-25T23:42:16Z","2026-09-10T03:51:03.167884784Z",[4376],{"type":1299,"score":1435},[4378,4380,4382,4383],{"type":1306,"url":4379},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rpm5-65cw-6hj4",{"type":1309,"url":4381},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42215",{"type":1317,"url":1318},{"type":1347,"url":4384},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.47",[1326,1327,1328],{"id":216,"slug":4387,"dossier":47,"summary":4388,"aliases":4389,"sourceIds":4393,"published":3141,"modified":4394,"checkedAt":7,"severity":4395,"references":4398,"versionKeys":4416,"packageCount":32,"repositoryCount":355},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[4390,4391,4392],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[216],"2026-09-10T03:49:48.419046410Z",[4396,4397],{"type":1299,"score":3145},{"type":1302,"score":4121},[4399,4401,4403,4405,4407,4409,4410,4412,4414],{"type":1309,"url":4400},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1312,"url":4402},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1312,"url":4404},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1312,"url":4406},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1312,"url":4408},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1317,"url":1518},{"type":1312,"url":4411},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1312,"url":4413},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1312,"url":4415},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[4417,4418,4419,1530,1531,1532,2576,2577,4141,4142,4143,4144],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":217,"slug":4421,"dossier":47,"summary":4422,"aliases":4423,"sourceIds":4426,"published":4427,"modified":4428,"checkedAt":7,"severity":4429,"references":4431,"versionKeys":4449,"packageCount":32,"repositoryCount":103},"ghsa-rwj8-pgh3-r573-0bf779f8","GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL",[4424,4425],"CVE-2026-67322","PYSEC-2026-3842",[217,4425],"2026-07-21T22:06:09Z","2026-09-24T18:28:17.149390188Z",[4430],{"type":1299,"score":2618},[4432,4434,4436,4438,4439,4441,4442,4444,4446,4447],{"type":1312,"url":4433},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1309,"url":4435},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-67322",{"type":1312,"url":4437},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fpull\u002F2172",{"type":1312,"url":2737},{"type":1309,"url":4440},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rwj8-pgh3-r573",{"type":1317,"url":1318},{"type":1312,"url":4443},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.52",{"type":1312,"url":4445},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fgitpython\u002FPYSEC-2026-3842.yaml",{"type":1317,"url":1451},{"type":1312,"url":4448},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-environment-variable-exfiltration-via-clone-from",[1326,1327,1328],{"id":218,"slug":4451,"dossier":47,"summary":4452,"aliases":4453,"sourceIds":4456,"published":4457,"modified":4458,"checkedAt":7,"severity":4459,"references":4461,"versionKeys":4469,"packageCount":32,"repositoryCount":103},"ghsa-v87r-6q3f-2j67-81913ca6","GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath",[4454,4455],"CVE-2026-44244","PYSEC-2026-2163",[218,4455],"2026-05-06T21:58:00Z","2026-09-10T03:50:47.691444343Z",[4460],{"type":1299,"score":2374},[4462,4464,4466,4467],{"type":1306,"url":4463},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-v87r-6q3f-2j67",{"type":1309,"url":4465},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44244",{"type":1317,"url":1318},{"type":1347,"url":4468},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Freleases\u002Ftag\u002F3.1.49",[1326,1327,1328],{"id":219,"slug":4471,"dossier":47,"summary":4472,"aliases":4473,"sourceIds":4477,"published":3141,"modified":4478,"checkedAt":7,"severity":4479,"references":4482,"versionKeys":4497,"packageCount":32,"repositoryCount":42},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[4474,4475,4476],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[219],"2026-06-10T17:41:15.774477397Z",[4480,4481],{"type":1299,"score":3145},{"type":1302,"score":3147},[4483,4485,4486,4487,4488,4490,4491,4493,4495],{"type":1309,"url":4484},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1312,"url":3152},{"type":1312,"url":3154},{"type":1312,"url":3156},{"type":1312,"url":4489},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1317,"url":1518},{"type":1312,"url":4492},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1312,"url":4494},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1312,"url":4496},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1530,1531,1532,2576,2577,4141,4142],{"id":220,"slug":4499,"dossier":90,"summary":4500,"aliases":4501,"sourceIds":4505,"published":4506,"modified":4507,"checkedAt":7,"severity":4508,"references":4510,"versionKeys":4524,"packageCount":32,"repositoryCount":1757},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[4502,4503,4504],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[220,4504],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[4509],{"type":1302,"score":4157},[4511,4513,4515,4517,4519,4520,4521,4522],{"type":1312,"url":4512},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1309,"url":4514},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1312,"url":4516},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1312,"url":4518},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1317,"url":1744},{"type":1312,"url":2130},{"type":1317,"url":2132},{"type":1309,"url":4523},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":221,"slug":4526,"dossier":47,"summary":4527,"aliases":4528,"sourceIds":4531,"published":4532,"modified":4533,"checkedAt":7,"severity":4534,"references":4541,"versionKeys":4567,"packageCount":32,"repositoryCount":385},"ghsa-vqwp-45wm-r9r5-eaa960a2","Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission",[4529,4530],"CVE-2026-10804","PYSEC-2026-212",[221,4530],"2026-06-04T12:16:24.620Z","2026-07-23T15:00:23.893493649Z",[4535,4537,4539],{"type":1299,"score":4536},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:L",{"type":1302,"score":4538},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1299,"score":4540},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4542,4544,4546,4548,4550,4552,4554,4555,4557,4559,4561,4563,4565],{"type":1309,"url":4543},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-10804",{"type":1347,"url":4545},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fissues\u002F14622",{"type":1347,"url":4547},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F14635",{"type":1312,"url":4549},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fpull\u002F15397",{"type":1312,"url":4551},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002Fcommit\u002Ffec0f584dae9261abed16cad35b32922104bb933",{"type":1312,"url":4553},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstreamlit\u002FPYSEC-2026-212.yaml",{"type":1317,"url":2509},{"type":1309,"url":4556},"https:\u002F\u002Fvuldb.com\u002Fcve\u002FCVE-2026-10804",{"type":1309,"url":4558},"https:\u002F\u002Fvuldb.com\u002Fsubmit\u002F831508",{"type":1309,"url":4560},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253",{"type":1511,"url":4562},"https:\u002F\u002Fvuldb.com\u002Fvuln\u002F368253\u002Fcti",{"type":1312,"url":4564},"https:\u002F\u002Fgithub.com\u002Fstreamlit\u002Fstreamlit\u002F",{"type":1309,"url":4566},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqwp-45wm-r9r5",[2513,2514,2515],{"id":222,"slug":4569,"dossier":90,"summary":4570,"aliases":4571,"sourceIds":4573,"published":4574,"modified":4575,"checkedAt":7,"severity":4576,"references":4578,"versionKeys":4587,"packageCount":32,"repositoryCount":2606},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[4572],"CVE-2026-97689",[222],"2026-09-30T14:46:18Z","2026-09-30T15:00:05.904945330Z",[4577],{"type":1302,"score":1466},[4579,4581,4583,4585,4586],{"type":1312,"url":4580},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1309,"url":4582},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1312,"url":4584},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1317,"url":1481},{"type":1312,"url":2602},[1485,1486,1487,1488,1489,2604,2605],{"id":223,"slug":4589,"dossier":47,"summary":4590,"aliases":4591,"sourceIds":4594,"published":4595,"modified":4596,"checkedAt":7,"severity":4597,"references":4600,"versionKeys":4617,"packageCount":32,"repositoryCount":2486},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[4592,4593],"CVE-2025-68146","PYSEC-2026-1375",[223,4593],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[4598],{"type":1299,"score":4599},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[4601,4603,4605,4606,4608,4610,4612,4613,4615],{"type":1312,"url":4602},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1312,"url":4604},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1317,"url":4194},{"type":1312,"url":4607},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1312,"url":4609},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1312,"url":4611},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1317,"url":4196},{"type":1309,"url":4614},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1309,"url":4616},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[4200,4201,4202,4203],{"id":224,"slug":4619,"dossier":47,"summary":4620,"aliases":4621,"sourceIds":4625,"published":4626,"modified":4627,"checkedAt":7,"severity":4628,"references":4631,"versionKeys":4669,"packageCount":32,"repositoryCount":355},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[4622,4623,4624],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[224,4624],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[4629,4630],{"type":1299,"score":1571},{"type":1302,"score":4157},[4632,4634,4636,4638,4640,4641,4643,4645,4647,4649,4651,4653,4654,4656,4658,4660,4661,4663,4665,4667],{"type":1312,"url":4633},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1309,"url":4635},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1312,"url":4637},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1312,"url":4639},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1317,"url":1744},{"type":1312,"url":4642},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1312,"url":4644},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1312,"url":4646},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1309,"url":4648},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1309,"url":4650},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1309,"url":4652},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1309,"url":3006},{"type":1309,"url":4655},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1309,"url":4657},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1309,"url":4659},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1309,"url":3008},{"type":1309,"url":4662},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1309,"url":4664},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1309,"url":4666},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1309,"url":4668},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1748,1749,1750,1751,1752,1753,1754,1755],{"id":225,"slug":4671,"dossier":47,"summary":4672,"aliases":4673,"sourceIds":4677,"published":4678,"modified":4679,"checkedAt":7,"severity":4680,"references":4683,"versionKeys":4692,"packageCount":32,"repositoryCount":355},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[4674,4675,4676],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[225,4676],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[4681,4682],{"type":1299,"score":1506},{"type":1302,"score":2072},[4684,4686,4688,4690,4691],{"type":1309,"url":4685},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1309,"url":4687},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1312,"url":4689},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1317,"url":1744},{"type":1309,"url":2080},[1748,1749,1750,1751,1752,1753,1754,1755],{"id":226,"slug":4694,"dossier":47,"summary":3565,"aliases":4695,"sourceIds":4698,"published":3570,"modified":4699,"checkedAt":7,"severity":4700,"references":4703,"versionKeys":4717,"packageCount":32,"repositoryCount":32},"ghsa-wrfc-pvp9-mr9g-c6b03ddf",[4696,4697],"CVE-2024-11393","PYSEC-2024-228",[226,4697],"2026-09-10T03:50:55.987633957Z",[4701,4702],{"type":1299,"score":3574},{"type":1299,"score":1300},[4704,4706,4707,4708,4709,4711,4713,4715],{"type":1309,"url":4705},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11393",{"type":1312,"url":3580},{"type":1312,"url":3582},{"type":1317,"url":1409},{"type":1312,"url":4710},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-228.yaml",{"type":1312,"url":4712},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514",{"type":1309,"url":4714},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514\u002F",{"type":1309,"url":4716},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wrfc-pvp9-mr9g",[1415],{"id":227,"slug":4719,"dossier":47,"summary":4720,"aliases":4721,"sourceIds":4724,"published":4725,"modified":4726,"checkedAt":7,"severity":4727,"references":4729,"versionKeys":4744,"packageCount":32,"repositoryCount":103},"ghsa-wvpp-8hx9-p66j-188b3951","GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution",[4722,4723],"CVE-2026-76220","PYSEC-2026-3843",[227,4723],"2026-08-07T15:49:07Z","2026-09-10T12:26:01.792035310Z",[4728],{"type":1299,"score":1435},[4730,4732,4734,4735,4737,4738,4739,4741,4742],{"type":1312,"url":4731},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",{"type":1309,"url":4733},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-76220",{"type":1312,"url":1802},{"type":1312,"url":4736},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fcommit\u002F96a888f4d782cb2f80452148e48e60ce4af6d541",{"type":1317,"url":1318},{"type":1312,"url":1807},{"type":1312,"url":4740},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fgitpython-before-command-execution-via-split-single-char-options",{"type":1317,"url":1451},{"type":1309,"url":4743},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wvpp-8hx9-p66j",[1326,1327,1328],{"id":228,"slug":4746,"dossier":47,"summary":4747,"aliases":4748,"sourceIds":4750,"published":4751,"modified":4752,"checkedAt":7,"severity":4753,"references":4756,"versionKeys":4768,"packageCount":32,"repositoryCount":404},"ghsa-wwv5-g3v4-889x-b37c7c95","Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`",[4749],"CVE-2026-91991",[228],"2026-09-01T20:17:23Z","2026-09-16T03:56:00.367681644Z",[4754],{"type":1302,"score":4755},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4757,4759,4760,4762,4764,4766,4767],{"type":1312,"url":4758},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fsecurity\u002Fadvisories\u002FGHSA-wwv5-g3v4-889x",{"type":1312,"url":2530},{"type":1312,"url":4761},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fpull\u002F3706",{"type":1312,"url":4763},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002F6ef836e43e1278530041376adb32504daa977b91",{"type":1312,"url":4765},"https:\u002F\u002Fgithub.com\u002Ftornadoweb\u002Ftornado\u002Fcommit\u002Fda284767eae8e1f0484f123b8c3225f6465b09c7",{"type":1317,"url":1633},{"type":1312,"url":2537},[1641,1642],{"id":229,"slug":4770,"dossier":47,"summary":4771,"aliases":4772,"sourceIds":4775,"published":4776,"modified":4777,"checkedAt":7,"severity":4778,"references":4782,"versionKeys":4791,"packageCount":32,"repositoryCount":103},"ghsa-x2qx-6953-8485-107f8fe2","GitPython: Unsafe option check validates multi_options before shlex.split transformation",[4773,4774],"CVE-2026-42284","PYSEC-2026-2161",[229,4774],"2026-04-25T23:41:49Z","2026-09-10T03:51:03.787491179Z",[4779,4781],{"type":1299,"score":4780},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1299,"score":1375},[4783,4785,4787,4788,4789],{"type":1306,"url":4784},"https:\u002F\u002Fgithub.com\u002Fgitpython-developers\u002FGitPython\u002Fsecurity\u002Fadvisories\u002FGHSA-x2qx-6953-8485",{"type":1309,"url":4786},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42284",{"type":1317,"url":1318},{"type":1347,"url":4384},{"type":1312,"url":4790},"https:\u002F\u002Fwww.tenable.com\u002Fcve\u002FCVE-2026-32686",[1326,1327,1328],{"id":230,"slug":4793,"dossier":47,"summary":4794,"aliases":4795,"sourceIds":4799,"published":4800,"modified":4801,"checkedAt":7,"severity":4802,"references":4807,"versionKeys":4823,"packageCount":32,"repositoryCount":404},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[4796,4797,4798],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[230],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[4803,4805],{"type":1299,"score":4804},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":1302,"score":4806},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4808,4810,4812,4814,4816,4817,4819,4821],{"type":1309,"url":4809},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1312,"url":4811},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1312,"url":4813},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1312,"url":4815},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1317,"url":1518},{"type":1312,"url":4818},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1312,"url":4820},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1312,"url":4822},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1530,1531],{"id":231,"slug":4825,"dossier":47,"summary":4826,"aliases":4827,"sourceIds":4829,"published":4830,"modified":4831,"checkedAt":7,"severity":4832,"references":4834,"versionKeys":4846,"packageCount":32,"repositoryCount":42},"ghsa-x9r9-c232-4q39-1586e326","Hugging Face Transformers downloads custom generation code before trust consent",[4828],"CVE-2026-80047",[231],"2026-09-01T15:31:13Z","2026-10-01T00:00:04.718526734Z",[4833],{"type":1299,"score":2374},[4835,4837,4839,4841,4842,4844],{"type":1309,"url":4836},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80047",{"type":1312,"url":4838},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F48620",{"type":1312,"url":4840},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fcbc1651a032b923da7f4b44b3d0e6f68e6ba6b55",{"type":1317,"url":1409},{"type":1312,"url":4843},"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1312,"url":4845},"https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F456290",[1416,1417,1418,1419,1420,1421,1422,1423,4847],"pypi:transformers@5.8.0",{"id":232,"slug":4849,"dossier":47,"summary":4850,"aliases":4851,"sourceIds":4855,"published":4856,"modified":4857,"checkedAt":7,"severity":4858,"references":4860,"versionKeys":4874,"packageCount":32,"repositoryCount":34},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[4852,4853,4854],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[232,4854],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[4859],{"type":1299,"score":2314},[4861,4863,4865,4867,4869,4871,4872],{"type":1309,"url":4862},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1309,"url":4864},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1312,"url":4866},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1347,"url":4868},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1312,"url":4870},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1317,"url":1744},{"type":1312,"url":4873},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1751],{"id":233,"slug":4876,"dossier":90,"summary":4877,"aliases":4878,"sourceIds":4882,"published":4883,"modified":4884,"checkedAt":7,"severity":4885,"references":4888,"versionKeys":4899,"packageCount":32,"repositoryCount":1757},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[4879,4880,4881],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[233,4881],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[4886],{"type":1299,"score":4887},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[4889,4891,4893,4895,4897,4898],{"type":1306,"url":4890},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1309,"url":4892},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1347,"url":4894},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1347,"url":4896},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1317,"url":1744},{"type":1309,"url":2130},[1748,1749,1750,1751,1752,1753,1754,1755,1756],{"id":234,"slug":4901,"dossier":47,"summary":4902,"aliases":4903,"sourceIds":4906,"published":4907,"modified":4908,"checkedAt":7,"severity":4909,"references":4912,"versionKeys":4925,"packageCount":32,"repositoryCount":2082},"ghsa-xrqw-3rrv-vx5w-3d985837","Transformers save_pretrained path traversal allows arbitrary file writes through chat template names",[4904,4905],"CVE-2026-9856","PYSEC-2026-3929",[234,4905],"2026-08-02T18:30:20Z","2026-09-10T12:25:36.528730268Z",[4910],{"type":1299,"score":4911},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4913,4915,4917,4919,4920,4922,4923],{"type":1309,"url":4914},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9856",{"type":1312,"url":4916},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F46191",{"type":1312,"url":4918},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Feaaaf8494dd5386634ae37d1d122212fdc315be5",{"type":1317,"url":1409},{"type":1312,"url":4921},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F362824d5-fe18-40e8-a6cf-62277f97a170",{"type":1317,"url":1556},{"type":1309,"url":4924},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xrqw-3rrv-vx5w",[1415,1416,1417,1418,1419,1420,1421,1422,1423,4847],{"id":235,"slug":4927,"dossier":47,"summary":83,"aliases":4928,"sourceIds":4931,"published":4932,"modified":4933,"checkedAt":7,"severity":4934,"references":4937,"versionKeys":4946,"packageCount":32,"repositoryCount":32},"pysec-2025-112-653e8a7c",[4929,4930],"CVE-2025-64429","GHSA-vmp8-hg63-v2hp",[235],"2025-11-12T22:15:49.813Z","2026-05-20T09:18:59.601738Z",[4935],{"type":1299,"score":4936},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4938,4940,4942,4944],{"type":1312,"url":4939},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fblob\u002F029a5b87ff5b1cd22f7f9717d48cd8830d00807c\u002Fsrc\u002Fcommon\u002Frandom_engine.cpp#L20",{"type":1309,"url":4941},"https:\u002F\u002Fduckdb.org\u002F2025\u002F09\u002F16\u002Fannouncing-duckdb-140.html",{"type":1309,"url":4943},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fsecurity\u002Fadvisories\u002FGHSA-vmp8-hg63-v2hp",{"type":1347,"url":4945},"https:\u002F\u002Fgithub.com\u002Fduckdb\u002Fduckdb\u002Fpull\u002F17275",[4947],"pypi:duckdb@1.4.1",{"id":236,"slug":4949,"dossier":47,"summary":83,"aliases":4950,"sourceIds":4953,"published":4954,"modified":4955,"checkedAt":7,"severity":4956,"references":4958,"versionKeys":4967,"packageCount":32,"repositoryCount":404},"pysec-2025-198-62b25ed4",[4951,4952],"BIT-pytorch-2025-46148","CVE-2025-46148",[236],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[4957],{"type":1299,"score":4099},[4959,4961,4963,4965],{"type":1309,"url":4960},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1309,"url":4962},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1511,"url":4964},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1347,"url":4966},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1530,1531],{"id":237,"slug":4969,"dossier":47,"summary":83,"aliases":4970,"sourceIds":4973,"published":4974,"modified":4975,"checkedAt":7,"severity":4976,"references":4978,"versionKeys":4984,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[4971,4972],"BIT-pytorch-2025-46149","CVE-2025-46149",[237],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[4977],{"type":1299,"score":4099},[4979,4980,4982],{"type":1309,"url":4960},{"type":1511,"url":4981},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1347,"url":4983},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1531],{"id":238,"slug":4986,"dossier":47,"summary":83,"aliases":4987,"sourceIds":4990,"published":4991,"modified":4992,"checkedAt":7,"severity":4993,"references":4995,"versionKeys":5003,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[4988,4989],"BIT-pytorch-2025-46150","CVE-2025-46150",[238],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[4994],{"type":1299,"score":4099},[4996,4997,4999,5001],{"type":1309,"url":4960},{"type":1511,"url":4998},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1511,"url":5000},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1347,"url":5002},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1531],{"id":239,"slug":5005,"dossier":47,"summary":83,"aliases":5006,"sourceIds":5009,"published":5010,"modified":5011,"checkedAt":7,"severity":5012,"references":5014,"versionKeys":5020,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[5007,5008],"BIT-pytorch-2025-46152","CVE-2025-46152",[239],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[5013],{"type":1299,"score":1544},[5015,5016,5018],{"type":1309,"url":4960},{"type":1511,"url":5017},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1347,"url":5019},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1531],{"id":240,"slug":5022,"dossier":47,"summary":83,"aliases":5023,"sourceIds":5026,"published":5027,"modified":5028,"checkedAt":7,"severity":5029,"references":5031,"versionKeys":5041,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[5024,5025],"BIT-pytorch-2025-46153","CVE-2025-46153",[240],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[5030],{"type":1299,"score":4099},[5032,5034,5035,5037,5039],{"type":1312,"url":5033},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1309,"url":4960},{"type":1309,"url":5036},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1511,"url":5038},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1347,"url":5040},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1531],{"id":241,"slug":5043,"dossier":47,"summary":83,"aliases":5044,"sourceIds":5047,"published":5048,"modified":5049,"checkedAt":7,"severity":5050,"references":5052,"versionKeys":5057,"packageCount":32,"repositoryCount":66},"pysec-2025-203-2febb201",[5045,5046],"BIT-pytorch-2025-55551","CVE-2025-55551",[241],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[5051],{"type":1299,"score":1571},[5053,5055],{"type":1309,"url":5054},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1511,"url":5056},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1530,1531,1532,2576,2577,4141],{"id":242,"slug":5059,"dossier":47,"summary":83,"aliases":5060,"sourceIds":5063,"published":5064,"modified":5065,"checkedAt":7,"severity":5066,"references":5068,"versionKeys":5072,"packageCount":32,"repositoryCount":66},"pysec-2025-204-cdae47da",[5061,5062],"BIT-pytorch-2025-55552","CVE-2025-55552",[242],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[5067],{"type":1299,"score":1571},[5069,5070],{"type":1309,"url":5054},{"type":1511,"url":5071},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1530,1531,1532,2576,2577,4141],{"id":243,"slug":5074,"dossier":47,"summary":83,"aliases":5075,"sourceIds":5078,"published":5079,"modified":5080,"checkedAt":7,"severity":5081,"references":5083,"versionKeys":5089,"packageCount":32,"repositoryCount":385},"pysec-2025-205-fd5e58fd",[5076,5077],"BIT-pytorch-2025-55553","CVE-2025-55553",[243],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[5082],{"type":1299,"score":1571},[5084,5085,5087],{"type":1309,"url":5054},{"type":1511,"url":5086},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1347,"url":5088},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1530,1531,1532],{"id":244,"slug":5091,"dossier":47,"summary":83,"aliases":5092,"sourceIds":5095,"published":5096,"modified":5097,"checkedAt":7,"severity":5098,"references":5100,"versionKeys":5104,"packageCount":32,"repositoryCount":66},"pysec-2025-206-58322476",[5093,5094],"BIT-pytorch-2025-55554","CVE-2025-55554",[244],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[5099],{"type":1299,"score":1544},[5101,5102],{"type":1309,"url":5054},{"type":1511,"url":5103},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1530,1531,1532,2576,2577,4141],{"id":245,"slug":5106,"dossier":47,"summary":83,"aliases":5107,"sourceIds":5110,"published":5111,"modified":5112,"checkedAt":7,"severity":5113,"references":5115,"versionKeys":5121,"packageCount":32,"repositoryCount":385},"pysec-2025-207-2abef3fc",[5108,5109],"BIT-pytorch-2025-55557","CVE-2025-55557",[245],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[5114],{"type":1299,"score":1571},[5116,5117,5119],{"type":1309,"url":5054},{"type":1511,"url":5118},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1347,"url":5120},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1530,1531,1532],{"id":246,"slug":5123,"dossier":47,"summary":83,"aliases":5124,"sourceIds":5127,"published":5128,"modified":5129,"checkedAt":7,"severity":5130,"references":5132,"versionKeys":5138,"packageCount":32,"repositoryCount":385},"pysec-2025-208-6e93fe9d",[5125,5126],"BIT-pytorch-2025-55558","CVE-2025-55558",[246],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[5131],{"type":1299,"score":1571},[5133,5134,5136],{"type":1309,"url":5054},{"type":1511,"url":5135},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1347,"url":5137},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1530,1531,1532],{"id":247,"slug":5140,"dossier":47,"summary":83,"aliases":5141,"sourceIds":5144,"published":5145,"modified":5146,"checkedAt":7,"severity":5147,"references":5149,"versionKeys":5155,"packageCount":32,"repositoryCount":385},"pysec-2025-209-e6f352b0",[5142,5143],"BIT-pytorch-2025-55560","CVE-2025-55560",[247],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[5148],{"type":1299,"score":1571},[5150,5151,5153],{"type":1309,"url":5054},{"type":1511,"url":5152},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1347,"url":5154},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1530,1531,1532],{"id":248,"slug":5157,"dossier":47,"summary":83,"aliases":5158,"sourceIds":5160,"published":5161,"modified":5162,"checkedAt":7,"severity":5163,"references":5165,"versionKeys":5168,"packageCount":32,"repositoryCount":5169},"pysec-2025-211-d8bd15de",[5159],"CVE-2025-14920",[248],"2025-12-23T21:15:47.183Z","2026-05-21T15:00:32.080516132Z",[5164],{"type":1299,"score":1402},[5166],{"type":1309,"url":5167},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1150\u002F",[1415,1416,1417,1418,1419],5,{"id":249,"slug":5171,"dossier":47,"summary":83,"aliases":5172,"sourceIds":5174,"published":5175,"modified":5176,"checkedAt":7,"severity":5177,"references":5179,"versionKeys":5182,"packageCount":32,"repositoryCount":5169},"pysec-2025-212-a011b97d",[5173],"CVE-2025-14921",[249],"2025-12-23T21:15:47.340Z","2026-05-21T15:00:32.052313357Z",[5178],{"type":1299,"score":1402},[5180],{"type":1309,"url":5181},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1149\u002F",[1415,1416,1417,1418,1419],{"id":250,"slug":5184,"dossier":47,"summary":83,"aliases":5185,"sourceIds":5187,"published":5188,"modified":5189,"checkedAt":7,"severity":5190,"references":5192,"versionKeys":5195,"packageCount":32,"repositoryCount":5169},"pysec-2025-213-9043dc9b",[5186],"CVE-2025-14924",[250],"2025-12-23T21:15:47.600Z","2026-05-21T15:00:32.048516839Z",[5191],{"type":1299,"score":1402},[5193],{"type":1309,"url":5194},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1141\u002F",[1415,1416,1417,1418,1419],{"id":251,"slug":5197,"dossier":47,"summary":83,"aliases":5198,"sourceIds":5200,"published":5201,"modified":5202,"checkedAt":7,"severity":5203,"references":5205,"versionKeys":5208,"packageCount":32,"repositoryCount":5169},"pysec-2025-214-eb241255",[5199],"CVE-2025-14926",[251],"2025-12-23T21:15:47.857Z","2026-05-21T15:00:32.929011749Z",[5204],{"type":1299,"score":1402},[5206],{"type":1309,"url":5207},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1147\u002F",[1415,1416,1417,1418,1419],{"id":252,"slug":5210,"dossier":47,"summary":83,"aliases":5211,"sourceIds":5213,"published":5214,"modified":5215,"checkedAt":7,"severity":5216,"references":5218,"versionKeys":5221,"packageCount":32,"repositoryCount":5169},"pysec-2025-215-6064f491",[5212],"CVE-2025-14927",[252],"2025-12-23T21:15:47.987Z","2026-05-21T15:00:32.888290877Z",[5217],{"type":1299,"score":1402},[5219],{"type":1309,"url":5220},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1148\u002F",[1415,1416,1417,1418,1419],{"id":253,"slug":5223,"dossier":47,"summary":83,"aliases":5224,"sourceIds":5226,"published":5227,"modified":5228,"checkedAt":7,"severity":5229,"references":5231,"versionKeys":5234,"packageCount":32,"repositoryCount":5169},"pysec-2025-216-5708ed01",[5225],"CVE-2025-14928",[253],"2025-12-23T21:15:48.110Z","2026-05-21T15:00:32.939311939Z",[5230],{"type":1299,"score":1402},[5232],{"type":1309,"url":5233},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1146\u002F",[1415,1416,1417,1418,1419],{"id":254,"slug":5236,"dossier":47,"summary":83,"aliases":5237,"sourceIds":5239,"published":5240,"modified":5241,"checkedAt":7,"severity":5242,"references":5244,"versionKeys":5247,"packageCount":32,"repositoryCount":42},"pysec-2025-217-2c1ad388",[5238],"CVE-2025-14929",[254],"2025-12-23T21:15:48.240Z","2026-05-21T15:00:24.271970226Z",[5243],{"type":1299,"score":1402},[5245],{"type":1309,"url":5246},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1144\u002F",[1415,1416,1417,1418,1419,1420,1421,1422,1423],{"id":255,"slug":5249,"dossier":47,"summary":83,"aliases":5250,"sourceIds":5252,"published":5253,"modified":5254,"checkedAt":7,"severity":5255,"references":5257,"versionKeys":5260,"packageCount":32,"repositoryCount":1784},"pysec-2025-218-39811fc3",[5251],"CVE-2025-14930",[255],"2025-12-23T21:15:48.367Z","2026-05-21T15:00:33.791364554Z",[5256],{"type":1299,"score":1402},[5258],{"type":1309,"url":5259},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1145\u002F",[1415,1416,1417,1418,1419,1420],{"id":256,"slug":5262,"dossier":47,"summary":83,"aliases":5263,"sourceIds":5266,"published":5267,"modified":5268,"checkedAt":7,"severity":5269,"references":5271,"versionKeys":5282,"packageCount":32,"repositoryCount":5283},"pysec-2026-139-96951ff6",[5264,5265],"BIT-pytorch-2026-4538","CVE-2026-4538",[256],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[5270],{"type":1299,"score":2374},[5272,5274,5276,5278,5280],{"type":1312,"url":5273},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1309,"url":5275},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1309,"url":5277},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1511,"url":5279},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1347,"url":5281},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[4417,1530,1531,1532,2576,2577,4141,4142,4143,4144],14,{"id":257,"slug":5285,"dossier":90,"summary":83,"aliases":5286,"sourceIds":5289,"published":5290,"modified":5291,"checkedAt":7,"severity":5292,"references":5295,"versionKeys":5310,"packageCount":32,"repositoryCount":1757},"pysec-2026-2132-627bf7c7",[5287,5288],"CVE-2026-7246","GHSA-47fr-3ffg-hgmw",[257],"2026-04-30T14:16:36.433Z","2026-07-13T07:15:21.899333658Z",[5293],{"type":1299,"score":5294},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[5296,5298,5300,5302,5304,5306,5308],{"type":1312,"url":5297},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-7246",{"type":1312,"url":5299},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-7246.json",{"type":1309,"url":5301},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24761",{"type":1309,"url":5303},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24762",{"type":1511,"url":5305},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2464121",{"type":1347,"url":5307},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fclick\u002Freleases\u002Ftag\u002F8.3.3",{"type":1306,"url":5309},"https:\u002F\u002Fgithub.com\u002Ftsigouris007\u002Fsecurity-advisories\u002Fsecurity\u002Fadvisories\u002FGHSA-47fr-3ffg-hgmw",[5311,5312,5313,5314,5315,5316],"pypi:click@8.1.7","pypi:click@8.1.8","pypi:click@8.2.0","pypi:click@8.2.1","pypi:click@8.3.0","pypi:click@8.3.1",{"id":258,"slug":5318,"dossier":47,"summary":83,"aliases":5319,"sourceIds":5324,"published":5325,"modified":5326,"checkedAt":7,"severity":5327,"references":5329,"versionKeys":5346,"packageCount":32,"repositoryCount":2486},"pysec-2026-2286-8795b007",[5320,5321,5322,5323],"BIT-pytorch-2026-24747","CVE-2026-24747","GHSA-63cw-57p8-fm3p","PYSEC-2026-1856",[258],"2026-01-27T22:15:56.470Z","2026-07-13T07:26:23.701611780Z",[5328],{"type":1299,"score":1300},[5330,5332,5334,5336,5338,5340,5342,5344],{"type":1312,"url":5331},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1312,"url":5333},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",{"type":1309,"url":5335},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1309,"url":5337},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1309,"url":5339},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1511,"url":5341},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1511,"url":5343},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1347,"url":5345},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",[1530,1531,1532,2576,2577,4141,4142,4143,4144],1790829721423]