[{"data":1,"prerenderedAt":6841},["ShallowReactive",2],{"ki-abhaengigkeitsatlas-repository-opencode-14333":3},{"schemaVersion":4,"dataset":5,"parserVersion":6,"generatedAt":7,"trackingSince":8,"source":9,"coverage":29,"methodology":43,"summary":62,"kind":77,"entity":78,"evidence":328,"related":331},"ki-abhaengigkeitsatlas\u002Fv1","german-public-sector-ai-dependency-atlas","1","2026-11-15T08:34:11.365Z","2026-07-18T21:20:30.334Z",{"codeRadar":10,"openCode":15,"depsDev":18,"osv":21,"spdx":24},{"dataset":11,"generatedAt":12,"parserVersion":13,"url":14},"german-public-sector-ai-code-radar","2026-11-15T08:32:06.031Z","3","https:\u002F\u002Fi6eal.de\u002Ftools\u002Fki-code-radar\u002F",{"label":16,"url":17},"openCode GitLab","https:\u002F\u002Fgitlab.opencode.de\u002F",{"label":19,"url":20},"deps.dev API v3","https:\u002F\u002Fdocs.deps.dev\u002Fapi\u002Fv3\u002F",{"label":22,"url":23},"OSV API","https:\u002F\u002Fgoogle.github.io\u002Fosv.dev\u002Fapi\u002F",{"label":25,"url":26,"version":27,"releaseDate":28},"SPDX License List","https:\u002F\u002Fspdx.org\u002Flicenses\u002F","3.29.0","2026-09-16T00:00:00Z",{"repositoryCount":30,"completeTreeCount":31,"incompleteTreeCount":32,"lockfileRepositoryCount":33,"sbomRepositoryCount":34,"artifactRepositoryCount":35,"resolvedRepositoryCount":36,"resolvedArtifactRepositoryCount":35,"dependencyFileCount":37,"parsedFileCount":38,"parseErrorCount":32,"unsupportedFileCount":39,"evaluatedVersionCount":40,"metadataResolvedCount":41,"metadataNotFoundCount":42,"osvEvaluatedVersionCount":40,"codeRadarRepositoryCount":30},49,48,1,29,6,33,45,47,46,0,5086,5074,12,{"componentParserSchemaVersion":44,"candidateBoundary":45,"resolvedVersionBoundary":46,"manifestRangesResolved":47,"latestVersionSubstitution":47,"containerTagsVulnerabilityChecked":47,"osvClaim":48,"depsDevLicenseSemantics":49,"providerSemantics":50,"generativeAiUsed":47,"scoreUsed":47,"treeEntryCeiling":51,"fileByteCeiling":52,"uniqueVersionCeiling":53,"observedFormats":54},"ki-dependency-atlas-components\u002Fv1","repositories_with_exact_ai_code_evidence","exact_lockfile_or_sbom_component_or_exact_double_equals_manifest_pin",false,"osv_matched_observed_resolved_package_version_at_collection_time","spdx_expressions_as_reported_without_inferred_compatibility","package_interface_presence_not_api_configuration_procurement_or_use",2500,5242880,8000,[55,56,57,58,59,60,61],"package-lock.json \u002F npm-shrinkwrap.json","uv.lock","poetry.lock","Pipfile.lock","CycloneDX JSON","SPDX JSON or YAML","exact == manifest pins",{"repositoryCount":30,"packageCount":63,"aiPackageCount":64,"resolvedComponentCount":65,"resolvedVersionCount":40,"providerExposureRepositoryCount":66,"licenseExpressionCount":67,"knownLicensePackageCount":68,"unknownLicensePackageCount":69,"advisoryCount":70,"matchedAdvisoryRepositoryCount":71,"topPackage":72},2871,51,9941,11,63,2832,39,1120,43,{"id":73,"slug":74,"label":75,"repositoryCount":33,"repositoryShare":76},"package:pypi:typing-extensions","typing-extensions-87d153eb","typing-extensions",0.5918367346938775,"repository",{"id":79,"slug":80,"gitlabProjectId":81,"name":82,"pathWithNamespace":83,"description":84,"webUrl":85,"commitSha":86,"commitUrl":87,"lastActivityAt":88,"headCommittedAt":89,"tree":90,"files":93,"resolvedComponentCount":101,"artifactResolvedComponentCount":101,"exactManifestPinCount":39,"packageCount":101,"ecosystems":102,"aiPackageCount":104,"licenseExpressionCount":105,"unknownLicensePackageCount":32,"advisoryIds":106,"advisoryCount":326,"providers":327},"opencode:14333","opencode-14333",14333,"URBAN.KI AirGuardAI","vernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai",null,"https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai","25e76382daca051de472efd8a32f7fa276ae36d0","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai\u002F-\u002Fcommit\u002F25e76382daca051de472efd8a32f7fa276ae36d0","2026-11-11T20:31:43.634Z","2026-11-11T20:31:28.000Z",{"complete":91,"entryCount":92,"truncated":47},true,95,[94],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},"uv-lock","d8e9658e0c9c7ed8859da5223f957aa8010f39de","https:\u002F\u002Fgitlab.opencode.de\u002Fvernetzte-stadt-gelsenkirchen\u002Furban.ki\u002Furban.ki-airguardai\u002F-\u002Fblob\u002F25e76382daca051de472efd8a32f7fa276ae36d0\u002Fuv.lock","59cb0231b92ede8e7f9c5ef5b78867b9fa36e7a4e0fc2600956a5c532b08c9e0",313514,"parsed",102,[103],"pypi",7,18,[107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275,276,277,278,279,280,281,282,283,284,285,286,287,288,289,290,291,292,293,294,295,296,297,298,299,300,301,302,303,304,305,306,307,308,309,310,311,312,313,314,315,316,317,318,319,320,321,322,323,324,325],"GHSA-22hg-r758-rrw9","GHSA-248v-346w-9cwc","GHSA-24rc-8hj2-v98c","GHSA-254f-3936-288h","GHSA-27h8-gf7j-v5hc","GHSA-27vj-qcqg-25rc","GHSA-29pf-2h5f-8g72","GHSA-2c2j-9gv5-cj73","GHSA-2fqr-mr3j-6wp8","GHSA-2g87-pp6c-29x5","GHSA-2vrm-gr82-f7m5","GHSA-2xpw-w6gg-jr37","GHSA-332p-7hrc-92wf","GHSA-3749-ghw9-m3mg","GHSA-379c-qx7v-6h59","GHSA-37mw-44qp-f5jm","GHSA-38jv-5279-wg99","GHSA-3j72-p6qg-6xp7","GHSA-3wq7-rqq7-wx6j","GHSA-4558-3h8r-v8xp","GHSA-45hq-cxwh-f6vc","GHSA-462x-pgg6-55fp","GHSA-48p4-8xcf-vxj5","GHSA-494j-54xm-rwp3","GHSA-4fvr-rgm6-gqmc","GHSA-4j2p-28q2-5m79","GHSA-4m7w-qmgq-4wj5","GHSA-4rm8-3hmm-39fg","GHSA-4rr5-89j8-mwwm","GHSA-4w7r-h757-3r74","GHSA-4x4j-2g7c-83w6","GHSA-5239-wwwm-4pmq","GHSA-53q9-r3pm-6pq6","GHSA-54jq-c3m8-4m76","GHSA-54p9-h82j-f925","GHSA-567q-5qvw-pf92","GHSA-58r4-6rv3-gfh8","GHSA-59g5-xgcq-4qw3","GHSA-59p9-h35m-wg4g","GHSA-5p39-cfhj-2xmp","GHSA-5rjg-fvgr-3xxf","GHSA-5rvq-cxj2-64vf","GHSA-5wr8-gcqf-gqf3","GHSA-5x8w-8jj5-q52h","GHSA-5x94-69rx-g8h2","GHSA-5xm2-6676-qcp9","GHSA-5xmw-vc9v-4wf2","GHSA-62p4-gmf7-7g93","GHSA-63cw-57p8-fm3p","GHSA-63hf-3vf5-4wqf","GHSA-63hw-fmq6-xxg2","GHSA-654x-cwwv-5j9c","GHSA-65pc-fj4g-8rjx","GHSA-65qm-jvmh-6pqg","GHSA-69f9-5gxw-wvc2","GHSA-69hj-f68j-2879","GHSA-69w3-r845-3855","GHSA-6cjc-53gc-5rqm","GHSA-6jhg-hg63-jvvf","GHSA-6jv3-5f52-599m","GHSA-6mq8-rvhq-8wgg","GHSA-6q48-6c7w-9gw2","GHSA-6r8x-57c9-28j4","GHSA-6rvg-6v2m-4j46","GHSA-74r2-7ff9-mjj2","GHSA-768j-98cg-p3fv","GHSA-78g4-xqwv-q3g8","GHSA-7f5h-v6xp-fcq8","GHSA-7mwm-ghpf-9vrm","GHSA-82r6-8w77-94w6","GHSA-82w8-qh3p-5jfq","GHSA-86qp-5c8j-p5mr","GHSA-887c-mr87-cxwp","GHSA-8988-9cw3-xx77","GHSA-8g5g-8vmr-9782","GHSA-8mx5-7m5m-r77g","GHSA-8v84-f9pq-wr9x","GHSA-9356-575x-2w9m","GHSA-9548-qrrj-x5pj","GHSA-966j-vmvw-g2g9","GHSA-9hjg-9r4m-mvj7","GHSA-9hw9-ch79-4vh6","GHSA-9v9v-9qvf-h2hj","GHSA-9vhv-jxww-xfm5","GHSA-9wx4-h78v-vm56","GHSA-9x8q-7h8h-wcw9","GHSA-9xw5-w5jj-pvcg","GHSA-c427-h43c-vf67","GHSA-c678-jfcj-6jmf","GHSA-c6hw-5grf-ff96","GHSA-cfh3-3jmp-rvhc","GHSA-cp9v-662q-vvx9","GHSA-cpwx-vrp4-4pq7","GHSA-cq5v-8q36-5273","GHSA-cwqr-hh33-gh44","GHSA-cx63-2mw6-8hw5","GHSA-f2g6-542v-9j58","GHSA-f4hp-rmr7-r7v8","GHSA-f96h-pmfr-66vw","GHSA-f9xw-jh8m-3mwq","GHSA-fc9g-5qg7-mf45","GHSA-fgcw-684q-jj6r","GHSA-fh55-r93g-j68g","GHSA-fj7v-r99m-22gq","GHSA-fpwr-67px-3qhx","GHSA-fq56-3cx3-fjxp","GHSA-g3cq-j2xw-wf74","GHSA-g4qv-2jxx-769h","GHSA-g7cr-3p24-7wf7","GHSA-g7vv-2v7x-gj9p","GHSA-g842-9rc4-69pw","GHSA-g84x-mcqj-x9qq","GHSA-gc5v-m9x4-r6x2","GHSA-gg2r-wvfm-q9rx","GHSA-gh4c-6fx4-qh6g","GHSA-gm62-xv2j-4w53","GHSA-gmj6-6f8f-6699","GHSA-gx76-c99x-2c96","GHSA-h35f-9h28-mq5c","GHSA-h75v-3vvj-5mfj","GHSA-hcc4-c3v8-rx92","GHSA-hg6j-4rv6-33pg","GHSA-hpj7-wq8m-9hgp","GHSA-hx9q-6w63-j58v","GHSA-hxxf-235m-72v3","GHSA-j4m9-6w36-pw47","GHSA-j8f7-rjxc-mr56","GHSA-jg22-mg44-37j8","GHSA-jg86-v3jv-hrpm","GHSA-jj3x-wxrx-4x23","GHSA-jjj6-mw9f-p565","GHSA-jjph-296x-mrcr","GHSA-jp82-jpqv-5vv3","GHSA-jw8x-6495-233v","GHSA-m5qp-6w8w-w647","GHSA-m6qw-4cw2-hm4m","GHSA-mf9v-mfxr-j63j","GHSA-mf9w-mj56-hr94","GHSA-mfx4-hv73-q22v","GHSA-mj87-hwqh-73pj","GHSA-mq44-7p77-q5h7","GHSA-mqqc-3gqh-h2x8","GHSA-mrfp-p49p-3hf2","GHSA-mwh4-6h8g-pg8w","GHSA-p4wg-p73j-c528","GHSA-p8hx-v2p6-rp84","GHSA-p998-jp59-783m","GHSA-pchr-8j38-3x4p","GHSA-pg7v-jwj7-p798","GHSA-phhr-52qp-3mj4","GHSA-phj9-mv4w-65pm","GHSA-pp6c-gr5w-3c5g","GHSA-pq67-6m6q-mj2v","GHSA-pqxq-w44r-73xw","GHSA-pwv6-vv43-88gr","GHSA-q2wp-rjmx-x6x9","GHSA-q2x7-8rv6-6q7h","GHSA-q45j-58j2-45rg","GHSA-qccp-gfcp-xxvc","GHSA-qfhq-4f3w-5fph","GHSA-qmgc-5h2g-mvrw","GHSA-qq3j-4f4f-9583","GHSA-qxrp-vhvm-j765","GHSA-r73j-pqj5-w3x7","GHSA-rcv9-qm8p-9p6j","GHSA-rfgq-q3w2-pmv2","GHSA-rfpc-qcw5-3pc4","GHSA-rgxp-2hwp-jwgg","GHSA-rrmf-rvhw-rf47","GHSA-v4x8-3wr5-3wq8","GHSA-v9pg-7xvm-68hf","GHSA-v9pv-5gc8-w2m6","GHSA-vffw-93wf-4j4q","GHSA-vgrw-7cvw-pwgx","GHSA-vjc4-5qp5-m44j","GHSA-vqfr-h8mv-ghfj","GHSA-vx6w-vv9f-6gvg","GHSA-vxq7-64xx-v4gw","GHSA-w2fm-2cpv-w7v5","GHSA-w853-jp5j-5j7f","GHSA-w889-685w-c8fh","GHSA-whj4-6x5x-4v2j","GHSA-wjx4-4jcj-g98j","GHSA-wp53-j4wj-2cfg","GHSA-wqgw-9xfh-qf2g","GHSA-wqp7-x3pw-xc5r","GHSA-wrfc-pvp9-mr9g","GHSA-x3gm-94wq-g975","GHSA-x746-7m8f-x49c","GHSA-x9r9-c232-4q39","GHSA-xcgm-r5h9-7989","GHSA-xcvg-w56q-r89m","GHSA-xg8h-j46f-w952","GHSA-xgh8-jp6q-p5x8","GHSA-xj96-63gp-2gmr","GHSA-xmj3-9gf7-h52w","GHSA-xrqw-3rrv-vx5w","GHSA-xvh5-g6gv-559v","PYSEC-2025-198","PYSEC-2025-199","PYSEC-2025-200","PYSEC-2025-201","PYSEC-2025-202","PYSEC-2025-203","PYSEC-2025-204","PYSEC-2025-205","PYSEC-2025-206","PYSEC-2025-207","PYSEC-2025-208","PYSEC-2025-209","PYSEC-2025-211","PYSEC-2025-212","PYSEC-2025-213","PYSEC-2025-214","PYSEC-2025-215","PYSEC-2025-216","PYSEC-2025-217","PYSEC-2025-218","PYSEC-2026-139",219,[],{"files":329,"occurrenceCount":101},[330],{"path":56,"kind":95,"blobSha":96,"sourceUrl":97,"commitSha":86,"contentSha256":98,"byteCount":99,"state":100,"componentCount":101},{"packages":332,"vulnerabilities":1267},[333,347,358,368,378,387,396,406,417,428,437,447,457,466,476,485,495,505,515,524,533,542,551,560,571,580,590,599,609,619,628,637,646,655,664,673,682,691,700,709,718,727,735,744,753,762,771,780,789,798,806,815,824,833,842,851,860,869,879,888,897,906,915,924,933,942,951,960,969,978,987,995,1004,1012,1022,1030,1039,1047,1056,1065,1074,1083,1092,1101,1111,1120,1129,1138,1147,1156,1164,1173,1182,1190,1198,1204,1213,1222,1231,1240,1249,1258],{"id":334,"slug":335,"identity":336,"label":337,"aiRelevant":91,"provider":338,"advisoryCount":341,"licenseExpressions":342,"versions":344,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":346},"package:pypi:transformers","transformers-65289303","pypi:transformers","Transformers",{"id":339,"label":340},"hugging-face","Hugging Face",27,[343],"Apache-2.0",[345],"5.8.0",[56],{"id":348,"slug":349,"identity":350,"label":351,"aiRelevant":91,"provider":84,"advisoryCount":352,"licenseExpressions":353,"versions":355,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":357},"package:pypi:torch","torch-47a5352a","pypi:torch","PyTorch",23,[354],"BSD-3-Clause",[356],"2.11.0",[56],{"id":359,"slug":360,"identity":361,"label":362,"aiRelevant":91,"provider":363,"advisoryCount":32,"licenseExpressions":364,"versions":365,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":367},"package:pypi:datasets","datasets-e12c1359","pypi:datasets","Hugging Face Datasets",{"id":339,"label":340},[343],[366],"4.8.5",[56],{"id":369,"slug":370,"identity":371,"label":372,"aiRelevant":91,"provider":84,"advisoryCount":32,"licenseExpressions":373,"versions":375,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":377},"package:pypi:accelerate","accelerate-7fac5dd9","pypi:accelerate","Accelerate",[343,374],"non-standard",[376],"1.13.0",[56],{"id":379,"slug":380,"identity":381,"label":382,"aiRelevant":91,"provider":84,"advisoryCount":32,"licenseExpressions":383,"versions":384,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":386},"package:pypi:scikit-learn","scikit-learn-ab0941d9","pypi:scikit-learn","scikit-learn",[354,374],[385],"1.8.0",[56],{"id":388,"slug":389,"identity":390,"label":391,"aiRelevant":91,"provider":84,"advisoryCount":39,"licenseExpressions":392,"versions":393,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":395},"package:pypi:tokenizers","tokenizers-7ba00902","pypi:tokenizers","Hugging Face Tokenizers",[374],[394],"0.22.2",[56],{"id":397,"slug":398,"identity":399,"label":400,"aiRelevant":91,"provider":84,"advisoryCount":39,"licenseExpressions":401,"versions":403,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":405},"package:pypi:lightgbm","lightgbm-da1283c4","pypi:lightgbm","LightGBM",[402],"MIT",[404],"4.6.0",[56],{"id":407,"slug":408,"identity":409,"label":410,"aiRelevant":47,"provider":84,"advisoryCount":67,"licenseExpressions":411,"versions":414,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":416},"package:pypi:pillow","pillow-834347dd","pypi:pillow","pillow",[412,413],"HPND","MIT-CMU",[415],"12.2.0",[56],{"id":418,"slug":419,"identity":420,"label":421,"aiRelevant":47,"provider":84,"advisoryCount":422,"licenseExpressions":423,"versions":425,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":427},"package:pypi:aiohttp","aiohttp-5a806a63","pypi:aiohttp","aiohttp",41,[343,424],"Apache-2.0 AND MIT",[426],"3.13.5",[56],{"id":429,"slug":430,"identity":431,"label":432,"aiRelevant":47,"provider":84,"advisoryCount":66,"licenseExpressions":433,"versions":435,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":436},"package:pypi:filelock","filelock-b1c63968","pypi:filelock","filelock",[402,434],"Unlicense",[27],[56],{"id":438,"slug":439,"identity":440,"label":441,"aiRelevant":47,"provider":84,"advisoryCount":442,"licenseExpressions":443,"versions":444,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":446},"package:pypi:urllib3","urllib3-fa68f32c","pypi:urllib3","urllib3",10,[402],[445],"2.7.0",[56],{"id":448,"slug":449,"identity":450,"label":451,"aiRelevant":47,"provider":84,"advisoryCount":452,"licenseExpressions":453,"versions":454,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":456},"package:pypi:python-multipart","python-multipart-7d2a810e","pypi:python-multipart","python-multipart",8,[343],[455],"0.0.28",[56],{"id":458,"slug":459,"identity":460,"label":461,"aiRelevant":47,"provider":84,"advisoryCount":452,"licenseExpressions":462,"versions":463,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":465},"package:pypi:starlette","starlette-beb9e527","pypi:starlette","starlette",[354],[464],"1.0.0",[56],{"id":467,"slug":468,"identity":469,"label":470,"aiRelevant":47,"provider":84,"advisoryCount":471,"licenseExpressions":472,"versions":473,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":475},"package:pypi:jinja2","jinja2-f7d34747","pypi:jinja2","jinja2",4,[354,374],[474],"3.1.6",[56],{"id":477,"slug":478,"identity":479,"label":480,"aiRelevant":47,"provider":84,"advisoryCount":471,"licenseExpressions":481,"versions":482,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":484},"package:pypi:setuptools","setuptools-fe37c31a","pypi:setuptools","setuptools",[402],[483],"81.0.0",[56],{"id":486,"slug":487,"identity":488,"label":489,"aiRelevant":47,"provider":84,"advisoryCount":490,"licenseExpressions":491,"versions":492,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":494},"package:pypi:requests","requests-53653f76","pypi:requests","requests",3,[343],[493],"2.34.0",[56],{"id":496,"slug":497,"identity":498,"label":499,"aiRelevant":47,"provider":84,"advisoryCount":500,"licenseExpressions":501,"versions":502,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":504},"package:pypi:anyio","anyio-399e5280","pypi:anyio","anyio",2,[402],[503],"4.13.0",[56],{"id":506,"slug":507,"identity":508,"label":509,"aiRelevant":47,"provider":84,"advisoryCount":500,"licenseExpressions":510,"versions":512,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":514},"package:pypi:certifi","certifi-d4f0c37e","pypi:certifi","certifi",[511],"MPL-2.0",[513],"2026.4.22",[56],{"id":516,"slug":517,"identity":518,"label":519,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":520,"versions":521,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":523},"package:pypi:fonttools","fonttools-d2488ea8","pypi:fonttools","fonttools",[402],[522],"4.62.1",[56],{"id":525,"slug":526,"identity":527,"label":528,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":529,"versions":530,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":532},"package:pypi:fsspec","fsspec-b1a7c311","pypi:fsspec","fsspec",[354],[531],"2026.2.0",[56],{"id":534,"slug":535,"identity":536,"label":537,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":538,"versions":539,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":541},"package:pypi:h11","h11-48165ab1","pypi:h11","h11",[402],[540],"0.16.0",[56],{"id":543,"slug":544,"identity":545,"label":546,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":547,"versions":548,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":550},"package:pypi:idna","idna-994c9929","pypi:idna","idna",[354,374],[549],"3.14",[56],{"id":552,"slug":553,"identity":554,"label":555,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":556,"versions":557,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":559},"package:pypi:multidict","multidict-b407a4ac","pypi:multidict","multidict",[343],[558],"6.7.1",[56],{"id":561,"slug":562,"identity":563,"label":564,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":565,"versions":568,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":570},"package:pypi:orjson","orjson-0293c856","pypi:orjson","orjson",[566,567],"Apache-2.0 OR MIT","MPL-2.0 AND (Apache-2.0 OR MIT)",[569],"3.11.9",[56],{"id":572,"slug":573,"identity":574,"label":575,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":576,"versions":577,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":579},"package:pypi:pyarrow","pyarrow-facb8516","pypi:pyarrow","pyarrow",[343,374],[578],"24.0.0",[56],{"id":581,"slug":582,"identity":583,"label":584,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":585,"versions":587,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":589},"package:pypi:pygments","pygments-ad71bc11","pypi:pygments","pygments",[586],"BSD-2-Clause",[588],"2.20.0",[56],{"id":591,"slug":592,"identity":593,"label":594,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":595,"versions":596,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":598},"package:pypi:python-dotenv","python-dotenv-27b12285","pypi:python-dotenv","python-dotenv",[354],[597],"1.2.2",[56],{"id":600,"slug":601,"identity":602,"label":603,"aiRelevant":47,"provider":84,"advisoryCount":32,"licenseExpressions":604,"versions":606,"dossier":91,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":608},"package:pypi:tqdm","tqdm-04b01f90","pypi:tqdm","tqdm",[605],"MIT AND MPL-2.0",[607],"4.67.3",[56],{"id":610,"slug":611,"identity":612,"label":613,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":614,"versions":616,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":618},"package:pypi:aiohappyeyeballs","aiohappyeyeballs-ea4657b8","pypi:aiohappyeyeballs","aiohappyeyeballs",[615],"PSF-2.0",[617],"2.6.1",[56],{"id":620,"slug":621,"identity":622,"label":623,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":624,"versions":625,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":627},"package:pypi:aiosignal","aiosignal-b6794e75","pypi:aiosignal","aiosignal",[343],[626],"1.4.0",[56],{"id":629,"slug":630,"identity":631,"label":632,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":633,"versions":634,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":636},"package:pypi:annotated-doc","annotated-doc-9568e1af","pypi:annotated-doc","annotated-doc",[402],[635],"0.0.4",[56],{"id":638,"slug":639,"identity":640,"label":641,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":642,"versions":643,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":645},"package:pypi:attrs","attrs-2e7954ac","pypi:attrs","attrs",[402],[644],"26.1.0",[56],{"id":647,"slug":648,"identity":649,"label":650,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":651,"versions":652,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":654},"package:pypi:charset-normalizer","charset-normalizer-74ccb20a","pypi:charset-normalizer","charset-normalizer",[402],[653],"3.4.7",[56],{"id":656,"slug":657,"identity":658,"label":659,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":660,"versions":661,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":663},"package:pypi:click","click-ef97f731","pypi:click","click",[354,374],[662],"8.3.3",[56],{"id":665,"slug":666,"identity":667,"label":668,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":669,"versions":670,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":672},"package:pypi:colorama","colorama-abaf57c3","pypi:colorama","colorama",[374],[671],"0.4.6",[56],{"id":674,"slug":675,"identity":676,"label":677,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":678,"versions":679,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":681},"package:pypi:contourpy","contourpy-f86f9e10","pypi:contourpy","contourpy",[354],[680],"1.3.3",[56],{"id":683,"slug":684,"identity":685,"label":686,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":687,"versions":688,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":690},"package:pypi:cuda-bindings","cuda-bindings-63e94baa","pypi:cuda-bindings","cuda-bindings",[374],[689],"13.2.0",[56],{"id":692,"slug":693,"identity":694,"label":695,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":696,"versions":697,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":699},"package:pypi:cuda-pathfinder","cuda-pathfinder-6d2ddb13","pypi:cuda-pathfinder","cuda-pathfinder",[343],[698],"1.5.4",[56],{"id":701,"slug":702,"identity":703,"label":704,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":705,"versions":706,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":708},"package:pypi:cuda-toolkit","cuda-toolkit-96ffd01e","pypi:cuda-toolkit","cuda-toolkit",[],[707],"13.0.2",[56],{"id":710,"slug":711,"identity":712,"label":713,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":714,"versions":715,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":717},"package:pypi:cycler","cycler-3e14883d","pypi:cycler","cycler",[354],[716],"0.12.1",[56],{"id":719,"slug":720,"identity":721,"label":722,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":723,"versions":724,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":726},"package:pypi:dill","dill-e2d26698","pypi:dill","dill",[354],[725],"0.4.1",[56],{"id":728,"slug":729,"identity":730,"label":731,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":732,"versions":733,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":734},"package:pypi:frozenlist","frozenlist-110237da","pypi:frozenlist","frozenlist",[343],[385],[56],{"id":736,"slug":737,"identity":738,"label":739,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":740,"versions":741,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":743},"package:pypi:gradio-client","gradio-client-f28a3144","pypi:gradio-client","gradio-client",[343],[742],"2.5.0",[56],{"id":745,"slug":746,"identity":747,"label":748,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":749,"versions":750,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":752},"package:pypi:hf-xet","hf-xet-732ec6c8","pypi:hf-xet","hf-xet",[343],[751],"1.5.0",[56],{"id":754,"slug":755,"identity":756,"label":757,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":758,"versions":759,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":761},"package:pypi:httpcore","httpcore-ba6ae671","pypi:httpcore","httpcore",[354],[760],"1.0.9",[56],{"id":763,"slug":764,"identity":765,"label":766,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":767,"versions":768,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":770},"package:pypi:httptools","httptools-b6cca685","pypi:httptools","httptools",[402],[769],"0.7.1",[56],{"id":772,"slug":773,"identity":774,"label":775,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":776,"versions":777,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":779},"package:pypi:httpx","httpx-a512a166","pypi:httpx","httpx",[354],[778],"0.28.1",[56],{"id":781,"slug":782,"identity":783,"label":784,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":785,"versions":786,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":788},"package:pypi:huggingface-hub","huggingface-hub-443ec6ef","pypi:huggingface-hub","huggingface-hub",[343],[787],"1.14.0",[56],{"id":790,"slug":791,"identity":792,"label":793,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":794,"versions":795,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":797},"package:pypi:joblib","joblib-8cbb7872","pypi:joblib","joblib",[354],[796],"1.5.3",[56],{"id":799,"slug":800,"identity":801,"label":802,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":803,"versions":804,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":805},"package:pypi:kiwisolver","kiwisolver-41b47c33","pypi:kiwisolver","kiwisolver",[374],[751],[56],{"id":807,"slug":808,"identity":809,"label":810,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":811,"versions":812,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":814},"package:pypi:markdown-it-py","markdown-it-py-27073f5e","pypi:markdown-it-py","markdown-it-py",[402],[813],"4.2.0",[56],{"id":816,"slug":817,"identity":818,"label":819,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":820,"versions":821,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":823},"package:pypi:markupsafe","markupsafe-1bdd4c7f","pypi:markupsafe","markupsafe",[354],[822],"3.0.3",[56],{"id":825,"slug":826,"identity":827,"label":828,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":829,"versions":830,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":832},"package:pypi:matplotlib","matplotlib-9dc72309","pypi:matplotlib","matplotlib",[374],[831],"3.10.9",[56],{"id":834,"slug":835,"identity":836,"label":837,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":838,"versions":839,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":841},"package:pypi:mdurl","mdurl-e6f5f075","pypi:mdurl","mdurl",[402],[840],"0.1.2",[56],{"id":843,"slug":844,"identity":845,"label":846,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":847,"versions":848,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":850},"package:pypi:mpmath","mpmath-4ccb7a41","pypi:mpmath","mpmath",[354],[849],"1.3.0",[56],{"id":852,"slug":853,"identity":854,"label":855,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":856,"versions":857,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":859},"package:pypi:multiprocess","multiprocess-9b2083dd","pypi:multiprocess","multiprocess",[354],[858],"0.70.19",[56],{"id":861,"slug":862,"identity":863,"label":864,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":865,"versions":866,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":868},"package:pypi:networkx","networkx-c2336a8d","pypi:networkx","networkx",[354,374],[867],"3.6.1",[56],{"id":870,"slug":871,"identity":872,"label":873,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":874,"versions":876,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":878},"package:pypi:numpy","numpy-ba79b98d","pypi:numpy","numpy",[875,374],"0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib",[877],"2.4.4",[56],{"id":880,"slug":881,"identity":882,"label":883,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":884,"versions":885,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":887},"package:pypi:nvidia-cublas","nvidia-cublas-6a0535be","pypi:nvidia-cublas","nvidia-cublas",[374],[886],"13.1.0.3",[56],{"id":889,"slug":890,"identity":891,"label":892,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":893,"versions":894,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":896},"package:pypi:nvidia-cuda-cupti","nvidia-cuda-cupti-28886b51","pypi:nvidia-cuda-cupti","nvidia-cuda-cupti",[374],[895],"13.0.85",[56],{"id":898,"slug":899,"identity":900,"label":901,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":902,"versions":903,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":905},"package:pypi:nvidia-cuda-nvrtc","nvidia-cuda-nvrtc-79a057fb","pypi:nvidia-cuda-nvrtc","nvidia-cuda-nvrtc",[374],[904],"13.0.88",[56],{"id":907,"slug":908,"identity":909,"label":910,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":911,"versions":912,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":914},"package:pypi:nvidia-cuda-runtime","nvidia-cuda-runtime-55699b1c","pypi:nvidia-cuda-runtime","nvidia-cuda-runtime",[374],[913],"13.0.96",[56],{"id":916,"slug":917,"identity":918,"label":919,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":920,"versions":921,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":923},"package:pypi:nvidia-cudnn-cu13","nvidia-cudnn-cu13-2486f81c","pypi:nvidia-cudnn-cu13","nvidia-cudnn-cu13",[374],[922],"9.19.0.56",[56],{"id":925,"slug":926,"identity":927,"label":928,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":929,"versions":930,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":932},"package:pypi:nvidia-cufft","nvidia-cufft-b2cd0527","pypi:nvidia-cufft","nvidia-cufft",[374],[931],"12.0.0.61",[56],{"id":934,"slug":935,"identity":936,"label":937,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":938,"versions":939,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":941},"package:pypi:nvidia-cufile","nvidia-cufile-52c06111","pypi:nvidia-cufile","nvidia-cufile",[374],[940],"1.15.1.6",[56],{"id":943,"slug":944,"identity":945,"label":946,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":947,"versions":948,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":950},"package:pypi:nvidia-curand","nvidia-curand-05859d58","pypi:nvidia-curand","nvidia-curand",[374],[949],"10.4.0.35",[56],{"id":952,"slug":953,"identity":954,"label":955,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":956,"versions":957,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":959},"package:pypi:nvidia-cusolver","nvidia-cusolver-6f33f83d","pypi:nvidia-cusolver","nvidia-cusolver",[374],[958],"12.0.4.66",[56],{"id":961,"slug":962,"identity":963,"label":964,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":965,"versions":966,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":968},"package:pypi:nvidia-cusparse","nvidia-cusparse-6ffaf037","pypi:nvidia-cusparse","nvidia-cusparse",[374],[967],"12.6.3.3",[56],{"id":970,"slug":971,"identity":972,"label":973,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":974,"versions":975,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":977},"package:pypi:nvidia-cusparselt-cu13","nvidia-cusparselt-cu13-bf1c94c0","pypi:nvidia-cusparselt-cu13","nvidia-cusparselt-cu13",[374],[976],"0.8.0",[56],{"id":979,"slug":980,"identity":981,"label":982,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":983,"versions":984,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":986},"package:pypi:nvidia-nccl-cu13","nvidia-nccl-cu13-e883df84","pypi:nvidia-nccl-cu13","nvidia-nccl-cu13",[374],[985],"2.28.9",[56],{"id":988,"slug":989,"identity":990,"label":991,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":992,"versions":993,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":994},"package:pypi:nvidia-nvjitlink","nvidia-nvjitlink-c5d1771c","pypi:nvidia-nvjitlink","nvidia-nvjitlink",[374],[904],[56],{"id":996,"slug":997,"identity":998,"label":999,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1000,"versions":1001,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1003},"package:pypi:nvidia-nvshmem-cu13","nvidia-nvshmem-cu13-8f04166d","pypi:nvidia-nvshmem-cu13","nvidia-nvshmem-cu13",[374],[1002],"3.4.5",[56],{"id":1005,"slug":1006,"identity":1007,"label":1008,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1009,"versions":1010,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1011},"package:pypi:nvidia-nvtx","nvidia-nvtx-2bf32610","pypi:nvidia-nvtx","nvidia-nvtx",[343],[895],[56],{"id":1013,"slug":1014,"identity":1015,"label":1016,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1017,"versions":1019,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1021},"package:pypi:packaging","packaging-78ee1f47","pypi:packaging","packaging",[1018,374],"Apache-2.0 OR BSD-2-Clause",[1020],"26.2",[56],{"id":1023,"slug":1024,"identity":1025,"label":1026,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1027,"versions":1028,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1029},"package:pypi:pandas","pandas-e8d52445","pypi:pandas","pandas",[354,374],[822],[56],{"id":1031,"slug":1032,"identity":1033,"label":1034,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1035,"versions":1036,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1038},"package:pypi:polars","polars-f649ebed","pypi:polars","polars",[402],[1037],"1.40.1",[56],{"id":1040,"slug":1041,"identity":1042,"label":1043,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1044,"versions":1045,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1046},"package:pypi:polars-runtime-32","polars-runtime-32-7674b461","pypi:polars-runtime-32","polars-runtime-32",[402],[1037],[56],{"id":1048,"slug":1049,"identity":1050,"label":1051,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1052,"versions":1053,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1055},"package:pypi:propcache","propcache-1fcd6be4","pypi:propcache","propcache",[343],[1054],"0.5.2",[56],{"id":1057,"slug":1058,"identity":1059,"label":1060,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1061,"versions":1062,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1064},"package:pypi:psutil","psutil-840b9a74","pypi:psutil","psutil",[354],[1063],"7.2.2",[56],{"id":1066,"slug":1067,"identity":1068,"label":1069,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1070,"versions":1071,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1073},"package:pypi:pyparsing","pyparsing-a28b9b62","pypi:pyparsing","pyparsing",[402],[1072],"3.3.2",[56],{"id":1075,"slug":1076,"identity":1077,"label":1078,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1079,"versions":1080,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1082},"package:pypi:pyproj","pyproj-cd69d38f","pypi:pyproj","pyproj",[402],[1081],"3.7.2",[56],{"id":1084,"slug":1085,"identity":1086,"label":1087,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1088,"versions":1089,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1091},"package:pypi:python-dateutil","python-dateutil-8eac96b7","pypi:python-dateutil","python-dateutil",[374],[1090],"2.9.0.post0",[56],{"id":1093,"slug":1094,"identity":1095,"label":1096,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1097,"versions":1098,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1100},"package:pypi:pyyaml","pyyaml-16000901","pypi:pyyaml","pyyaml",[402],[1099],"6.0.3",[56],{"id":1102,"slug":1103,"identity":1104,"label":1105,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1106,"versions":1108,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1110},"package:pypi:regex","regex-5e8be65e","pypi:regex","regex",[343,1107],"Apache-2.0 AND CNRI-Python",[1109],"2026.5.9",[56],{"id":1112,"slug":1113,"identity":1114,"label":1115,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1116,"versions":1117,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1119},"package:pypi:rich","rich-23b343f7","pypi:rich","rich",[402],[1118],"15.0.0",[56],{"id":1121,"slug":1122,"identity":1123,"label":1124,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1125,"versions":1126,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1128},"package:pypi:safetensors","safetensors-2a32c77a","pypi:safetensors","safetensors",[374],[1127],"0.7.0",[56],{"id":1130,"slug":1131,"identity":1132,"label":1133,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1134,"versions":1135,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1137},"package:pypi:scipy","scipy-215f884d","pypi:scipy","scipy",[374],[1136],"1.17.1",[56],{"id":1139,"slug":1140,"identity":1141,"label":1142,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1143,"versions":1145,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1146},"package:pypi:shellingham","shellingham-fceabe5b","pypi:shellingham","shellingham",[1144],"ISC",[698],[56],{"id":1148,"slug":1149,"identity":1150,"label":1151,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1152,"versions":1153,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1155},"package:pypi:six","six-3c3888bd","pypi:six","six",[402],[1154],"1.17.0",[56],{"id":1157,"slug":1158,"identity":1159,"label":1160,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1161,"versions":1162,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1163},"package:pypi:sympy","sympy-b30cb89e","pypi:sympy","sympy",[354,402,374],[787],[56],{"id":1165,"slug":1166,"identity":1167,"label":1168,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1169,"versions":1170,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1172},"package:pypi:threadpoolctl","threadpoolctl-e94f6300","pypi:threadpoolctl","threadpoolctl",[354],[1171],"3.6.0",[56],{"id":1174,"slug":1175,"identity":1176,"label":1177,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1178,"versions":1179,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1181},"package:pypi:trackio","trackio-de70160f","pypi:trackio","trackio",[402],[1180],"0.25.1",[56],{"id":1183,"slug":1184,"identity":1185,"label":1186,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1187,"versions":1188,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1189},"package:pypi:triton","triton-601ea838","pypi:triton","triton",[402],[1171],[56],{"id":1191,"slug":1192,"identity":1193,"label":1194,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1195,"versions":1196,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1197},"package:pypi:typer","typer-b291ff1c","pypi:typer","typer",[402],[1180],[56],{"id":73,"slug":74,"identity":1199,"label":75,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1200,"versions":1201,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1203},"pypi:typing-extensions",[615,374],[1202],"4.15.0",[56],{"id":1205,"slug":1206,"identity":1207,"label":1208,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1209,"versions":1210,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1212},"package:pypi:tzdata","tzdata-f80b3bb7","pypi:tzdata","tzdata",[343],[1211],"2026.2",[56],{"id":1214,"slug":1215,"identity":1216,"label":1217,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1218,"versions":1219,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1221},"package:pypi:uvicorn","uvicorn-07c7a595","pypi:uvicorn","uvicorn",[354],[1220],"0.46.0",[56],{"id":1223,"slug":1224,"identity":1225,"label":1226,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1227,"versions":1228,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1230},"package:pypi:uvloop","uvloop-7921eb0f","pypi:uvloop","uvloop",[402],[1229],"0.22.1",[56],{"id":1232,"slug":1233,"identity":1234,"label":1235,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1236,"versions":1237,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1239},"package:pypi:watchfiles","watchfiles-d200b8ce","pypi:watchfiles","watchfiles",[402],[1238],"1.1.1",[56],{"id":1241,"slug":1242,"identity":1243,"label":1244,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1245,"versions":1246,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1248},"package:pypi:websockets","websockets-047236a0","pypi:websockets","websockets",[354],[1247],"16.0",[56],{"id":1250,"slug":1251,"identity":1252,"label":1253,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1254,"versions":1255,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1257},"package:pypi:xxhash","xxhash-908d556a","pypi:xxhash","xxhash",[586,374],[1256],"3.7.0",[56],{"id":1259,"slug":1260,"identity":1261,"label":1262,"aiRelevant":47,"provider":84,"advisoryCount":39,"licenseExpressions":1263,"versions":1264,"dossier":47,"occurrenceCount":32,"directOccurrenceCount":39,"evidenceFiles":1266},"package:pypi:yarl","yarl-05cd1b35","pypi:yarl","yarl",[343],[1265],"1.23.0",[56],[1268,1307,1343,1367,1389,1413,1457,1491,1524,1558,1601,1626,1662,1684,1727,1767,1793,1819,1845,1868,1895,1920,1942,1968,1989,2009,2045,2063,2087,2111,2137,2166,2205,2231,2256,2285,2313,2336,2363,2386,2424,2461,2485,2503,2527,2550,2571,2600,2630,2680,2707,2726,2752,2780,2801,2824,2850,2877,2897,2920,2942,2965,3001,3027,3050,3071,3103,3127,3159,3182,3209,3228,3279,3316,3348,3370,3389,3412,3437,3461,3483,3521,3547,3574,3594,3624,3644,3664,3689,3721,3743,3798,3821,3853,3880,3900,3931,3952,3985,4010,4031,4051,4090,4114,4142,4165,4188,4207,4232,4256,4289,4314,4339,4366,4387,4411,4434,4462,4483,4517,4551,4573,4596,4616,4651,4681,4702,4724,4756,4777,4800,4827,4852,4873,4902,4926,4945,4966,4996,5024,5047,5072,5095,5118,5140,5161,5184,5206,5230,5257,5282,5306,5327,5351,5372,5398,5420,5447,5468,5488,5521,5548,5575,5602,5630,5657,5679,5701,5731,5765,5786,5808,5832,5855,5883,5910,5939,5957,5981,6004,6034,6056,6108,6131,6157,6176,6210,6235,6267,6286,6314,6333,6354,6381,6404,6429,6450,6476,6506,6526,6543,6562,6579,6600,6617,6632,6649,6664,6681,6698,6715,6728,6741,6754,6767,6780,6793,6806,6819],{"id":107,"slug":1269,"dossier":91,"summary":1270,"aliases":1271,"sourceIds":1274,"published":1275,"modified":1276,"checkedAt":7,"severity":1277,"references":1281,"versionKeys":1295,"packageCount":32,"repositoryCount":1306},"ghsa-22hg-r758-rrw9-14adf850","Pillow: Infinite loop in MIC n_frames when the embedded TIFF",[1272,1273],"BIT-pillow-2026-112390","CVE-2026-112390",[107],"2026-10-21T20:39:49Z","2026-10-26T08:56:03.565713059Z",[1278],{"type":1279,"score":1280},"CVSS_V4","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1282,1285,1288,1290,1293],{"type":1283,"url":1284},"WEB","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-22hg-r758-rrw9",{"type":1286,"url":1287},"ADVISORY","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112390",{"type":1283,"url":1289},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F26cb3ed061173b817b9ee4b6f507cb0e1e293218",{"type":1291,"url":1292},"PACKAGE","https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow",{"type":1283,"url":1294},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F13.0.0",[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],"pypi:pillow@10.3.0","pypi:pillow@10.4.0","pypi:pillow@11.1.0","pypi:pillow@11.2.1","pypi:pillow@11.3.0","pypi:pillow@12.0.0","pypi:pillow@12.1.0","pypi:pillow@12.1.1","pypi:pillow@12.2.0","pypi:pillow@12.3.0",19,{"id":108,"slug":1308,"dossier":47,"summary":1309,"aliases":1310,"sourceIds":1313,"published":1314,"modified":1315,"checkedAt":7,"severity":1316,"references":1320,"versionKeys":1341,"packageCount":32,"repositoryCount":32},"ghsa-248v-346w-9cwc-8a7dbdf1","Certifi removes GLOBALTRUST root certificate",[1311,1312],"CVE-2024-39689","PYSEC-2024-230",[108,1312],"2024-07-05T19:15:10Z","2026-09-10T03:50:15.994602411Z",[1317],{"type":1318,"score":1319},"CVSS_V3","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[1321,1323,1325,1328,1330,1332,1335,1337,1339],{"type":1286,"url":1322},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-248v-346w-9cwc",{"type":1286,"url":1324},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-39689",{"type":1326,"url":1327},"FIX","https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fcommit\u002Fbd8153872e9c6fc98f4023df9c2deaffea2fa463",{"type":1291,"url":1329},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi",{"type":1283,"url":1331},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fcertifi\u002FPYSEC-2024-230.yaml",{"type":1333,"url":1334},"ARTICLE","https:\u002F\u002Fgroups.google.com\u002Fa\u002Fmozilla.org\u002Fg\u002Fdev-security-policy\u002Fc\u002FXpknYMPO8dI",{"type":1283,"url":1336},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001",{"type":1286,"url":1338},"https:\u002F\u002Fsecurity.netapp.com\u002Fadvisory\u002Fntap-20241206-0001\u002F",{"type":1286,"url":1340},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-248v-346w-9cwc",[1342],"pypi:certifi@2024.6.2",{"id":109,"slug":1344,"dossier":91,"summary":1345,"aliases":1346,"sourceIds":1349,"published":1350,"modified":1351,"checkedAt":7,"severity":1352,"references":1355,"versionKeys":1366,"packageCount":32,"repositoryCount":1306},"ghsa-24rc-8hj2-v98c-379a2f18","Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape \u002F absolute mode",[1347,1348],"BIT-pillow-2026-96638","CVE-2026-96638",[109],"2026-10-22T15:59:35Z","2026-10-29T10:55:36.262902070Z",[1353],{"type":1318,"score":1354},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1356,1358,1360,1362,1364,1365],{"type":1283,"url":1357},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-24rc-8hj2-v98c",{"type":1286,"url":1359},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96638",{"type":1283,"url":1361},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10015",{"type":1283,"url":1363},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe7794835e323ff2691d9b3a974cade1a44301b9a",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":110,"slug":1368,"dossier":91,"summary":1369,"aliases":1370,"sourceIds":1373,"published":1374,"modified":1375,"checkedAt":7,"severity":1376,"references":1379,"versionKeys":1388,"packageCount":32,"repositoryCount":1306},"ghsa-254f-3936-288h-1cc364b4","Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()",[1371,1372],"BIT-pillow-2026-112391","CVE-2026-112391",[110],"2026-10-21T21:11:07Z","2026-10-26T08:56:17.690706279Z",[1377],{"type":1279,"score":1378},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[1380,1382,1384,1386,1387],{"type":1283,"url":1381},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-254f-3936-288h",{"type":1286,"url":1383},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112391",{"type":1283,"url":1385},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F94cb11c44ff7345414da17ebfea1598a529ad9cd",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":111,"slug":1390,"dossier":91,"summary":1391,"aliases":1392,"sourceIds":1396,"published":1397,"modified":1398,"checkedAt":7,"severity":1399,"references":1403,"versionKeys":1412,"packageCount":32,"repositoryCount":1306},"ghsa-27h8-gf7j-v5hc-bd4ebeac","Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images",[1393,1394,1395],"BIT-pillow-2026-112392","CVE-2026-112392","PYSEC-2026-4326",[111,1395],"2026-10-19T22:17:06.587Z","2026-10-27T11:10:35.409737764Z",[1400,1401],{"type":1279,"score":1280},{"type":1318,"score":1402},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1404,1406,1408,1410,1411],{"type":1326,"url":1405},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-27h8-gf7j-v5hc",{"type":1286,"url":1407},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112392",{"type":1326,"url":1409},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F443e3130a8c11594fd0e296afad497e11e678961",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":112,"slug":1414,"dossier":47,"summary":1415,"aliases":1416,"sourceIds":1419,"published":1420,"modified":1421,"checkedAt":7,"severity":1422,"references":1425,"versionKeys":1446,"packageCount":32,"repositoryCount":1456},"ghsa-27vj-qcqg-25rc-06b922e9","fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution",[1417,1418],"CVE-2026-104851","PYSEC-2026-4217",[112,1418],"2026-10-05T22:53:22Z","2026-10-15T14:56:18.658408345Z",[1423],{"type":1318,"score":1424},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1426,1428,1430,1432,1434,1436,1438,1440,1442,1444],{"type":1283,"url":1427},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fsecurity\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",{"type":1286,"url":1429},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104851",{"type":1283,"url":1431},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2029",{"type":1283,"url":1433},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fpull\u002F2039",{"type":1283,"url":1435},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002F86438783f93b1398ef245b92f0e6063b445b611c",{"type":1283,"url":1437},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Fcommit\u002Fa1c16ab3f07f354aa371c38f7b1b07ea7fd4c5c8",{"type":1291,"url":1439},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec",{"type":1283,"url":1441},"https:\u002F\u002Fgithub.com\u002Ffsspec\u002Ffilesystem_spec\u002Freleases\u002Ftag\u002F2026.6.0",{"type":1291,"url":1443},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffsspec",{"type":1286,"url":1445},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-27vj-qcqg-25rc",[1447,1448,1449,1450,1451,1452,1453,1454,1455],"pypi:fsspec@2024.9.0","pypi:fsspec@2025.10.0","pypi:fsspec@2025.3.0","pypi:fsspec@2025.3.2","pypi:fsspec@2025.5.0","pypi:fsspec@2025.9.0","pypi:fsspec@2026.1.0","pypi:fsspec@2026.2.0","pypi:fsspec@2026.3.0",15,{"id":113,"slug":1458,"dossier":47,"summary":1459,"aliases":1460,"sourceIds":1463,"published":1464,"modified":1465,"checkedAt":7,"severity":1466,"references":1469,"versionKeys":1481,"packageCount":32,"repositoryCount":66},"ghsa-29pf-2h5f-8g72-1d83ebb4","HuggingFace transformers vulnerable to remote code execution",[1461,1462],"CVE-2026-4372","PYSEC-2026-2289",[113,1462],"2026-05-24T14:16:16.917Z","2026-09-10T03:50:45.254378086Z",[1467],{"type":1318,"score":1468},"CVSS:3.0\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[1470,1472,1474,1476,1479],{"type":1286,"url":1471},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4372",{"type":1326,"url":1473},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fa7f8e7ff37d87d1a1a0c8cf607971c607741452f",{"type":1291,"url":1475},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers",{"type":1477,"url":1478},"EVIDENCE","https:\u002F\u002Fhuntr.com\u002Fbounties\u002F1f693a6e-6836-4b8b-a0bd-ca036fba8884",{"type":1286,"url":1480},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-29pf-2h5f-8g72",[1482,1483,1484,1485,1486,1487,1488,1489,1490],"pypi:transformers@4.47.1","pypi:transformers@4.51.0","pypi:transformers@4.51.3","pypi:transformers@4.52.4","pypi:transformers@4.53.1","pypi:transformers@4.57.1","pypi:transformers@4.57.3","pypi:transformers@4.57.4","pypi:transformers@4.57.6",{"id":114,"slug":1492,"dossier":47,"summary":1493,"aliases":1494,"sourceIds":1497,"published":1498,"modified":1499,"checkedAt":7,"severity":1500,"references":1503,"versionKeys":1520,"packageCount":32,"repositoryCount":471},"ghsa-2c2j-9gv5-cj73-60bc1f35","Starlette has possible denial-of-service vector when parsing large files in multipart forms",[1495,1496],"CVE-2025-54121","PYSEC-2026-1941",[114,1496],"2025-07-21T19:34:23Z","2026-09-10T03:50:25.704876348Z",[1501],{"type":1318,"score":1502},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[1504,1506,1508,1510,1512,1514,1516,1518],{"type":1283,"url":1505},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-2c2j-9gv5-cj73",{"type":1286,"url":1507},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54121",{"type":1326,"url":1509},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fcommit\u002F9f7ec2eb512fcc3fe90b43cb9dd9e1d08696bec1",{"type":1291,"url":1511},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette",{"type":1283,"url":1513},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fblob\u002Ffa5355442753f794965ae1af0f87f9fec1b9a3de\u002Fstarlette\u002Fdatastructures.py#L436C5-L447C14",{"type":1283,"url":1515},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fdiscussions\u002F2927#discussioncomment-13721403",{"type":1291,"url":1517},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fstarlette",{"type":1286,"url":1519},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2c2j-9gv5-cj73",[1521,1522,1523],"pypi:starlette@0.37.2","pypi:starlette@0.44.0","pypi:starlette@0.46.2",{"id":115,"slug":1525,"dossier":47,"summary":1526,"aliases":1527,"sourceIds":1530,"published":1531,"modified":1532,"checkedAt":7,"severity":1533,"references":1537,"versionKeys":1548,"packageCount":32,"repositoryCount":66},"ghsa-2fqr-mr3j-6wp8-5ee7c60f","aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence",[1528,1529],"CVE-2026-54279","PYSEC-2026-2112",[115,1529],"2026-06-15T20:08:51Z","2026-11-03T16:45:04.163545105Z",[1534,1535],{"type":1318,"score":1402},{"type":1279,"score":1536},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:N\u002FSC:L\u002FSI:N\u002FSA:N\u002FE:U",[1538,1540,1542,1544,1546],{"type":1286,"url":1539},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2fqr-mr3j-6wp8",{"type":1286,"url":1541},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54279",{"type":1326,"url":1543},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa329a7aacad5284f087af36103aff778746da0f2",{"type":1291,"url":1545},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp",{"type":1283,"url":1547},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Faiohttp\u002FPYSEC-2026-2112.yaml",[1549,1550,1551,1552,1553,1554,1555,1556,1557],"pypi:aiohttp@3.10.11","pypi:aiohttp@3.11.11","pypi:aiohttp@3.11.18","pypi:aiohttp@3.12.13","pypi:aiohttp@3.12.15","pypi:aiohttp@3.13.1","pypi:aiohttp@3.13.2","pypi:aiohttp@3.13.3","pypi:aiohttp@3.13.5",{"id":116,"slug":1559,"dossier":47,"summary":1560,"aliases":1561,"sourceIds":1563,"published":1564,"modified":1565,"checkedAt":7,"severity":1566,"references":1569,"versionKeys":1597,"packageCount":32,"repositoryCount":1600},"ghsa-2g87-pp6c-29x5-5aaa26fd","aiohttp: Multiple instances of excessive or unbounded memory\u002FCPU use",[1562],"CVE-2026-123817",[116],"2026-10-19T17:07:23Z","2026-11-09T21:30:07.738926065Z",[1567],{"type":1279,"score":1568},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1570,1572,1574,1576,1578,1580,1582,1584,1586,1588,1590,1592,1594,1595],{"type":1283,"url":1571},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2g87-pp6c-29x5",{"type":1283,"url":1573},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F09bcaa73ff084a0c539bbf16a0a78743acb7141f",{"type":1283,"url":1575},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0ae507423f681161efa77d20052b4054397c7fb6",{"type":1283,"url":1577},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F3d850ee9b92573c7e913821cbcb96005beb3f4df",{"type":1283,"url":1579},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F47babd8c23ca79e2bae6cc8dcb5752b61e369fc7",{"type":1283,"url":1581},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F615fec3d4f088f30d2ee72cad760152e92aa1c53",{"type":1283,"url":1583},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6963ee0befec1502b6bb7b4db6c72d044c08f4fa",{"type":1283,"url":1585},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6a4f6682817839313b04b8e5cea2b39c1a88ab4f",{"type":1283,"url":1587},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F8cfbe9abe5e11b84006a10f9bdf82bf607671dab",{"type":1283,"url":1589},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa555ab698e08e9baea7386d5b4c0761cb8956fdd",{"type":1283,"url":1591},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc6ac0e44c3c573ff9616f4a6a532992538b31e43",{"type":1283,"url":1593},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fd925a80539ffd227da1d93ab4a5bff123cc777db",{"type":1291,"url":1545},{"type":1283,"url":1596},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.4",[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],"pypi:aiohttp@3.14.1","pypi:aiohttp@3.14.3",13,{"id":117,"slug":1602,"dossier":47,"summary":1603,"aliases":1604,"sourceIds":1607,"published":1608,"modified":1609,"checkedAt":7,"severity":1610,"references":1615,"versionKeys":1625,"packageCount":32,"repositoryCount":442},"ghsa-2vrm-gr82-f7m5-5092ea0c","AIOHTTP has CRLF injection through multipart part content type header construction",[1605,1606],"CVE-2026-34514","PYSEC-2026-2096",[117,1606],"2026-04-01T21:16:59.417Z","2026-09-10T03:50:42.288164171Z",[1611,1613],{"type":1279,"score":1612},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":1614},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[1616,1618,1620,1622,1623],{"type":1326,"url":1617},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-2vrm-gr82-f7m5",{"type":1286,"url":1619},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34514",{"type":1326,"url":1621},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9a6ada97e2c6cf1ce31727c6c9fcea17c21f6f06",{"type":1291,"url":1545},{"type":1286,"url":1624},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.13.4",[1549,1550,1551,1552,1553,1554,1555,1556],{"id":118,"slug":1627,"dossier":47,"summary":1628,"aliases":1629,"sourceIds":1632,"published":1633,"modified":1634,"checkedAt":7,"severity":1635,"references":1638,"versionKeys":1655,"packageCount":32,"repositoryCount":1661},"ghsa-2xpw-w6gg-jr37-91cead57","urllib3 streaming API improperly handles highly compressed data",[1630,1631],"CVE-2025-66471","PYSEC-2026-1994",[118,1631],"2025-12-05T18:15:54Z","2026-09-25T17:15:05.968189421Z",[1636],{"type":1279,"score":1637},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:H",[1639,1641,1643,1645,1647,1649,1651,1653],{"type":1283,"url":1640},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1286,"url":1642},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66471",{"type":1326,"url":1644},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fc19571de34c47de3a766541b041637ba5f716ed7",{"type":1283,"url":1646},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fd0fde3672e4a4093f7587858dccfc298eb66e46c",{"type":1286,"url":1648},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-2xpw-w6gg-jr37",{"type":1283,"url":1650},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-1994.yaml",{"type":1291,"url":1652},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3",{"type":1291,"url":1654},"https:\u002F\u002Fpypi.org\u002Fproject\u002Furllib3",[1656,1657,1658,1659,1660],"pypi:urllib3@2.2.2","pypi:urllib3@2.2.3","pypi:urllib3@2.3.0","pypi:urllib3@2.4.0","pypi:urllib3@2.5.0",17,{"id":119,"slug":1663,"dossier":91,"summary":1664,"aliases":1665,"sourceIds":1668,"published":1669,"modified":1670,"checkedAt":7,"severity":1671,"references":1674,"versionKeys":1683,"packageCount":32,"repositoryCount":1306},"ghsa-332p-7hrc-92wf-af7b2989","Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO",[1666,1667],"BIT-pillow-2026-112393","CVE-2026-112393",[119],"2026-10-21T21:28:09Z","2026-10-26T08:56:07.886625845Z",[1672],{"type":1279,"score":1673},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[1675,1677,1679,1681,1682],{"type":1283,"url":1676},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-332p-7hrc-92wf",{"type":1286,"url":1678},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112393",{"type":1283,"url":1680},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F11582e5ffbdceb973d5ee593f3105af5a9852b40",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":120,"slug":1685,"dossier":47,"summary":1686,"aliases":1687,"sourceIds":1691,"published":1692,"modified":1693,"checkedAt":7,"severity":1694,"references":1701,"versionKeys":1723,"packageCount":32,"repositoryCount":490},"ghsa-3749-ghw9-m3mg-fadf4a32","PyTorch susceptible to local Denial of Service",[1688,1689,1690],"BIT-pytorch-2025-2953","CVE-2025-2953","PYSEC-2025-191",[120,1690],"2025-03-30T16:15:14.380Z","2026-09-10T03:50:22.781448235Z",[1695,1697,1699],{"type":1318,"score":1696},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",{"type":1279,"score":1698},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1318,"score":1700},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",[1702,1704,1707,1709,1711,1713,1715,1717,1719,1721],{"type":1286,"url":1703},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2953",{"type":1705,"url":1706},"REPORT","https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274",{"type":1705,"url":1708},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149274#issue-2923122269",{"type":1283,"url":1710},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-191.yaml",{"type":1291,"url":1712},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch",{"type":1283,"url":1714},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fmain\u002FSECURITY.md#untrusted-models",{"type":1705,"url":1716},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302006",{"type":1286,"url":1718},"https:\u002F\u002Fvuldb.com\u002F?id.302006",{"type":1286,"url":1720},"https:\u002F\u002Fvuldb.com\u002F?submit.521279",{"type":1286,"url":1722},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-3749-ghw9-m3mg",[1724,1725,1726],"pypi:torch@2.5.1","pypi:torch@2.6.0","pypi:torch@2.7.0",{"id":121,"slug":1728,"dossier":47,"summary":1729,"aliases":1730,"sourceIds":1733,"published":1734,"modified":1735,"checkedAt":7,"severity":1736,"references":1743,"versionKeys":1760,"packageCount":32,"repositoryCount":34},"ghsa-379c-qx7v-6h59-ebbf4eb1","Hugging Face Datasets folder-based builders allow path traversal through file_name metadata",[1731,1732],"CVE-2026-66007","PYSEC-2026-3716",[121,1732],"2026-07-24T15:19:07.493Z","2026-10-15T14:45:06.499774727Z",[1737,1739,1741],{"type":1318,"score":1738},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1279,"score":1740},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1279,"score":1742},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[1744,1746,1748,1750,1752,1754,1756,1758],{"type":1286,"url":1745},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-66007",{"type":1705,"url":1747},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fissues\u002F8324",{"type":1326,"url":1749},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fpull\u002F8325",{"type":1326,"url":1751},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets\u002Fcommit\u002Ff989ef9b4cc6c0039a7a82458eebca49e2b58b4b",{"type":1291,"url":1753},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Fdatasets",{"type":1283,"url":1755},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fdatasets\u002FPYSEC-2026-3716.yaml",{"type":1326,"url":1757},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fdatasets-path-traversal-via-unsanitized-file-name-metadata",{"type":1286,"url":1759},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-379c-qx7v-6h59",[1761,1762,1763,1764,1765,1766],"pypi:datasets@3.2.0","pypi:datasets@3.5.1","pypi:datasets@3.6.0","pypi:datasets@4.3.0","pypi:datasets@4.4.1","pypi:datasets@4.8.5",{"id":122,"slug":1768,"dossier":47,"summary":1769,"aliases":1770,"sourceIds":1773,"published":1774,"modified":1775,"checkedAt":7,"severity":1776,"references":1778,"versionKeys":1792,"packageCount":32,"repositoryCount":490},"ghsa-37mw-44qp-f5jm-fb05555e","Transformers is vulnerable to ReDoS attack through its DonutProcessor class",[1771,1772],"CVE-2025-3933","PYSEC-2026-1977",[122,1772],"2025-07-11T12:30:32Z","2026-09-10T03:50:57.888142744Z",[1777],{"type":1318,"score":1502},[1779,1781,1783,1785,1786,1788,1790],{"type":1286,"url":1780},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3933",{"type":1283,"url":1782},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F37788",{"type":1283,"url":1784},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Febbe9b12dd75b69f92100d684c47f923ee262a93",{"type":1291,"url":1475},{"type":1283,"url":1787},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F25282953-5827-4384-bb6f-5790d275721b",{"type":1291,"url":1789},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftransformers",{"type":1286,"url":1791},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-37mw-44qp-f5jm",[1482,1483,1484],{"id":123,"slug":1794,"dossier":47,"summary":1795,"aliases":1796,"sourceIds":1799,"published":1800,"modified":1801,"checkedAt":7,"severity":1802,"references":1805,"versionKeys":1818,"packageCount":32,"repositoryCount":1661},"ghsa-38jv-5279-wg99-c9df8f7b","Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)",[1797,1798],"CVE-2026-21441","PYSEC-2026-1996",[123,1798],"2026-01-07T19:18:14Z","2026-09-10T03:50:32.562010895Z",[1803,1804],{"type":1318,"score":1402},{"type":1279,"score":1637},[1806,1808,1810,1812,1813,1815,1816],{"type":1283,"url":1807},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-38jv-5279-wg99",{"type":1286,"url":1809},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-21441",{"type":1326,"url":1811},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F8864ac407bba8607950025e0979c4c69bc7abc7b",{"type":1291,"url":1652},{"type":1283,"url":1814},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2026\u002F01\u002Fmsg00017.html",{"type":1291,"url":1654},{"type":1286,"url":1817},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-38jv-5279-wg99",[1656,1657,1658,1659,1660],{"id":124,"slug":1820,"dossier":91,"summary":1821,"aliases":1822,"sourceIds":1826,"published":1827,"modified":1828,"checkedAt":7,"severity":1829,"references":1833,"versionKeys":1844,"packageCount":32,"repositoryCount":1306},"ghsa-3j72-p6qg-6xp7-6d019684","Pillow: TarIO negative size field causes infinite CPU-spin loop",[1823,1824,1825],"BIT-pillow-2026-96642","CVE-2026-96642","PYSEC-2026-4341",[124,1825],"2026-10-21T21:20:32.650Z","2026-10-29T10:55:45.826300321Z",[1830,1832],{"type":1279,"score":1831},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":1354},[1834,1836,1838,1840,1842,1843],{"type":1286,"url":1835},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-3j72-p6qg-6xp7",{"type":1286,"url":1837},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96642",{"type":1705,"url":1839},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10012",{"type":1326,"url":1841},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19b695fdcc5eddc37374e2b1645fc4185edaf71d",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":125,"slug":1846,"dossier":47,"summary":1847,"aliases":1848,"sourceIds":1851,"published":1852,"modified":1853,"checkedAt":7,"severity":1854,"references":1858,"versionKeys":1867,"packageCount":32,"repositoryCount":442},"ghsa-3wq7-rqq7-wx6j-29b8d785","AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS",[1849,1850],"CVE-2026-34517","PYSEC-2026-2099",[125,1850],"2026-04-01T21:16:59.870Z","2026-09-10T03:50:42.683852324Z",[1855,1857],{"type":1279,"score":1856},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":1502},[1859,1861,1863,1865,1866],{"type":1326,"url":1860},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-3wq7-rqq7-wx6j",{"type":1286,"url":1862},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34517",{"type":1326,"url":1864},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fcbb774f38330563422ca0c413a71021d7b944145",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":126,"slug":1869,"dossier":91,"summary":1870,"aliases":1871,"sourceIds":1875,"published":1876,"modified":1877,"checkedAt":7,"severity":1878,"references":1883,"versionKeys":1894,"packageCount":32,"repositoryCount":1306},"ghsa-4558-3h8r-v8xp-9e09a0b2","Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer size",[1872,1873,1874],"BIT-pillow-2026-112394","CVE-2026-112394","PYSEC-2026-4327",[126,1874],"2026-10-19T21:17:07.747Z","2026-10-27T11:10:34.006455299Z",[1879,1881],{"type":1279,"score":1880},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":1882},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:H",[1884,1886,1888,1890,1892,1893],{"type":1477,"url":1885},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4558-3h8r-v8xp",{"type":1286,"url":1887},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112394",{"type":1283,"url":1889},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9723",{"type":1326,"url":1891},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F392ee6f0d19a4adb766a63e9a99f3c28193b8d31",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":127,"slug":1896,"dossier":47,"summary":1897,"aliases":1898,"sourceIds":1902,"published":1903,"modified":1904,"checkedAt":7,"severity":1905,"references":1907,"versionKeys":1919,"packageCount":32,"repositoryCount":105},"ghsa-45hq-cxwh-f6vc-d18d2872","Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading",[1899,1900,1901],"BIT-pillow-2026-55379","CVE-2026-55379","PYSEC-2026-2255",[127,1901],"2026-07-06T19:17:08.577Z","2026-09-10T03:50:51.372929814Z",[1906],{"type":1318,"score":1402},[1908,1910,1912,1914,1916,1917],{"type":1477,"url":1909},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-45hq-cxwh-f6vc",{"type":1286,"url":1911},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55379",{"type":1326,"url":1913},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F0a263e6264aa5399988d9acd3bbfbca2ca3ec77d",{"type":1283,"url":1915},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2255.yaml",{"type":1291,"url":1292},{"type":1286,"url":1918},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fblob\u002Fmain\u002Fdocs\u002Freleasenotes\u002F12.3.0.rst",[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":128,"slug":1921,"dossier":91,"summary":1922,"aliases":1923,"sourceIds":1926,"published":1927,"modified":1928,"checkedAt":7,"severity":1929,"references":1932,"versionKeys":1941,"packageCount":32,"repositoryCount":1306},"ghsa-462x-pgg6-55fp-29049dd8","Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)",[1924,1925],"BIT-pillow-2026-112395","CVE-2026-112395",[128],"2026-10-20T20:49:26Z","2026-10-26T08:56:01.770928143Z",[1930],{"type":1318,"score":1931},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:L",[1933,1935,1937,1939,1940],{"type":1283,"url":1934},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-462x-pgg6-55fp",{"type":1286,"url":1936},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112395",{"type":1283,"url":1938},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F76869efdbbf2ad7dccd7536520fb61b7a00ab61e",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":129,"slug":1943,"dossier":47,"summary":1944,"aliases":1945,"sourceIds":1948,"published":1949,"modified":1950,"checkedAt":7,"severity":1951,"references":1954,"versionKeys":1967,"packageCount":32,"repositoryCount":452},"ghsa-48p4-8xcf-vxj5-13f12656","urllib3 does not control redirects in browsers and Node.js",[1946,1947],"CVE-2025-50182","PYSEC-2026-1997",[129,1947],"2025-06-18T17:50:11Z","2026-09-10T03:50:24.821170285Z",[1952],{"type":1318,"score":1953},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[1955,1957,1959,1961,1962,1964,1965],{"type":1283,"url":1956},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",{"type":1286,"url":1958},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50182",{"type":1326,"url":1960},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f",{"type":1291,"url":1652},{"type":1283,"url":1963},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.5.0",{"type":1291,"url":1654},{"type":1286,"url":1966},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-48p4-8xcf-vxj5",[1656,1657,1658,1659],{"id":130,"slug":1969,"dossier":47,"summary":1970,"aliases":1971,"sourceIds":1973,"published":1974,"modified":1975,"checkedAt":7,"severity":1976,"references":1979,"versionKeys":1988,"packageCount":32,"repositoryCount":1600},"ghsa-494j-54xm-rwp3-eab1773e","AIOHTTP: Secure attribute not enforced for shared cookie",[1972],"CVE-2026-111063",[130],"2026-10-19T17:07:47Z","2026-10-26T15:00:05.287728271Z",[1977],{"type":1279,"score":1978},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[1980,1982,1984,1986,1987],{"type":1283,"url":1981},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-494j-54xm-rwp3",{"type":1286,"url":1983},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111063",{"type":1283,"url":1985},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F999c356d61e966faffa97b06ab0d0455226d36c5",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":131,"slug":1990,"dossier":47,"summary":1991,"aliases":1992,"sourceIds":1995,"published":1996,"modified":1997,"checkedAt":7,"severity":1998,"references":2002,"versionKeys":2008,"packageCount":32,"repositoryCount":66},"ghsa-4fvr-rgm6-gqmc-c8b35c87","aiohttp: HTTP\u002F1 Pipelined Requests Queue Without Limit",[1993,1994],"CVE-2026-54273","PYSEC-2026-2107",[131,1994],"2026-06-15T20:10:32Z","2026-09-10T03:51:07.881817751Z",[1999,2001],{"type":1279,"score":2000},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":1402},[2003,2005,2007],{"type":1286,"url":2004},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-4fvr-rgm6-gqmc",{"type":1326,"url":2006},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":132,"slug":2010,"dossier":47,"summary":2011,"aliases":2012,"sourceIds":2015,"published":2016,"modified":2017,"checkedAt":7,"severity":2018,"references":2023,"versionKeys":2040,"packageCount":32,"repositoryCount":471},"ghsa-4j2p-28q2-5m79-f1478ba7","Accelerate path traversal and denial of service via sharded checkpoint weight_map entries",[2013,2014],"CVE-2026-69112","PYSEC-2026-3804",[132,2014],"2026-08-10T21:32:04Z","2026-09-10T12:25:52.792193450Z",[2019,2021],{"type":1318,"score":2020},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",{"type":1279,"score":2022},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2024,2026,2028,2030,2032,2034,2036,2038],{"type":1286,"url":2025},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69112",{"type":1283,"url":2027},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fissues\u002F4067",{"type":1283,"url":2029},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fpull\u002F4070",{"type":1283,"url":2031},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate\u002Fpull\u002F4138",{"type":1291,"url":2033},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Faccelerate",{"type":1283,"url":2035},"https:\u002F\u002Fwww.vulncheck.com\u002Fadvisories\u002Fhugging-face-accelerate-path-traversal-and-dos-via-weight-map",{"type":1291,"url":2037},"https:\u002F\u002Fpypi.org\u002Fproject\u002Faccelerate",{"type":1286,"url":2039},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4j2p-28q2-5m79",[2041,2042,2043,2044],"pypi:accelerate@1.11.0","pypi:accelerate@1.12.0","pypi:accelerate@1.13.0","pypi:accelerate@1.2.1",{"id":133,"slug":2046,"dossier":47,"summary":2047,"aliases":2048,"sourceIds":2051,"published":2052,"modified":2053,"checkedAt":7,"severity":2054,"references":2058,"versionKeys":2062,"packageCount":32,"repositoryCount":66},"ghsa-4m7w-qmgq-4wj5-f98433d3","aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections",[2049,2050],"CVE-2026-54275","PYSEC-2026-237",[133,2050],"2026-06-15T20:11:13Z","2026-09-10T03:50:48.205198252Z",[2055,2057],{"type":1279,"score":2056},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":1402},[2059,2061],{"type":1286,"url":2060},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-4m7w-qmgq-4wj5",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":134,"slug":2064,"dossier":91,"summary":2065,"aliases":2066,"sourceIds":2070,"published":2071,"modified":2072,"checkedAt":7,"severity":2073,"references":2075,"versionKeys":2086,"packageCount":32,"repositoryCount":1306},"ghsa-4rm8-3hmm-39fg-6e9ca404","Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise",[2067,2068,2069],"BIT-pillow-2026-96641","CVE-2026-96641","PYSEC-2026-4340",[134,2069],"2026-10-21T21:20:32.500Z","2026-10-29T10:56:07.449486409Z",[2074],{"type":1318,"score":1354},[2076,2078,2080,2082,2084,2085],{"type":1286,"url":2077},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rm8-3hmm-39fg",{"type":1286,"url":2079},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96641",{"type":1705,"url":2081},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10010",{"type":1326,"url":2083},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F80de4be9e38d3a6148dd4d8491eb80cd12b760a4",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":135,"slug":2088,"dossier":47,"summary":2089,"aliases":2090,"sourceIds":2094,"published":2095,"modified":2096,"checkedAt":7,"severity":2097,"references":2101,"versionKeys":2110,"packageCount":32,"repositoryCount":66},"ghsa-4rr5-89j8-mwwm-f8e3c770","Pillow: Heap use-after-free when encoding TIFF to an in-memory buffer",[2091,2092,2093],"BIT-pillow-2026-112396","CVE-2026-112396","PYSEC-2026-4328",[135,2093],"2026-10-19T22:17:06.837Z","2026-10-27T11:10:49.694224501Z",[2098,2100],{"type":1318,"score":2099},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"type":1318,"score":1402},[2102,2104,2106,2108,2109],{"type":1477,"url":2103},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4rr5-89j8-mwwm",{"type":1286,"url":2105},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112396",{"type":1326,"url":2107},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fdc95da20207827a062cfbf551ee9f6031465a8bb",{"type":1291,"url":1292},{"type":1286,"url":1294},[1300,1301,1302,1303,1304,1305],{"id":136,"slug":2112,"dossier":47,"summary":2113,"aliases":2114,"sourceIds":2117,"published":2118,"modified":2119,"checkedAt":7,"severity":2120,"references":2123,"versionKeys":2136,"packageCount":32,"repositoryCount":471},"ghsa-4w7r-h757-3r74-ca8973bc","Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer",[2115,2116],"CVE-2025-6921","PYSEC-2026-1980",[136,2116],"2025-09-23T15:31:09Z","2026-09-10T03:50:27.867584538Z",[2121],{"type":1318,"score":2122},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2124,2126,2128,2130,2131,2133,2134],{"type":1286,"url":2125},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6921",{"type":1283,"url":2127},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F47c34fba5c303576560cb29767efb452ff12b8be",{"type":1283,"url":2129},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fd37f7517972f67e3f2194c000ed0f87f064e5099",{"type":1291,"url":1475},{"type":1283,"url":2132},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F287d15a7-6e7c-45d2-8c05-11e305776f1f",{"type":1291,"url":1789},{"type":1286,"url":2135},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-4w7r-h757-3r74",[1482,1483,1484,1485],{"id":137,"slug":2138,"dossier":47,"summary":2139,"aliases":2140,"sourceIds":2144,"published":2145,"modified":2146,"checkedAt":7,"severity":2147,"references":2150,"versionKeys":2165,"packageCount":32,"repositoryCount":105},"ghsa-4x4j-2g7c-83w6-326c14d2","Pillow: WindowsViewer.get_command() OS command injection via unescaped shell path",[2141,2142,2143],"BIT-pillow-2026-55798","CVE-2026-55798","PYSEC-2026-2257",[137,2143],"2026-07-06T19:17:08.830Z","2026-09-10T03:51:10.324377232Z",[2148],{"type":1318,"score":2149},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[2151,2153,2155,2157,2159,2161,2163,2164],{"type":1477,"url":2152},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-4x4j-2g7c-83w6",{"type":1286,"url":2154},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55798",{"type":1326,"url":2156},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F8404ea5fe5df40fc34aa1e51403dd6fce0778b8a",{"type":1326,"url":2158},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F88194166691b7b603529b8b036ab3ab9cedd2de4",{"type":1326,"url":2160},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb0e06caa64c1405aa3da0bb1d2bd9a77ca22de7f",{"type":1283,"url":2162},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2257.yaml",{"type":1291,"url":1292},{"type":1286,"url":1918},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":138,"slug":2167,"dossier":47,"summary":2168,"aliases":2169,"sourceIds":2172,"published":2173,"modified":2174,"checkedAt":7,"severity":2175,"references":2178,"versionKeys":2201,"packageCount":32,"repositoryCount":2204},"ghsa-5239-wwwm-4pmq-228840e4","Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching",[2170,2171],"CVE-2026-4539","PYSEC-2026-2987",[138,2171],"2026-03-22T06:30:15Z","2026-09-10T03:50:59.780634752Z",[2176,2177],{"type":1318,"score":1696},{"type":1279,"score":1698},[2179,2181,2183,2185,2187,2189,2191,2193,2195,2197,2199],{"type":1286,"url":2180},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-4539",{"type":1283,"url":2182},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fissues\u002F3058",{"type":1283,"url":2184},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fpull\u002F3064",{"type":1283,"url":2186},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Fcommit\u002F24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc",{"type":1291,"url":2188},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments",{"type":1283,"url":2190},"https:\u002F\u002Fgithub.com\u002Fpygments\u002Fpygments\u002Freleases\u002Ftag\u002F2.20.0",{"type":1283,"url":2192},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352327",{"type":1283,"url":2194},"https:\u002F\u002Fvuldb.com\u002F?id.352327",{"type":1283,"url":2196},"https:\u002F\u002Fvuldb.com\u002F?submit.774685",{"type":1291,"url":2198},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpygments",{"type":1286,"url":2200},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5239-wwwm-4pmq",[2202,2203],"pypi:pygments@2.19.1","pypi:pygments@2.19.2",16,{"id":139,"slug":2206,"dossier":47,"summary":2207,"aliases":2208,"sourceIds":2212,"published":2213,"modified":2214,"checkedAt":7,"severity":2215,"references":2220,"versionKeys":2230,"packageCount":32,"repositoryCount":32},"ghsa-53q9-r3pm-6pq6-6fbb0149","PyTorch: `torch.load` with `weights_only=True` leads to remote code execution",[2209,2210,2211],"BIT-pytorch-2025-32434","CVE-2025-32434","PYSEC-2025-41",[139,2211],"2025-04-18T15:19:28Z","2026-08-07T08:12:20.395044060Z",[2216,2218],{"type":1279,"score":2217},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":2219},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2221,2223,2225,2227,2229],{"type":1286,"url":2222},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-53q9-r3pm-6pq6",{"type":1286,"url":2224},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-32434",{"type":1283,"url":2226},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F8d4b8a920a2172523deb95bf20e8e52d50649c04",{"type":1283,"url":2228},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-41.yaml",{"type":1291,"url":1712},[1724],{"id":140,"slug":2232,"dossier":47,"summary":2233,"aliases":2234,"sourceIds":2237,"published":2238,"modified":2239,"checkedAt":7,"severity":2240,"references":2243,"versionKeys":2255,"packageCount":32,"repositoryCount":452},"ghsa-54jq-c3m8-4m76-bba4b2d3","AIOHTTP vulnerable to brute-force leak of internal static file path components",[2235,2236],"CVE-2025-69226","PYSEC-2026-1097",[140,2236],"2026-01-05T23:09:51Z","2026-09-10T03:50:32.751498447Z",[2241],{"type":1279,"score":2242},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[2244,2246,2248,2250,2251,2253],{"type":1283,"url":2245},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-54jq-c3m8-4m76",{"type":1286,"url":2247},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69226",{"type":1326,"url":2249},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Ff2a86fd5ac0383000d1715afddfa704413f0711e",{"type":1291,"url":1545},{"type":1291,"url":2252},"https:\u002F\u002Fpypi.org\u002Fproject\u002Faiohttp",{"type":1286,"url":2254},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-54jq-c3m8-4m76",[1549,1550,1551,1552,1553,1554,1555],{"id":141,"slug":2257,"dossier":47,"summary":2258,"aliases":2259,"sourceIds":2262,"published":2263,"modified":2264,"checkedAt":7,"severity":2265,"references":2267,"versionKeys":2282,"packageCount":32,"repositoryCount":452},"ghsa-54p9-h82j-f925-623d2ef6","Multidict: Reference leak in CIMultiDict\u002FMultiDict items-view union and subtraction",[2260,2261],"CVE-2026-104874","PYSEC-2026-4244",[141,2261],"2026-10-05T23:40:58Z","2026-10-15T14:56:05.601333622Z",[2266],{"type":1318,"score":1502},[2268,2270,2272,2274,2276,2278,2280],{"type":1283,"url":2269},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Fsecurity\u002Fadvisories\u002FGHSA-54p9-h82j-f925",{"type":1286,"url":2271},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-104874",{"type":1283,"url":2273},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Fcommit\u002F350b4a07bf8ff851b6d7544e81b1c748bdc74c40",{"type":1291,"url":2275},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict",{"type":1283,"url":2277},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Fmultidict\u002Freleases\u002Ftag\u002Fv6.9.1",{"type":1291,"url":2279},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fmultidict",{"type":1286,"url":2281},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-54p9-h82j-f925",[2283,2284],"pypi:multidict@6.7.0","pypi:multidict@6.7.1",{"id":142,"slug":2286,"dossier":47,"summary":2287,"aliases":2288,"sourceIds":2290,"published":2291,"modified":2292,"checkedAt":7,"severity":2293,"references":2296,"versionKeys":2307,"packageCount":32,"repositoryCount":2312},"ghsa-567q-5qvw-pf92-60527ab6","filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",[2289],"CVE-2026-112907",[142],"2026-10-23T22:27:32Z","2026-10-23T22:45:03.452878321Z",[2294],{"type":1318,"score":2295},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[2297,2299,2301,2303,2305],{"type":1283,"url":2298},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-567q-5qvw-pf92",{"type":1283,"url":2300},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F835",{"type":1283,"url":2302},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Fe1e825b1992f69fb6b346dc395d5ae4893536c0a",{"type":1291,"url":2304},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock",{"type":1283,"url":2306},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.2.1",[2308,2309,2310,2311],"pypi:filelock@3.25.2","pypi:filelock@3.29.0","pypi:filelock@3.29.4","pypi:filelock@3.29.7",5,{"id":143,"slug":2314,"dossier":91,"summary":2315,"aliases":2316,"sourceIds":2320,"published":2321,"modified":2322,"checkedAt":7,"severity":2323,"references":2326,"versionKeys":2335,"packageCount":32,"repositoryCount":1306},"ghsa-58r4-6rv3-gfh8-17253bd5","Pillow: Out-of-bounds access in _imagingmorph on a zero-width image",[2317,2318,2319],"BIT-pillow-2026-112397","CVE-2026-112397","PYSEC-2026-4329",[143,2319],"2026-10-19T22:17:06.970Z","2026-10-28T11:10:53.627071818Z",[2324,2325],{"type":1279,"score":1568},{"type":1318,"score":1402},[2327,2329,2331,2333,2334],{"type":1477,"url":2328},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-58r4-6rv3-gfh8",{"type":1286,"url":2330},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112397",{"type":1326,"url":2332},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F18f7c0dfee93063c51db6ed0ca8c4da2999dcb64",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":144,"slug":2337,"dossier":47,"summary":2338,"aliases":2339,"sourceIds":2342,"published":2343,"modified":2344,"checkedAt":7,"severity":2345,"references":2348,"versionKeys":2361,"packageCount":32,"repositoryCount":32},"ghsa-59g5-xgcq-4qw3-949fce0e","Denial of service (DoS) via deformation `multipart\u002Fform-data` boundary",[2340,2341],"CVE-2024-53981","PYSEC-2026-1851",[144,2341],"2024-12-02T21:37:04Z","2026-09-10T03:50:21.270678783Z",[2346,2347],{"type":1318,"score":1402},{"type":1279,"score":1568},[2349,2351,2353,2355,2357,2359],{"type":1283,"url":2350},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-59g5-xgcq-4qw3",{"type":1286,"url":2352},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-53981",{"type":1283,"url":2354},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fcommit\u002Fc4fe4d3cebc08c660e57dd709af1ffa7059b3177",{"type":1291,"url":2356},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart",{"type":1291,"url":2358},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpython-multipart",{"type":1286,"url":2360},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59g5-xgcq-4qw3",[2362],"pypi:python-multipart@0.0.9",{"id":145,"slug":2364,"dossier":47,"summary":2365,"aliases":2366,"sourceIds":2369,"published":2370,"modified":2371,"checkedAt":7,"severity":2372,"references":2374,"versionKeys":2385,"packageCount":32,"repositoryCount":471},"ghsa-59p9-h35m-wg4g-68657c65","Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer",[2367,2368],"CVE-2025-6638","PYSEC-2026-1981",[145,2368],"2025-09-12T12:30:23Z","2026-09-10T03:50:58.113501288Z",[2373],{"type":1318,"score":2122},[2375,2377,2378,2379,2380,2382,2383],{"type":1286,"url":2376},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6638",{"type":1283,"url":2127},{"type":1283,"url":2129},{"type":1291,"url":1475},{"type":1283,"url":2381},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F6a6c933f-9ce8-4ded-8b3b-2c1444c61f36",{"type":1291,"url":1789},{"type":1286,"url":2384},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-59p9-h35m-wg4g",[1482,1483,1484,1485],{"id":146,"slug":2387,"dossier":47,"summary":2388,"aliases":2389,"sourceIds":2392,"published":2393,"modified":2394,"checkedAt":7,"severity":2395,"references":2398,"versionKeys":2415,"packageCount":32,"repositoryCount":2204},"ghsa-5p39-cfhj-2xmp-77a62550","AnyIO process-pool workers can block indefinitely on undrained stderr",[2390,2391],"CVE-2026-64847","PYSEC-2026-4024",[146,2391],"2026-09-18T17:17:10Z","2026-10-01T17:55:57.336188727Z",[2396],{"type":1279,"score":2397},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2399,2401,2403,2405,2407,2409,2411,2413],{"type":1283,"url":2400},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1283,"url":2402},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1207",{"type":1283,"url":2404},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002Ff1b7301c8264b0d2e8d24a5788fd29e93dea4040",{"type":1291,"url":2406},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio",{"type":1283,"url":2408},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Freleases\u002Ftag\u002F4.14.2",{"type":1291,"url":2410},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fanyio",{"type":1286,"url":2412},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5p39-cfhj-2xmp",{"type":1286,"url":2414},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-64847",[2416,2417,2418,2419,2420,2421,2422,2423],"pypi:anyio@4.10.0","pypi:anyio@4.11.0","pypi:anyio@4.12.1","pypi:anyio@4.13.0","pypi:anyio@4.3.0","pypi:anyio@4.5.2","pypi:anyio@4.8.0","pypi:anyio@4.9.0",{"id":147,"slug":2425,"dossier":47,"summary":2426,"aliases":2427,"sourceIds":2431,"published":2432,"modified":2433,"checkedAt":7,"severity":2434,"references":2439,"versionKeys":2456,"packageCount":32,"repositoryCount":471},"ghsa-5rjg-fvgr-3xxf-79d39e6b","setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write",[2428,2429,2430],"BIT-setuptools-2025-47273","CVE-2025-47273","PYSEC-2025-49",[147,2430],"2025-05-17T16:15:19Z","2026-09-10T03:50:24.253527717Z",[2435,2437],{"type":1279,"score":2436},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1318,"score":2438},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2440,2442,2444,2446,2448,2450,2452,2454],{"type":1477,"url":2441},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-5rjg-fvgr-3xxf",{"type":1286,"url":2443},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-47273",{"type":1705,"url":2445},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fissues\u002F4946",{"type":1326,"url":2447},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F250a6d17978f9f6ac3ac887091f2d32886fbbb0b",{"type":1283,"url":2449},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2025-49.yaml",{"type":1291,"url":2451},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools",{"type":1283,"url":2453},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fblob\u002F6ead555c5fb29bc57fe6105b1bffc163f56fd558\u002Fsetuptools\u002Fpackage_index.py#L810C1-L825C88",{"type":1333,"url":2455},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F05\u002Fmsg00035.html",[2457,2458,2459,2460],"pypi:setuptools@69.2.0","pypi:setuptools@72.2.0","pypi:setuptools@75.8.0","pypi:setuptools@78.1.0",{"id":148,"slug":2462,"dossier":47,"summary":2463,"aliases":2464,"sourceIds":2467,"published":2468,"modified":2469,"checkedAt":7,"severity":2470,"references":2472,"versionKeys":2481,"packageCount":32,"repositoryCount":104},"ghsa-5rvq-cxj2-64vf-5e3e7388","python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service",[2465,2466],"CVE-2026-53539","PYSEC-2026-3036",[148,2466],"2026-06-15T20:24:09Z","2026-09-10T03:50:48.426087467Z",[2471],{"type":1318,"score":1402},[2473,2475,2476,2477,2479],{"type":1283,"url":2474},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-5rvq-cxj2-64vf",{"type":1291,"url":2356},{"type":1291,"url":2358},{"type":1286,"url":2478},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-5rvq-cxj2-64vf",{"type":1286,"url":2480},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53539",[2482,2483,2484,2362],"pypi:python-multipart@0.0.18","pypi:python-multipart@0.0.20","pypi:python-multipart@0.0.28",{"id":149,"slug":2486,"dossier":47,"summary":2487,"aliases":2488,"sourceIds":2490,"published":2491,"modified":2492,"checkedAt":7,"severity":2493,"references":2495,"versionKeys":2502,"packageCount":32,"repositoryCount":1600},"ghsa-5wr8-gcqf-gqf3-8b4786ad","aiohttp server lacks an initial request\u002Fheader timeout",[2489],"CVE-2026-111064",[149],"2026-10-19T17:08:04Z","2026-10-19T17:15:04.139404381Z",[2494],{"type":1279,"score":1280},[2496,2498,2500,2501],{"type":1283,"url":2497},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-5wr8-gcqf-gqf3",{"type":1283,"url":2499},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbe846822b4b3a5a54b6163e794b42dc06fba54a3",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":150,"slug":2504,"dossier":91,"summary":2505,"aliases":2506,"sourceIds":2510,"published":2511,"modified":2512,"checkedAt":7,"severity":2513,"references":2517,"versionKeys":2526,"packageCount":32,"repositoryCount":1306},"ghsa-5x8w-8jj5-q52h-96fe86d3","Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution",[2507,2508,2509],"BIT-pillow-2026-112398","CVE-2026-112398","PYSEC-2026-4330",[150,2509],"2026-10-19T22:17:07.107Z","2026-10-28T11:10:48.833199086Z",[2514,2516],{"type":1279,"score":2515},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":2219},[2518,2520,2522,2524,2525],{"type":1477,"url":2519},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x8w-8jj5-q52h",{"type":1286,"url":2521},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112398",{"type":1326,"url":2523},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F242a059aedc1935097d9aa1dc3f099750467ba75",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":151,"slug":2528,"dossier":47,"summary":2529,"aliases":2530,"sourceIds":2534,"published":2535,"modified":2536,"checkedAt":7,"severity":2537,"references":2539,"versionKeys":2549,"packageCount":32,"repositoryCount":105},"ghsa-5x94-69rx-g8h2-0bc05f88","Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`",[2531,2532,2533],"BIT-pillow-2026-54060","CVE-2026-54060","PYSEC-2026-2254",[151,2533],"2026-07-06T19:17:08.270Z","2026-09-10T03:51:10.514604451Z",[2538],{"type":1318,"score":1402},[2540,2542,2544,2545,2547,2548],{"type":1477,"url":2541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5x94-69rx-g8h2",{"type":1286,"url":2543},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54060",{"type":1326,"url":1913},{"type":1283,"url":2546},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2254.yaml",{"type":1291,"url":1292},{"type":1286,"url":1918},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":152,"slug":2551,"dossier":91,"summary":2552,"aliases":2553,"sourceIds":2556,"published":2557,"modified":2558,"checkedAt":7,"severity":2559,"references":2561,"versionKeys":2570,"packageCount":32,"repositoryCount":1306},"ghsa-5xm2-6676-qcp9-1e22ee95","Pillow: APNG background disposal allocates full canvas before decompression bomb check",[2554,2555],"BIT-pillow-2026-112399","CVE-2026-112399",[152],"2026-10-21T21:17:56Z","2026-10-26T08:56:16.789537980Z",[2560],{"type":1279,"score":1568},[2562,2564,2566,2568,2569],{"type":1283,"url":2563},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xm2-6676-qcp9",{"type":1286,"url":2565},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112399",{"type":1283,"url":2567},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff1acfc54c53502948d0d14121872061df931db48",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":153,"slug":2572,"dossier":47,"summary":2573,"aliases":2574,"sourceIds":2578,"published":2579,"modified":2580,"checkedAt":7,"severity":2581,"references":2585,"versionKeys":2599,"packageCount":32,"repositoryCount":1600},"ghsa-5xmw-vc9v-4wf2-86a8861a","Pillow has a heap buffer overflow with nested list coordinates",[2575,2576,2577],"BIT-pillow-2026-42309","CVE-2026-42309","PYSEC-2026-2251",[153,2577],"2026-05-04T20:18:27Z","2026-10-19T20:00:04.709097863Z",[2582,2583],{"type":1318,"score":1700},{"type":1279,"score":2584},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2586,2588,2590,2592,2594,2596,2597],{"type":1286,"url":2587},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-5xmw-vc9v-4wf2",{"type":1286,"url":2589},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42309",{"type":1283,"url":2591},"https:\u002F\u002Fgithub.com\u002Fdesigncomputer\u002Fmysql_mcp_server\u002Fcommit\u002Fa96549f4a4d65443fd6e9c7f2324fba9a5c80a82",{"type":1283,"url":2593},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcf6de8ca9b23e714aa5310e1c791eda66fc0b670",{"type":1283,"url":2595},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2251.yaml",{"type":1291,"url":1292},{"type":1286,"url":2598},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.2.0",[1299,1300,1301,1302,1303],{"id":154,"slug":2601,"dossier":47,"summary":2602,"aliases":2603,"sourceIds":2607,"published":2608,"modified":2609,"checkedAt":7,"severity":2610,"references":2613,"versionKeys":2629,"packageCount":32,"repositoryCount":105},"ghsa-62p4-gmf7-7g93-cb81341c","Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)",[2604,2605,2606],"BIT-pillow-2026-54058","CVE-2026-54058","PYSEC-2026-3493",[154,2606],"2026-07-20T21:08:13Z","2026-09-10T03:51:10.632149522Z",[2611],{"type":1279,"score":2612},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[2614,2616,2618,2620,2622,2623,2625,2627],{"type":1283,"url":2615},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",{"type":1286,"url":2617},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54058",{"type":1283,"url":2619},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9719",{"type":1283,"url":2621},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6a8de891fb00968e5ea79bfa84368ed90b3cfc1d",{"type":1291,"url":1292},{"type":1283,"url":2624},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F12.3.0",{"type":1291,"url":2626},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpillow",{"type":1286,"url":2628},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-62p4-gmf7-7g93",[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":155,"slug":2631,"dossier":47,"summary":2632,"aliases":2633,"sourceIds":2638,"published":2639,"modified":2640,"checkedAt":7,"severity":2641,"references":2643,"versionKeys":2671,"packageCount":32,"repositoryCount":2679},"ghsa-63cw-57p8-fm3p-01ac35c7","PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files",[2634,2635,2636,2637],"BIT-pytorch-2026-24747","CVE-2026-24747","PYSEC-2026-1856","PYSEC-2026-2286",[155,2637],"2026-01-27T20:10:54Z","2026-11-04T03:15:10.870748916Z",[2642],{"type":1318,"score":1424},[2644,2646,2648,2650,2652,2654,2656,2658,2660,2662,2663,2665,2667,2669],{"type":1286,"url":2645},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fsecurity\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1286,"url":2647},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24747",{"type":1705,"url":2649},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F163105",{"type":1286,"url":2651},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:24977",{"type":1283,"url":2653},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-24747",{"type":1705,"url":2655},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2433612",{"type":1286,"url":2657},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-63cw-57p8-fm3p",{"type":1283,"url":2659},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpytorch\u002FPYSEC-2026-1856.yaml",{"type":1283,"url":2661},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2026-2286.yaml",{"type":1291,"url":1712},{"type":1326,"url":2664},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F163122\u002Fcommit\u002F954dc5183ee9205cbe79876ad05dd2d9ae752139",{"type":1286,"url":2666},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Freleases\u002Ftag\u002Fv2.10.0",{"type":1283,"url":2668},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fpytorch",{"type":1283,"url":2670},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-24747.json",[1724,1725,1726,2672,2673,2674,2675,2676,2677,2678],"pypi:torch@2.7.1","pypi:torch@2.7.1+cpu","pypi:torch@2.8.0","pypi:torch@2.9.0","pypi:torch@2.9.1","pypi:torch@2.9.1+cpu","pypi:torch@2.9.1+cu128",14,{"id":156,"slug":2681,"dossier":47,"summary":2682,"aliases":2683,"sourceIds":2686,"published":2687,"modified":2688,"checkedAt":7,"severity":2689,"references":2695,"versionKeys":2706,"packageCount":32,"repositoryCount":442},"ghsa-63hf-3vf5-4wqf-aadd9f0f","AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection\u002Fsecurity bypass",[2684,2685],"CVE-2026-34520","PYSEC-2026-2102",[156,2685],"2026-04-01T21:17:00.333Z","2026-09-10T03:50:43.255807027Z",[2690,2692,2693],{"type":1318,"score":2691},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",{"type":1279,"score":1612},{"type":1279,"score":2694},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[2696,2698,2700,2702,2703,2704],{"type":1326,"url":2697},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-63hf-3vf5-4wqf",{"type":1286,"url":2699},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34520",{"type":1326,"url":2701},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9370b9714a7a56003cacd31a9b4ae16eab109ba4",{"type":1291,"url":1545},{"type":1286,"url":1624},{"type":1283,"url":2705},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Faiohttp\u002FPYSEC-2026-2102.yaml",[1549,1550,1551,1552,1553,1554,1555,1556],{"id":157,"slug":2708,"dossier":47,"summary":2709,"aliases":2710,"sourceIds":2713,"published":2714,"modified":2715,"checkedAt":7,"severity":2716,"references":2719,"versionKeys":2725,"packageCount":32,"repositoryCount":66},"ghsa-63hw-fmq6-xxg2-00aac622","aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines",[2711,2712],"CVE-2026-54277","PYSEC-2026-2110",[157,2712],"2026-06-15T20:09:16Z","2026-09-10T03:50:48.460120366Z",[2717,2718],{"type":1279,"score":2000},{"type":1318,"score":1402},[2720,2722,2724],{"type":1286,"url":2721},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-63hw-fmq6-xxg2",{"type":1326,"url":2723},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F5ab61bb4cd88f19b712f12c7c9295fe262bf804d",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":158,"slug":2727,"dossier":47,"summary":2728,"aliases":2729,"sourceIds":2733,"published":2734,"modified":2735,"checkedAt":7,"severity":2736,"references":2740,"versionKeys":2751,"packageCount":32,"repositoryCount":1456},"ghsa-654x-cwwv-5j9c-54c66942","Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1",[2730,2731,2732],"BIT-pillow-2026-114501","CVE-2026-114501","PYSEC-2026-4336",[158,2732],"2026-10-21T22:16:49.410Z","2026-10-29T10:56:00.934076155Z",[2737,2738],{"type":1279,"score":1978},{"type":1318,"score":2739},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[2741,2743,2745,2747,2749,2750],{"type":1286,"url":2742},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-654x-cwwv-5j9c",{"type":1286,"url":2744},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-114501",{"type":1705,"url":2746},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10172",{"type":1326,"url":2748},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F19f64946eb247b973dd4560be7dea3bf979d2e6a",{"type":1291,"url":1292},{"type":1286,"url":1294},[1299,1300,1301,1302,1303,1304,1305],{"id":159,"slug":2753,"dossier":91,"summary":2754,"aliases":2755,"sourceIds":2758,"published":2759,"modified":2760,"checkedAt":7,"severity":2761,"references":2765,"versionKeys":2774,"packageCount":32,"repositoryCount":2779},"ghsa-65pc-fj4g-8rjx-9fe9e88a","Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix",[2756,2757],"CVE-2026-45409","PYSEC-2026-215",[159,2757],"2026-05-19T14:34:32Z","2026-09-10T03:50:45.700124422Z",[2762,2763],{"type":1318,"score":1502},{"type":1279,"score":2764},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[2766,2768,2770,2772],{"type":1286,"url":2767},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna\u002Fsecurity\u002Fadvisories\u002FGHSA-65pc-fj4g-8rjx",{"type":1286,"url":2769},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-45409",{"type":1291,"url":2771},"https:\u002F\u002Fgithub.com\u002Fkjd\u002Fidna",{"type":1283,"url":2773},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fidna\u002FPYSEC-2026-215.yaml",[2775,2776,2777,2778],"pypi:idna@3.10","pypi:idna@3.11","pypi:idna@3.14","pypi:idna@3.7",22,{"id":160,"slug":2781,"dossier":91,"summary":2782,"aliases":2783,"sourceIds":2786,"published":2787,"modified":2788,"checkedAt":7,"severity":2789,"references":2791,"versionKeys":2800,"packageCount":32,"repositoryCount":1306},"ghsa-65qm-jvmh-6pqg-7925f039","Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS",[2784,2785],"BIT-pillow-2026-112400","CVE-2026-112400",[160],"2026-10-20T20:53:36Z","2026-10-26T08:55:49.781288748Z",[2790],{"type":1279,"score":1568},[2792,2794,2796,2798,2799],{"type":1283,"url":2793},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-65qm-jvmh-6pqg",{"type":1286,"url":2795},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112400",{"type":1283,"url":2797},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6faed707cfb760a4cbd726ddc8406f576cf35bf7",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":161,"slug":2802,"dossier":47,"summary":2803,"aliases":2804,"sourceIds":2807,"published":2808,"modified":2809,"checkedAt":7,"severity":2810,"references":2812,"versionKeys":2823,"packageCount":32,"repositoryCount":452},"ghsa-69f9-5gxw-wvc2-eec14573","AIOHTTP's unicode processing of header values could cause parsing discrepancies",[2805,2806],"CVE-2025-69224","PYSEC-2026-1099",[161,2806],"2026-01-05T22:58:57Z","2026-09-10T03:49:54.440954011Z",[2811],{"type":1279,"score":1612},[2813,2815,2817,2819,2820,2821],{"type":1283,"url":2814},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-69f9-5gxw-wvc2",{"type":1286,"url":2816},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69224",{"type":1326,"url":2818},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F32677f2adfd907420c078dda6b79225c6f4ebce0",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":2822},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69f9-5gxw-wvc2",[1549,1550,1551,1552,1553,1554,1555],{"id":162,"slug":2825,"dossier":91,"summary":2826,"aliases":2827,"sourceIds":2829,"published":2830,"modified":2831,"checkedAt":7,"severity":2832,"references":2835,"versionKeys":2844,"packageCount":32,"repositoryCount":1306},"ghsa-69hj-f68j-2879-d34e420d","filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path",[2828],"CVE-2026-112909",[162],"2026-10-28T21:08:35Z","2026-10-28T21:15:04.974667790Z",[2833],{"type":1318,"score":2834},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:N",[2836,2838,2840,2841,2842,2843],{"type":1283,"url":2837},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-69hj-f68j-2879",{"type":1286,"url":2839},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112909",{"type":1283,"url":2300},{"type":1283,"url":2302},{"type":1291,"url":2304},{"type":1283,"url":2306},[2845,2846,2847,2848,2849,2308,2309,2310,2311],"pypi:filelock@3.16.1","pypi:filelock@3.18.0","pypi:filelock@3.19.1","pypi:filelock@3.20.0","pypi:filelock@3.20.3",{"id":163,"slug":2851,"dossier":47,"summary":2852,"aliases":2853,"sourceIds":2856,"published":2857,"modified":2858,"checkedAt":7,"severity":2859,"references":2864,"versionKeys":2876,"packageCount":32,"repositoryCount":66},"ghsa-69w3-r845-3855-1b4edc28","HuggingFace Transformers allows for arbitrary code execution in the `Trainer` class",[2854,2855],"CVE-2026-1839","PYSEC-2026-2288",[163,2855],"2026-04-07T06:16:41.490Z","2026-09-10T03:50:43.300048881Z",[2860,2862],{"type":1318,"score":2861},"CVSS:3.0\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:H",{"type":1318,"score":2863},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[2865,2867,2869,2870,2872,2874],{"type":1286,"url":2866},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-1839",{"type":1326,"url":2868},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F03c8082ba4594c9b8d6fe190ca9bed0e5f8ca396",{"type":1291,"url":1475},{"type":1283,"url":2871},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Freleases\u002Ftag\u002Fv5.0.0rc3",{"type":1477,"url":2873},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c77bb97-e493-493d-9a88-c57f5c536485",{"type":1286,"url":2875},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-69w3-r845-3855",[1482,1483,1484,1485,1486,1487,1488,1489,1490],{"id":164,"slug":2878,"dossier":47,"summary":2879,"aliases":2880,"sourceIds":2882,"published":2883,"modified":2884,"checkedAt":7,"severity":2885,"references":2887,"versionKeys":2896,"packageCount":32,"repositoryCount":1600},"ghsa-6cjc-53gc-5rqm-f1beb40a","AIOHTTP: Connector pool exhaustion via Max-Age overflow",[2881],"CVE-2026-111065",[164],"2026-10-20T19:57:24Z","2026-10-20T20:15:05.286053785Z",[2886],{"type":1279,"score":2764},[2888,2890,2892,2894,2895],{"type":1283,"url":2889},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6cjc-53gc-5rqm",{"type":1286,"url":2891},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111065",{"type":1283,"url":2893},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9dd8eaf4e31f1237ef2c1574a8c82a739fca5805",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":165,"slug":2898,"dossier":47,"summary":2899,"aliases":2900,"sourceIds":2903,"published":2904,"modified":2905,"checkedAt":7,"severity":2906,"references":2908,"versionKeys":2919,"packageCount":32,"repositoryCount":452},"ghsa-6jhg-hg63-jvvf-74cd77d8","AIOHTTP vulnerable to  denial of service through large payloads",[2901,2902],"CVE-2025-69228","PYSEC-2026-1100",[165,2902],"2026-01-05T23:13:14Z","2026-09-10T03:50:32.839537992Z",[2907],{"type":1279,"score":2000},[2909,2911,2913,2915,2916,2917],{"type":1283,"url":2910},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6jhg-hg63-jvvf",{"type":1286,"url":2912},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69228",{"type":1326,"url":2914},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fb7dbd35375aedbcd712cbae8ad513d56d11cce60",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":2918},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6jhg-hg63-jvvf",[1549,1550,1551,1552,1553,1554,1555],{"id":166,"slug":2921,"dossier":47,"summary":2922,"aliases":2923,"sourceIds":2926,"published":2927,"modified":2928,"checkedAt":7,"severity":2929,"references":2932,"versionKeys":2941,"packageCount":32,"repositoryCount":104},"ghsa-6jv3-5f52-599m-dd700d26","python-multipart: Semicolon treated as querystring field separator enables parameter smuggling",[2924,2925],"CVE-2026-53538","PYSEC-2026-3037",[166,2925],"2026-06-15T20:22:25Z","2026-09-10T03:51:07.925895532Z",[2930],{"type":1318,"score":2931},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",[2933,2935,2936,2937,2939],{"type":1283,"url":2934},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-6jv3-5f52-599m",{"type":1291,"url":2356},{"type":1291,"url":2358},{"type":1286,"url":2938},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6jv3-5f52-599m",{"type":1286,"url":2940},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53538",[2482,2483,2484,2362],{"id":167,"slug":2943,"dossier":47,"summary":2944,"aliases":2945,"sourceIds":2948,"published":2949,"modified":2950,"checkedAt":7,"severity":2951,"references":2953,"versionKeys":2964,"packageCount":32,"repositoryCount":452},"ghsa-6mq8-rvhq-8wgg-d94d738f","AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb",[2946,2947],"CVE-2025-69223","PYSEC-2026-1101",[167,2947],"2026-01-05T22:58:41Z","2026-09-10T03:50:32.830751052Z",[2952],{"type":1318,"score":1402},[2954,2956,2958,2960,2961,2962],{"type":1283,"url":2955},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-6mq8-rvhq-8wgg",{"type":1286,"url":2957},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69223",{"type":1326,"url":2959},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F2b920c39002cee0ec5b402581779bbaaf7c9138a",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":2963},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6mq8-rvhq-8wgg",[1549,1550,1551,1552,1553,1554,1555],{"id":168,"slug":2966,"dossier":91,"summary":2967,"aliases":2968,"sourceIds":2970,"published":2971,"modified":2972,"checkedAt":7,"severity":2973,"references":2976,"versionKeys":2988,"packageCount":32,"repositoryCount":3000},"ghsa-6q48-6c7w-9gw2-05036ff0","certifi bundles emSign root CAs with compromised intermediate CA keys",[2969],"PYSEC-2026-4320",[168,2969],"2026-10-20T19:35:05Z","2026-10-30T14:00:02.590922333Z",[2974],{"type":1279,"score":2975},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[2977,2979,2981,2983,2984,2986],{"type":1283,"url":2978},"https:\u002F\u002Fgithub.com\u002Fcertifi\u002Fpython-certifi\u002Fsecurity\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",{"type":1283,"url":2980},"https:\u002F\u002Fdiscuss.python.org\u002Ft\u002Finformation-for-python-users-regarding-emudhra-emsign-ca-certificate-security-incident\u002F109576",{"type":1283,"url":2982},"https:\u002F\u002Femudhra.we-have-a-problem.com\u002F",{"type":1291,"url":1329},{"type":1291,"url":2985},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fcertifi",{"type":1286,"url":2987},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6q48-6c7w-9gw2",[2989,1342,2990,2991,2992,2993,2994,2995,2996,2997,2998,2999],"pypi:certifi@2024.12.14","pypi:certifi@2025.1.31","pypi:certifi@2025.10.5","pypi:certifi@2025.11.12","pypi:certifi@2025.4.26","pypi:certifi@2025.6.15","pypi:certifi@2025.8.3","pypi:certifi@2026.1.4","pypi:certifi@2026.2.25","pypi:certifi@2026.4.22","pypi:certifi@2026.6.17",21,{"id":169,"slug":3002,"dossier":47,"summary":3003,"aliases":3004,"sourceIds":3008,"published":3009,"modified":3010,"checkedAt":7,"severity":3011,"references":3013,"versionKeys":3026,"packageCount":32,"repositoryCount":105},"ghsa-6r8x-57c9-28j4-3a620dbf","Pillow: Heap out-of-bounds write `Image.paste()` \u002F `Image.crop()` via signed coordinate overflow",[3005,3006,3007],"BIT-pillow-2026-59199","CVE-2026-59199","PYSEC-2026-3451",[169,3007],"2026-07-14T16:17:01.937Z","2026-09-10T03:51:10.822199342Z",[3012],{"type":1318,"score":1402},[3014,3016,3018,3020,3022,3024,3025],{"type":1477,"url":3015},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-6r8x-57c9-28j4",{"type":1286,"url":3017},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59199",{"type":1326,"url":3019},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9703",{"type":1326,"url":3021},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fceefc348eb3c3844c7f9796ef2cc3a7dd5fbba7b",{"type":1283,"url":3023},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3451.yaml",{"type":1291,"url":1292},{"type":1286,"url":2624},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":170,"slug":3028,"dossier":47,"summary":3029,"aliases":3030,"sourceIds":3033,"published":3034,"modified":3035,"checkedAt":7,"severity":3036,"references":3038,"versionKeys":3049,"packageCount":32,"repositoryCount":32},"ghsa-6rvg-6v2m-4j46-e04ee614","Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3031,3032],"CVE-2024-12720","PYSEC-2026-1982",[170,3032],"2025-03-20T12:32:43Z","2026-08-13T20:11:58.209202163Z",[3037],{"type":1318,"score":2122},[3039,3041,3043,3044,3046,3047],{"type":1286,"url":3040},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-12720",{"type":1283,"url":3042},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fdeac971c469bcbb182c2e52da0b82fb3bf54cccf",{"type":1291,"url":1475},{"type":1283,"url":3045},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F4bed1214-7835-4252-a853-22bbad891f98",{"type":1291,"url":1789},{"type":1286,"url":3048},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-6rvg-6v2m-4j46",[1482],{"id":171,"slug":3051,"dossier":91,"summary":3052,"aliases":3053,"sourceIds":3056,"published":3057,"modified":3058,"checkedAt":7,"severity":3059,"references":3061,"versionKeys":3070,"packageCount":32,"repositoryCount":1306},"ghsa-74r2-7ff9-mjj2-9127f170","Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()",[3054,3055],"BIT-pillow-2026-112401","CVE-2026-112401",[171],"2026-10-21T20:42:11Z","2026-10-26T08:56:13.792431880Z",[3060],{"type":1279,"score":2764},[3062,3064,3066,3068,3069],{"type":1283,"url":3063},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-74r2-7ff9-mjj2",{"type":1286,"url":3065},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112401",{"type":1283,"url":3067},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F68a3fe957d8a4d552e8c69d96066d749f0614c7e",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":172,"slug":3072,"dossier":47,"summary":3073,"aliases":3074,"sourceIds":3077,"published":3078,"modified":3079,"checkedAt":7,"severity":3080,"references":3083,"versionKeys":3096,"packageCount":32,"repositoryCount":452},"ghsa-768j-98cg-p3fv-0815ff07","fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib",[3075,3076],"CVE-2025-66034","PYSEC-2026-1389",[172,3076],"2025-12-01T19:07:00Z","2026-09-10T03:50:31.754255627Z",[3081],{"type":1318,"score":3082},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:N\u002FI:H\u002FA:L",[3084,3086,3088,3090,3092,3094],{"type":1283,"url":3085},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fsecurity\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",{"type":1286,"url":3087},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66034",{"type":1283,"url":3089},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools\u002Fcommit\u002Fa696d5ba93270d5954f98e7cab5ddca8a02c1e32",{"type":1291,"url":3091},"https:\u002F\u002Fgithub.com\u002Ffonttools\u002Ffonttools",{"type":1291,"url":3093},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffonttools",{"type":1286,"url":3095},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-768j-98cg-p3fv",[3097,3098,3099,3100,3101,3102],"pypi:fonttools@4.55.3","pypi:fonttools@4.55.8","pypi:fonttools@4.57.0","pypi:fonttools@4.58.0","pypi:fonttools@4.58.5","pypi:fonttools@4.59.2",{"id":173,"slug":3104,"dossier":47,"summary":3105,"aliases":3106,"sourceIds":3107,"published":3108,"modified":3109,"checkedAt":7,"severity":3110,"references":3113,"versionKeys":3126,"packageCount":32,"repositoryCount":1661},"ghsa-78g4-xqwv-q3g8-95d38591","Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()",[],[173],"2026-10-22T17:01:08Z","2026-10-22T17:15:04.326552524Z",[3111],{"type":1318,"score":3112},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[3114,3116,3118,3120,3122,3123,3124],{"type":1283,"url":3115},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-78g4-xqwv-q3g8",{"type":1283,"url":3117},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5f8114c8096b181fae493543cd3837d9f9a971cc",{"type":1283,"url":3119},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd3470c327840f4c216a1610f30e7091dfd0b97c0",{"type":1283,"url":3121},"https:\u002F\u002Fgithub.com\u002Fuclouvain\u002Fopenjpeg\u002Fcommit\u002F91d08b11a72764f6d199f32fa0c1b1abd4edc2ad",{"type":1291,"url":1292},{"type":1283,"url":1294},{"type":1283,"url":3125},"https:\u002F\u002Fosv.dev\u002Fvulnerability\u002FOSV-2025-219",[1298,1299,1300,1301,1302,1303,1304,1305],{"id":174,"slug":3128,"dossier":47,"summary":3129,"aliases":3130,"sourceIds":3133,"published":3134,"modified":3135,"checkedAt":7,"severity":3136,"references":3138,"versionKeys":3155,"packageCount":32,"repositoryCount":34},"ghsa-7f5h-v6xp-fcq8-9393173e","Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``",[3131,3132],"CVE-2025-62727","PYSEC-2026-1942",[174,3132],"2025-10-28T20:38:01Z","2026-09-10T03:50:29.490992457Z",[3137],{"type":1318,"score":1402},[3139,3141,3143,3145,3148,3150,3152,3153],{"type":1283,"url":3140},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-7f5h-v6xp-fcq8",{"type":1286,"url":3142},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-62727",{"type":1326,"url":3144},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F4ea6e22b489ec388d6004cfbca52dd5b147127c5",{"type":3146,"url":3147},"INTRODUCED","https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F69ed26a85956ef4bd0161807eb27abf49be7cd3c",{"type":1291,"url":3149},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette",{"type":1283,"url":3151},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Freleases\u002Ftag\u002F0.49.1",{"type":1291,"url":1517},{"type":1286,"url":3154},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-7f5h-v6xp-fcq8",[1522,1523,3156,3157,3158],"pypi:starlette@0.47.3","pypi:starlette@0.48.0","pypi:starlette@0.49.0",{"id":175,"slug":3160,"dossier":91,"summary":3161,"aliases":3162,"sourceIds":3166,"published":3167,"modified":3168,"checkedAt":7,"severity":3169,"references":3172,"versionKeys":3181,"packageCount":32,"repositoryCount":1306},"ghsa-7mwm-ghpf-9vrm-446e4269","Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform",[3163,3164,3165],"BIT-pillow-2026-112402","CVE-2026-112402","PYSEC-2026-4331",[175,3165],"2026-10-19T22:17:07.633Z","2026-10-28T11:10:35.587185673Z",[3170,3171],{"type":1279,"score":1568},{"type":1318,"score":1402},[3173,3175,3177,3179,3180],{"type":1326,"url":3174},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-7mwm-ghpf-9vrm",{"type":1286,"url":3176},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112402",{"type":1326,"url":3178},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faafa6c75f7cdabb9f409a8aac7c780bea31d08d9",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":176,"slug":3183,"dossier":47,"summary":3184,"aliases":3185,"sourceIds":3188,"published":3189,"modified":3190,"checkedAt":7,"severity":3191,"references":3194,"versionKeys":3208,"packageCount":32,"repositoryCount":2204},"ghsa-82r6-8w77-94w6-217253d8","AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing",[3186,3187],"CVE-2026-63374","PYSEC-2026-4025",[176,3187],"2026-09-18T17:17:18Z","2026-10-01T17:56:11.058322399Z",[3192],{"type":1279,"score":3193},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3195,3197,3199,3201,3202,3203,3204,3206],{"type":1283,"url":3196},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fsecurity\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1283,"url":3198},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fpull\u002F1208",{"type":1283,"url":3200},"https:\u002F\u002Fgithub.com\u002Fagronholm\u002Fanyio\u002Fcommit\u002F68f58915f82d9be8109ebbbd8f5d70577d43f2ce",{"type":1291,"url":2406},{"type":1283,"url":2408},{"type":1291,"url":2410},{"type":1286,"url":3205},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-82r6-8w77-94w6",{"type":1286,"url":3207},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-63374",[2416,2417,2418,2419,2420,2421,2422,2423],{"id":177,"slug":3210,"dossier":47,"summary":3211,"aliases":3212,"sourceIds":3215,"published":3216,"modified":3217,"checkedAt":7,"severity":3218,"references":3220,"versionKeys":3224,"packageCount":32,"repositoryCount":442},"ghsa-82w8-qh3p-5jfq-a05ef51e","Starlette: request.form() limits silently ignored for application\u002Fx-www-form-urlencoded enable DoS",[3213,3214],"CVE-2026-54283","PYSEC-2026-249",[177,3214],"2026-06-15T20:39:53Z","2026-09-10T03:51:08.156199030Z",[3219],{"type":1318,"score":1402},[3221,3223],{"type":1286,"url":3222},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-82w8-qh3p-5jfq",{"type":1291,"url":3149},[1521,1522,1523,3156,3157,3158,3225,3226,3227],"pypi:starlette@0.49.3","pypi:starlette@0.50.0","pypi:starlette@1.0.0",{"id":178,"slug":3229,"dossier":47,"summary":3230,"aliases":3231,"sourceIds":3235,"published":3236,"modified":3237,"checkedAt":7,"severity":3238,"references":3241,"versionKeys":3278,"packageCount":32,"repositoryCount":442},"ghsa-86qp-5c8j-p5mr-13e563cb","Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks",[3232,3233,3234],"CVE-2026-48710","PYSEC-2026-161","X41-2026-002",[178,3233],"2026-05-22T13:10:03Z","2026-09-10T03:51:08.121685407Z",[3239],{"type":1318,"score":3240},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[3242,3244,3246,3248,3250,3252,3254,3256,3258,3260,3261,3263,3266,3268,3270,3272,3274,3276],{"type":1286,"url":3243},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-86qp-5c8j-p5mr",{"type":1286,"url":3245},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48710",{"type":1326,"url":3247},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002F764dab0dcfb9033d75442d7a359645c9f94648c6",{"type":1283,"url":3249},"https:\u002F\u002Fwww.x41-dsec.de\u002Flab\u002Fadvisories\u002Fx41-2026-002-starlette",{"type":1333,"url":3251},"https:\u002F\u002Fwww.secwest.net\u002Fstarlette",{"type":1283,"url":3253},"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-48710",{"type":1283,"url":3255},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-48710.json",{"type":1283,"url":3257},"https:\u002F\u002Fostif.org\u002Fdisclosing-the-badhost-vulnerability-in-starlette",{"type":1283,"url":3259},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstarlette\u002FPYSEC-2026-161.yaml",{"type":1291,"url":3149},{"type":1283,"url":3262},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2481742",{"type":3264,"url":3265},"DETECTION","https:\u002F\u002Fbadhost.org\u002F",{"type":1283,"url":3267},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-48710",{"type":1283,"url":3269},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:60520",{"type":1283,"url":3271},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:51357",{"type":1283,"url":3273},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:44696",{"type":1333,"url":3275},"https:\u002F\u002Fostif.org\u002Fdisclosing-the-badhost-vulnerability-in-starlette\u002F",{"type":1286,"url":3277},"https:\u002F\u002Fwww.x41-dsec.de\u002Flab\u002Fadvisories\u002Fx41-2026-002-starlette\u002F",[1521,1522,1523,3156,3157,3158,3225,3226,3227],{"id":179,"slug":3280,"dossier":47,"summary":3281,"aliases":3282,"sourceIds":3286,"published":3287,"modified":3288,"checkedAt":7,"severity":3289,"references":3293,"versionKeys":3315,"packageCount":32,"repositoryCount":452},"ghsa-887c-mr87-cxwp-233a2961","PyTorch Improper Resource Shutdown or Release vulnerability",[3283,3284,3285],"BIT-pytorch-2025-3730","CVE-2025-3730","PYSEC-2026-1970",[179,3285],"2025-04-16T21:30:59Z","2026-09-10T03:50:23.660138570Z",[3290,3291],{"type":1318,"score":1696},{"type":1279,"score":3292},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3294,3296,3298,3300,3302,3304,3305,3307,3309,3311,3313],{"type":1286,"url":3295},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3730",{"type":1283,"url":3297},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F150835",{"type":1283,"url":3299},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F150981",{"type":1283,"url":3301},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F01f226bfb8f2c343f5c614a6bbf685d91160f3af",{"type":1283,"url":3303},"https:\u002F\u002Fgithub.com\u002Ftimocafe\u002Ftewart-pytorch\u002Fcommit\u002F46fc5d8e360127361211cb237d5f9eef0223e567",{"type":1291,"url":1712},{"type":1283,"url":3306},"https:\u002F\u002Fvuldb.com\u002F?ctiid.305076",{"type":1283,"url":3308},"https:\u002F\u002Fvuldb.com\u002F?id.305076",{"type":1283,"url":3310},"https:\u002F\u002Fvuldb.com\u002F?submit.553645",{"type":1291,"url":3312},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftorch",{"type":1286,"url":3314},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-887c-mr87-cxwp",[1724,1725,1726,2672,2673],{"id":180,"slug":3317,"dossier":91,"summary":3318,"aliases":3319,"sourceIds":3322,"published":3323,"modified":3324,"checkedAt":7,"severity":3325,"references":3328,"versionKeys":3345,"packageCount":32,"repositoryCount":2779},"ghsa-8988-9cw3-xx77-ee9c660c","urllib3: HTTPS proxy TLS configuration may be ignored or overridden",[3320,3321],"CVE-2026-97687","PYSEC-2026-4175",[180,3321],"2026-09-30T14:46:04Z","2026-10-01T17:55:53.793608550Z",[3326],{"type":1279,"score":3327},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[3329,3331,3333,3335,3337,3339,3340,3342,3343],{"type":1283,"url":3330},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",{"type":1286,"url":3332},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97687",{"type":1283,"url":3334},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fpull\u002F5093",{"type":1283,"url":3336},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F07408cec79d1856d81bb42c74a904a24fdb9e465",{"type":1283,"url":3338},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fb6447295fff7b38fdffc67e0df9712d60cef3cc3",{"type":1291,"url":1652},{"type":1283,"url":3341},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Freleases\u002Ftag\u002F2.8.0",{"type":1291,"url":1654},{"type":1286,"url":3344},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-8988-9cw3-xx77",[1656,1657,1658,1659,1660,3346,3347],"pypi:urllib3@2.6.3","pypi:urllib3@2.7.0",{"id":181,"slug":3349,"dossier":47,"summary":3350,"aliases":3351,"sourceIds":3355,"published":3356,"modified":3357,"checkedAt":7,"severity":3358,"references":3361,"versionKeys":3369,"packageCount":32,"repositoryCount":1306},"ghsa-8g5g-8vmr-9782-3b73f6ca","Pillow: Heap buffer overflow in ImagingJpegDecode",[3352,3353,3354],"BIT-pillow-2026-112403","CVE-2026-112403","PYSEC-2026-4332",[181,3354],"2026-10-19T22:17:07.770Z","2026-10-28T11:10:51.788355157Z",[3359,3360],{"type":1279,"score":2515},{"type":1318,"score":2219},[3362,3364,3366,3367,3368],{"type":1477,"url":3363},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8g5g-8vmr-9782",{"type":1286,"url":3365},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112403",{"type":1326,"url":2523},{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":182,"slug":3371,"dossier":47,"summary":3372,"aliases":3373,"sourceIds":3375,"published":3376,"modified":3377,"checkedAt":7,"severity":3378,"references":3381,"versionKeys":3388,"packageCount":32,"repositoryCount":1306},"ghsa-8mx5-7m5m-r77g-03e425ff","filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",[3374],"CVE-2026-112910",[182],"2026-10-28T21:08:55Z","2026-10-28T21:15:05.688436299Z",[3379],{"type":1318,"score":3380},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:L",[3382,3384,3385,3386,3387],{"type":1283,"url":3383},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-8mx5-7m5m-r77g",{"type":1283,"url":2300},{"type":1283,"url":2302},{"type":1291,"url":2304},{"type":1283,"url":2306},[2845,2846,2847,2848,2849,2308,2309,2310,2311],{"id":183,"slug":3390,"dossier":47,"summary":3391,"aliases":3392,"sourceIds":3396,"published":3397,"modified":3398,"checkedAt":7,"severity":3399,"references":3401,"versionKeys":3411,"packageCount":32,"repositoryCount":105},"ghsa-8v84-f9pq-wr9x-6c1b185f","Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading",[3393,3394,3395],"BIT-pillow-2026-54059","CVE-2026-54059","PYSEC-2026-2253",[183,3395],"2026-07-06T19:17:08.127Z","2026-09-10T03:51:11.229114807Z",[3400],{"type":1318,"score":1402},[3402,3404,3406,3407,3409,3410],{"type":1477,"url":3403},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-8v84-f9pq-wr9x",{"type":1286,"url":3405},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54059",{"type":1326,"url":1913},{"type":1283,"url":3408},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2253.yaml",{"type":1291,"url":1292},{"type":1286,"url":1918},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":184,"slug":3413,"dossier":47,"summary":3414,"aliases":3415,"sourceIds":3418,"published":3419,"modified":3420,"checkedAt":7,"severity":3421,"references":3423,"versionKeys":3436,"packageCount":32,"repositoryCount":471},"ghsa-9356-575x-2w9m-908a1f8c","Hugging Face Transformers Regular Expression Denial of Service (ReDoS) vulnerability",[3416,3417],"CVE-2025-5197","PYSEC-2026-1983",[184,3417],"2025-08-06T12:31:20Z","2026-09-10T03:50:26.988216861Z",[3422],{"type":1318,"score":2122},[3424,3426,3428,3430,3431,3433,3434],{"type":1286,"url":3425},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-5197",{"type":1283,"url":3427},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F701caef704e356dc2f9331cc3fd5df0eccb4720a",{"type":1283,"url":3429},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F944b56000be5e9b61af8301aa340838770ad8a0b",{"type":1291,"url":1475},{"type":1283,"url":3432},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3f8b3fd0-166b-46e7-b60f-60dd9d2678bf",{"type":1291,"url":1789},{"type":1286,"url":3435},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9356-575x-2w9m",[1482,1483,1484,1485],{"id":185,"slug":3438,"dossier":47,"summary":3439,"aliases":3440,"sourceIds":3443,"published":3444,"modified":3445,"checkedAt":7,"severity":3446,"references":3449,"versionKeys":3460,"packageCount":32,"repositoryCount":471},"ghsa-9548-qrrj-x5pj-6121f213","AIOHTTP is vulnerable to HTTP Request\u002FResponse Smuggling through incorrect parsing of chunked trailer sections",[3441,3442],"CVE-2025-53643","PYSEC-2026-1104",[185,3442],"2025-07-14T19:33:31Z","2026-09-10T03:50:26.231846188Z",[3447],{"type":1279,"score":3448},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[3450,3452,3454,3456,3457,3458],{"type":1283,"url":3451},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9548-qrrj-x5pj",{"type":1286,"url":3453},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-53643",{"type":1326,"url":3455},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fe8d774f635dc6d1cd3174d0e38891da5de0e2b6a",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":3459},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9548-qrrj-x5pj",[1549,1550,1551,1552],{"id":186,"slug":3462,"dossier":47,"summary":3463,"aliases":3464,"sourceIds":3467,"published":3468,"modified":3469,"checkedAt":7,"severity":3470,"references":3473,"versionKeys":3482,"packageCount":32,"repositoryCount":442},"ghsa-966j-vmvw-g2g9-dad9a989","AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect",[3465,3466],"CVE-2026-34518","PYSEC-2026-2100",[186,3466],"2026-04-01T21:17:00.020Z","2026-09-10T03:51:01.374434696Z",[3471,3472],{"type":1318,"score":2739},{"type":1279,"score":2242},[3474,3476,3478,3480,3481],{"type":1326,"url":3475},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-966j-vmvw-g2g9",{"type":1286,"url":3477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34518",{"type":1326,"url":3479},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F5351c980dcec7ad385730efdf4e1f4338b24fdb6",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":187,"slug":3484,"dossier":47,"summary":3485,"aliases":3486,"sourceIds":3489,"published":3490,"modified":3491,"checkedAt":7,"severity":3492,"references":3495,"versionKeys":3518,"packageCount":32,"repositoryCount":452},"ghsa-9hjg-9r4m-mvj7-32d7b63e","Requests vulnerable to .netrc credentials leak via malicious URLs",[3487,3488],"CVE-2024-47081","PYSEC-2026-1872",[187,3488],"2025-06-09T19:06:08Z","2026-10-19T20:00:04.716114530Z",[3493],{"type":1318,"score":3494},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[3496,3498,3500,3502,3504,3506,3508,3510,3512,3514,3516],{"type":1283,"url":3497},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1286,"url":3499},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47081",{"type":1283,"url":3501},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6965",{"type":1326,"url":3503},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F96ba401c1296ab1dda74a2365ef36d88f7d144ef",{"type":1286,"url":3505},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9hjg-9r4m-mvj7",{"type":1291,"url":3507},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests",{"type":1283,"url":3509},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.32.4",{"type":1283,"url":3511},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Frequests\u002FPYSEC-2026-1872.yaml",{"type":1291,"url":3513},"https:\u002F\u002Fpypi.org\u002Fproject\u002Frequests",{"type":1283,"url":3515},"https:\u002F\u002Frequests.readthedocs.io\u002Fen\u002Flatest\u002Fapi\u002F#requests.Session.trust_env",{"type":1283,"url":3517},"https:\u002F\u002Fseclists.org\u002Ffulldisclosure\u002F2025\u002FJun\u002F2",[3519,3520],"pypi:requests@2.31.0","pypi:requests@2.32.3",{"id":188,"slug":3522,"dossier":47,"summary":3523,"aliases":3524,"sourceIds":3528,"published":3529,"modified":3530,"checkedAt":7,"severity":3531,"references":3533,"versionKeys":3546,"packageCount":32,"repositoryCount":105},"ghsa-9hw9-ch79-4vh6-1ebda54f","Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch",[3525,3526,3527],"BIT-pillow-2026-59205","CVE-2026-59205","PYSEC-2026-3453",[188,3527],"2026-07-14T16:17:02.370Z","2026-09-10T03:51:11.334365483Z",[3532],{"type":1318,"score":1402},[3534,3536,3538,3540,3542,3544,3545],{"type":1477,"url":3535},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9hw9-ch79-4vh6",{"type":1286,"url":3537},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59205",{"type":1326,"url":3539},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9715",{"type":1326,"url":3541},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa9ffc42bedf4fc0a7ef8d6486e7f9e81e3397721",{"type":1283,"url":3543},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3453.yaml",{"type":1291,"url":1292},{"type":1286,"url":2624},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":189,"slug":3548,"dossier":47,"summary":3549,"aliases":3550,"sourceIds":3554,"published":3555,"modified":3556,"checkedAt":7,"severity":3557,"references":3562,"versionKeys":3573,"packageCount":32,"repositoryCount":1306},"ghsa-9v9v-9qvf-h2hj-0344c250","Pillow: Heap over-read in WMF\u002FEMF rendering via 16-bit dimension truncation (Windows builds)",[3551,3552,3553],"BIT-pillow-2026-96644","CVE-2026-96644","PYSEC-2026-4343",[189,3553],"2026-10-21T21:20:32.943Z","2026-10-29T10:55:35.129178084Z",[3558,3560],{"type":1279,"score":3559},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":3561},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[3563,3565,3567,3569,3571,3572],{"type":1286,"url":3564},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-9v9v-9qvf-h2hj",{"type":1286,"url":3566},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96644",{"type":1705,"url":3568},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10120",{"type":1326,"url":3570},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4cf46bee338304c5c8968fd7f132ba0d40c428b7",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":190,"slug":3575,"dossier":47,"summary":3576,"aliases":3577,"sourceIds":3579,"published":3580,"modified":3581,"checkedAt":7,"severity":3582,"references":3584,"versionKeys":3593,"packageCount":32,"repositoryCount":2312},"ghsa-9vhv-jxww-xfm5-e19a009a","filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",[3578],"CVE-2026-112913",[190],"2026-10-23T22:28:19Z","2026-10-23T22:45:03.439584635Z",[3583],{"type":1318,"score":1696},[3585,3587,3589,3591,3592],{"type":1283,"url":3586},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-9vhv-jxww-xfm5",{"type":1283,"url":3588},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F834",{"type":1283,"url":3590},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d",{"type":1291,"url":2304},{"type":1283,"url":2306},[2308,2309,2310,2311],{"id":191,"slug":3595,"dossier":47,"summary":3596,"aliases":3597,"sourceIds":3600,"published":3601,"modified":3602,"checkedAt":7,"severity":3603,"references":3606,"versionKeys":3623,"packageCount":32,"repositoryCount":32},"ghsa-9wx4-h78v-vm56-6a334c57","Requests `Session` object does not verify requests after making first request with verify=False",[3598,3599],"CVE-2024-35195","PYSEC-2026-1873",[191,3599],"2024-05-20T20:15:00Z","2026-09-10T03:50:13.740879755Z",[3604],{"type":1318,"score":3605},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[3607,3609,3611,3613,3615,3616,3618,3620,3621],{"type":1283,"url":3608},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",{"type":1286,"url":3610},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-35195",{"type":1283,"url":3612},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fpull\u002F6655",{"type":1326,"url":3614},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002Fa58d7f2ffb4d00b46dca2d70a3932a0b37e22fac",{"type":1291,"url":3507},{"type":1283,"url":3617},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FIYLSNK5TL46Q6XPRVMHVWS63MVJQOK4Q",{"type":1283,"url":3619},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FN7WP6EYDSUOCOJYHDK5NX43PYZ4SNHGZ",{"type":1291,"url":3513},{"type":1286,"url":3622},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-9wx4-h78v-vm56",[3519],{"id":192,"slug":3625,"dossier":47,"summary":3626,"aliases":3627,"sourceIds":3630,"published":3631,"modified":3632,"checkedAt":7,"severity":3633,"references":3637,"versionKeys":3643,"packageCount":32,"repositoryCount":66},"ghsa-9x8q-7h8h-wcw9-af94166e","aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect",[3628,3629],"CVE-2026-54280","PYSEC-2026-2113",[192,3629],"2026-06-15T20:10:44Z","2026-09-10T03:50:55.382836820Z",[3634,3636],{"type":1279,"score":3635},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":1402},[3638,3640,3642],{"type":1286,"url":3639},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9x8q-7h8h-wcw9",{"type":1326,"url":3641},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fa762eda5242f6490d6ba667533193f8b473ad587",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":193,"slug":3645,"dossier":47,"summary":3646,"aliases":3647,"sourceIds":3649,"published":3650,"modified":3651,"checkedAt":7,"severity":3652,"references":3654,"versionKeys":3663,"packageCount":32,"repositoryCount":1600},"ghsa-9xw5-w5jj-pvcg-5b93a500","AIOHTTP: File descriptor exhaustion in multipart requests",[3648],"CVE-2026-111066",[193],"2026-10-20T19:52:09Z","2026-10-20T20:00:04.692319554Z",[3653],{"type":1279,"score":1280},[3655,3657,3659,3661,3662],{"type":1283,"url":3656},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-9xw5-w5jj-pvcg",{"type":1286,"url":3658},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111066",{"type":1283,"url":3660},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F2d94633b7f1b4c1ba07d647b629a8440652b2d09",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":194,"slug":3665,"dossier":47,"summary":3666,"aliases":3667,"sourceIds":3670,"published":3671,"modified":3672,"checkedAt":7,"severity":3673,"references":3677,"versionKeys":3688,"packageCount":32,"repositoryCount":442},"ghsa-c427-h43c-vf67-fa5b38aa","AIOHTTP accepts duplicate Host headers",[3668,3669],"CVE-2026-34525","PYSEC-2026-2103",[194,3669],"2026-04-01T21:17:00.490Z","2026-09-10T03:51:01.505705751Z",[3674,3676],{"type":1279,"score":3675},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:L\u002FSI:L\u002FSA:N",{"type":1318,"score":1614},[3678,3680,3682,3684,3686,3687],{"type":1326,"url":3679},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-c427-h43c-vf67",{"type":1286,"url":3681},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34525",{"type":1326,"url":3683},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F53e2e6fc58b89c6185be7820bd2c9f40216b3000",{"type":1326,"url":3685},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fe00ca3cca92c465c7913c4beb763a72da9ed8349",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":195,"slug":3690,"dossier":47,"summary":3691,"aliases":3692,"sourceIds":3696,"published":3697,"modified":3698,"checkedAt":7,"severity":3699,"references":3704,"versionKeys":3720,"packageCount":32,"repositoryCount":500},"ghsa-c678-jfcj-6jmf-cd9a8774","PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument",[3693,3694,3695],"BIT-pytorch-2025-2148","CVE-2025-2148","PYSEC-2025-189",[195],"2025-03-10T12:30:55Z","2026-06-09T21:26:06.844649427Z",[3700,3702],{"type":1318,"score":3701},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:L",{"type":1279,"score":3703},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3705,3707,3709,3711,3712,3714,3716,3718],{"type":1286,"url":3706},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2148",{"type":1283,"url":3708},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147722",{"type":1283,"url":3710},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-189.yaml",{"type":1291,"url":1712},{"type":1283,"url":3713},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fblob\u002Fb0a67c7495bb11ecb23e556058db059ba48354af\u002Ftorch\u002Fautograd\u002Fprofiler.py#L990",{"type":1283,"url":3715},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299059",{"type":1283,"url":3717},"https:\u002F\u002Fvuldb.com\u002F?id.299059",{"type":1283,"url":3719},"https:\u002F\u002Fvuldb.com\u002F?submit.505959",[1724,1725],{"id":196,"slug":3722,"dossier":47,"summary":3723,"aliases":3724,"sourceIds":3727,"published":3728,"modified":3729,"checkedAt":7,"severity":3730,"references":3733,"versionKeys":3742,"packageCount":32,"repositoryCount":1306},"ghsa-c6hw-5grf-ff96-1e7aec72","Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels",[3725,3726],"BIT-pillow-2026-112404","CVE-2026-112404",[196],"2026-10-20T20:42:00Z","2026-10-26T08:55:55.669563065Z",[3731],{"type":1279,"score":3732},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3734,3736,3738,3740,3741],{"type":1283,"url":3735},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-c6hw-5grf-ff96",{"type":1286,"url":3737},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112404",{"type":1283,"url":3739},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":197,"slug":3744,"dossier":47,"summary":3745,"aliases":3746,"sourceIds":3750,"published":3751,"modified":3752,"checkedAt":7,"severity":3753,"references":3757,"versionKeys":3797,"packageCount":32,"repositoryCount":2204},"ghsa-cfh3-3jmp-rvhc-4e95572c","Pillow affected by out-of-bounds write when loading PSD images",[3747,3748,3749],"BIT-pillow-2026-25990","CVE-2026-25990","PYSEC-2026-2249",[197,3749],"2026-02-11T14:22:50Z","2026-09-10T03:50:59.393816085Z",[3754,3756],{"type":1279,"score":3755},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":1402},[3758,3760,3762,3764,3766,3768,3769,3771,3773,3775,3777,3779,3781,3783,3785,3787,3789,3791,3793,3795],{"type":1283,"url":3759},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cfh3-3jmp-rvhc",{"type":1286,"url":3761},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25990",{"type":1283,"url":3763},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9427",{"type":1283,"url":3765},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F54ba4db542ad3c7b918812a4e2d69c27735a3199",{"type":1283,"url":3767},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F9000313cc5d4a31bdcdd6d7f0781101abab553aa",{"type":1291,"url":1292},{"type":1283,"url":3770},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.1.1.html",{"type":1283,"url":3772},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-25990",{"type":1283,"url":3774},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-25990.json",{"type":1286,"url":3776},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:10184",{"type":1286,"url":3778},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14873",{"type":1286,"url":3780},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:14874",{"type":1286,"url":3782},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16174",{"type":1286,"url":3784},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19712",{"type":1286,"url":3786},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:28385",{"type":1286,"url":3788},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3461",{"type":1286,"url":3790},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:3462",{"type":1286,"url":3792},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4128",{"type":1286,"url":3794},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:4942",{"type":1286,"url":3796},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:5168",[1296,1297,1298,1299,1300,1301,1302],{"id":198,"slug":3799,"dossier":47,"summary":3800,"aliases":3801,"sourceIds":3805,"published":3806,"modified":3807,"checkedAt":7,"severity":3808,"references":3811,"versionKeys":3820,"packageCount":32,"repositoryCount":104},"ghsa-cp9v-662q-vvx9-b0a60d48","Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0",[3802,3803,3804],"BIT-pillow-2026-112405","CVE-2026-112405","PYSEC-2026-4333",[198,3804],"2026-10-19T22:17:08.027Z","2026-10-28T11:10:36.014536437Z",[3809,3810],{"type":1279,"score":1568},{"type":1318,"score":1402},[3812,3814,3816,3818,3819],{"type":1477,"url":3813},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-cp9v-662q-vvx9",{"type":1286,"url":3815},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112405",{"type":1326,"url":3817},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb6ee66e8b2c2c0932bdf65f963268d9f2927ef86",{"type":1291,"url":1292},{"type":1286,"url":1294},[1301,1302,1303,1304,1305],{"id":199,"slug":3822,"dossier":47,"summary":3823,"aliases":3824,"sourceIds":3827,"published":3828,"modified":3829,"checkedAt":7,"severity":3830,"references":3833,"versionKeys":3850,"packageCount":32,"repositoryCount":500},"ghsa-cpwx-vrp4-4pq7-799bdc98","Jinja2 vulnerable to sandbox breakout through attr filter selecting format method",[3825,3826],"CVE-2025-27516","PYSEC-2026-1471",[199,3826],"2025-03-05T20:40:14Z","2026-09-10T03:49:48.526758681Z",[3831],{"type":1279,"score":3832},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:P\u002FPR:L\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3834,3836,3838,3840,3842,3844,3846,3848],{"type":1283,"url":3835},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",{"type":1286,"url":3837},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-27516",{"type":1326,"url":3839},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F90457bbf33b8662926ae65cdde4c4c32e756e403",{"type":1291,"url":3841},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja",{"type":1283,"url":3843},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00022.html",{"type":1283,"url":3845},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F04\u002Fmsg00045.html",{"type":1291,"url":3847},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fjinja2",{"type":1286,"url":3849},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cpwx-vrp4-4pq7",[3851,3852],"pypi:jinja2@3.1.3","pypi:jinja2@3.1.5",{"id":200,"slug":3854,"dossier":47,"summary":3855,"aliases":3856,"sourceIds":3859,"published":3860,"modified":3861,"checkedAt":7,"severity":3862,"references":3864,"versionKeys":3879,"packageCount":32,"repositoryCount":42},"ghsa-cq5v-8q36-5273-b5e8d025","AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)",[3857,3858],"CVE-2026-69244","PYSEC-2026-3545",[200,3858],"2026-08-03T20:51:13Z","2026-09-10T03:51:13.983479281Z",[3863],{"type":1279,"score":1831},[3865,3867,3869,3871,3872,3874,3875,3877],{"type":1283,"url":3866},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-cq5v-8q36-5273",{"type":1283,"url":3868},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F13223",{"type":1283,"url":3870},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F49f65d54150397892f7bcc4aae887767d51c322d",{"type":1291,"url":1545},{"type":1283,"url":3873},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.3",{"type":1291,"url":2252},{"type":1286,"url":3876},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cq5v-8q36-5273",{"type":1286,"url":3878},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69244",[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598],{"id":201,"slug":3881,"dossier":47,"summary":3882,"aliases":3883,"sourceIds":3885,"published":3886,"modified":3887,"checkedAt":7,"severity":3888,"references":3890,"versionKeys":3899,"packageCount":32,"repositoryCount":2312},"ghsa-cwqr-hh33-gh44-4ee53d3a","filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout",[3884],"CVE-2026-112915",[201],"2026-10-28T21:08:49Z","2026-10-28T21:15:04.923553251Z",[3889],{"type":1318,"score":1700},[3891,3893,3895,3896,3897,3898],{"type":1283,"url":3892},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-cwqr-hh33-gh44",{"type":1286,"url":3894},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112915",{"type":1283,"url":3588},{"type":1283,"url":3590},{"type":1291,"url":2304},{"type":1283,"url":2306},[2308,2309,2310,2311],{"id":202,"slug":3901,"dossier":47,"summary":3902,"aliases":3903,"sourceIds":3907,"published":3908,"modified":3909,"checkedAt":7,"severity":3910,"references":3914,"versionKeys":3930,"packageCount":32,"repositoryCount":32},"ghsa-cx63-2mw6-8hw5-1754ad59","setuptools vulnerable to Command Injection via package URL",[3904,3905,3906],"BIT-setuptools-2024-6345","CVE-2024-6345","PYSEC-2026-1918",[202,3906],"2024-07-15T03:30:57Z","2026-09-10T03:50:16.663495061Z",[3911,3912],{"type":1318,"score":1424},{"type":1279,"score":3913},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:A\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[3915,3917,3919,3921,3922,3924,3926,3928],{"type":1286,"url":3916},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-6345",{"type":1283,"url":3918},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F4332",{"type":1283,"url":3920},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F88807c7062788254f654ea8c03427adc859321f0",{"type":1291,"url":2451},{"type":1283,"url":3923},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fd6362117-ad57-4e83-951f-b8141c6e7ca5",{"type":1283,"url":3925},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F09\u002Fmsg00018.html",{"type":1291,"url":3927},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fsetuptools",{"type":1286,"url":3929},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-cx63-2mw6-8hw5",[2457],{"id":203,"slug":3932,"dossier":47,"summary":3933,"aliases":3934,"sourceIds":3937,"published":3938,"modified":3939,"checkedAt":7,"severity":3940,"references":3942,"versionKeys":3951,"packageCount":32,"repositoryCount":1306},"ghsa-f2g6-542v-9j58-1b810101","Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle",[3935,3936],"BIT-pillow-2026-112406","CVE-2026-112406",[203],"2026-10-21T21:21:07Z","2026-10-26T08:56:13.538142549Z",[3941],{"type":1279,"score":1568},[3943,3945,3947,3949,3950],{"type":1283,"url":3944},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-f2g6-542v-9j58",{"type":1286,"url":3946},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112406",{"type":1283,"url":3948},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fb3ebf20c694f2f12537a629c30229a1d5a53f777",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":204,"slug":3953,"dossier":47,"summary":3954,"aliases":3955,"sourceIds":3959,"published":3960,"modified":3961,"checkedAt":7,"severity":3962,"references":3966,"versionKeys":3984,"packageCount":32,"repositoryCount":500},"ghsa-f4hp-rmr7-r7v8-fe038cb7","PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function",[3956,3957,3958],"BIT-pytorch-2025-2998","CVE-2025-2998","PYSEC-2025-192",[204],"2025-03-31T15:30:48Z","2026-06-09T22:11:09.050788278Z",[3963,3964],{"type":1318,"score":3380},{"type":1279,"score":3965},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[3967,3969,3971,3973,3975,3977,3978,3980,3982],{"type":1286,"url":3968},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2998",{"type":1283,"url":3970},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622",{"type":1283,"url":3972},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149622#issue-2935495265",{"type":1283,"url":3974},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F494518046816d29099b7d056a74ffa5c244fdcdd",{"type":1283,"url":3976},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-192.yaml",{"type":1291,"url":1712},{"type":1283,"url":3979},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302047",{"type":1283,"url":3981},"https:\u002F\u002Fvuldb.com\u002F?id.302047",{"type":1283,"url":3983},"https:\u002F\u002Fvuldb.com\u002F?submit.524151",[1724,1725],{"id":205,"slug":3986,"dossier":47,"summary":3987,"aliases":3988,"sourceIds":3991,"published":3992,"modified":3993,"checkedAt":7,"severity":3994,"references":3998,"versionKeys":4009,"packageCount":32,"repositoryCount":32},"ghsa-f96h-pmfr-66vw-6763f20e","Starlette Denial of service (DoS) via multipart\u002Fform-data",[3989,3990],"CVE-2024-47874","PYSEC-2026-1943",[205,3990],"2024-10-15T18:12:57Z","2026-09-10T03:50:19.756287586Z",[3995,3997],{"type":1318,"score":3996},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:N",{"type":1279,"score":1568},[3999,4001,4003,4005,4006,4007],{"type":1283,"url":4000},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-f96h-pmfr-66vw",{"type":1286,"url":4002},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-47874",{"type":1326,"url":4004},"https:\u002F\u002Fgithub.com\u002Fencode\u002Fstarlette\u002Fcommit\u002Ffd038f3070c302bff17ef7d173dbb0b007617733",{"type":1291,"url":1511},{"type":1291,"url":1517},{"type":1286,"url":4008},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-f96h-pmfr-66vw",[1521],{"id":206,"slug":4011,"dossier":47,"summary":4012,"aliases":4013,"sourceIds":4015,"published":4016,"modified":4017,"checkedAt":7,"severity":4018,"references":4021,"versionKeys":4030,"packageCount":32,"repositoryCount":1600},"ghsa-f9xw-jh8m-3mwq-43205cf6","AIOHTTP: Absolute-form request targets can spoof Request.scheme",[4014],"CVE-2026-111748",[206],"2026-10-20T20:01:40Z","2026-10-20T20:15:05.218624757Z",[4019],{"type":1279,"score":4020},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4022,4024,4026,4028,4029],{"type":1283,"url":4023},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-f9xw-jh8m-3mwq",{"type":1286,"url":4025},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111748",{"type":1283,"url":4027},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6d4e7b01f9b951aa084a75d7356e907d4ee80411",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":207,"slug":4032,"dossier":47,"summary":4033,"aliases":4034,"sourceIds":4037,"published":4038,"modified":4039,"checkedAt":7,"severity":4040,"references":4042,"versionKeys":4050,"packageCount":32,"repositoryCount":1306},"ghsa-fc9g-5qg7-mf45-6ce92387","Pillow: Quadratic GIF comment copying during save",[4035,4036],"BIT-pillow-2026-112891","CVE-2026-112891",[207],"2026-10-21T20:38:43Z","2026-10-26T08:56:06.483214483Z",[4041],{"type":1279,"score":2764},[4043,4045,4047,4048,4049],{"type":1283,"url":4044},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fc9g-5qg7-mf45",{"type":1286,"url":4046},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112891",{"type":1283,"url":3067},{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":208,"slug":4052,"dossier":47,"summary":4053,"aliases":4054,"sourceIds":4057,"published":4058,"modified":4059,"checkedAt":7,"severity":4060,"references":4065,"versionKeys":4089,"packageCount":32,"repositoryCount":66},"ghsa-fgcw-684q-jj6r-9fe55ba1","huggingface\u002Ftransformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path",[4055,4056],"CVE-2026-5241","PYSEC-2026-2290",[208,4056],"2026-06-03T14:16:46.337Z","2026-09-10T03:50:49.345942449Z",[4061,4063],{"type":1318,"score":4062},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N",{"type":1318,"score":4064},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:H",[4066,4068,4070,4072,4074,4076,4078,4080,4081,4083,4085,4087],{"type":1286,"url":4067},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-5241",{"type":1326,"url":4069},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F676559d5022b74aaa0cee1cee0842b7f27c5320e",{"type":1286,"url":4071},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:34456",{"type":1286,"url":4073},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:37275",{"type":1283,"url":4075},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:42644",{"type":1283,"url":4077},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-5241",{"type":1705,"url":4079},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484384",{"type":1291,"url":1475},{"type":1283,"url":4082},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2026-2290.yaml",{"type":1477,"url":4084},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fceb3ce1a-4c45-497a-b25e-cb9a7685e619",{"type":1283,"url":4086},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-5241.json",{"type":1286,"url":4088},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fgcw-684q-jj6r",[1482,1483,1484,1485,1486,1487,1488,1489,1490],{"id":209,"slug":4091,"dossier":47,"summary":4092,"aliases":4093,"sourceIds":4096,"published":4097,"modified":4098,"checkedAt":7,"severity":4099,"references":4102,"versionKeys":4113,"packageCount":32,"repositoryCount":452},"ghsa-fh55-r93g-j68g-a231bc8e","AIOHTTP Vulnerable to Cookie Parser Warning Storm",[4094,4095],"CVE-2025-69230","PYSEC-2026-1105",[209,4095],"2026-01-05T23:13:46Z","2026-09-10T03:50:33.047685052Z",[4100],{"type":1279,"score":4101},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",[4103,4105,4107,4109,4110,4111],{"type":1283,"url":4104},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-fh55-r93g-j68g",{"type":1286,"url":4106},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69230",{"type":1326,"url":4108},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F64629a0834f94e46d9881f4e99c41a137e1f3326",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":4112},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fh55-r93g-j68g",[1549,1550,1551,1552,1553,1554,1555],{"id":210,"slug":4115,"dossier":47,"summary":4116,"aliases":4117,"sourceIds":4121,"published":4122,"modified":4123,"checkedAt":7,"severity":4124,"references":4127,"versionKeys":4141,"packageCount":32,"repositoryCount":105},"ghsa-fj7v-r99m-22gq-e36cfebd","Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images",[4118,4119,4120],"BIT-pillow-2026-59198","CVE-2026-59198","PYSEC-2026-3494",[210,4120],"2026-07-20T23:09:36Z","2026-09-10T03:50:51.891240357Z",[4125],{"type":1318,"score":4126},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:L",[4128,4130,4132,4134,4136,4137,4138,4139],{"type":1283,"url":4129},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",{"type":1286,"url":4131},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59198",{"type":1283,"url":4133},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9709",{"type":1283,"url":4135},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Feada3cbd7fb9963ee90673fb7b5270124a0d5f4b",{"type":1291,"url":1292},{"type":1283,"url":2624},{"type":1291,"url":2626},{"type":1286,"url":4140},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fj7v-r99m-22gq",[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":211,"slug":4143,"dossier":47,"summary":3029,"aliases":4144,"sourceIds":4147,"published":4148,"modified":4149,"checkedAt":7,"severity":4150,"references":4153,"versionKeys":4164,"packageCount":32,"repositoryCount":32},"ghsa-fpwr-67px-3qhx-94f30126",[4145,4146],"CVE-2025-1194","PYSEC-2026-1984",[211,4146],"2025-04-29T12:30:21Z","2026-08-13T20:11:58.399313771Z",[4151],{"type":1318,"score":4152},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[4154,4156,4158,4159,4161,4162],{"type":1286,"url":4155},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-1194",{"type":1283,"url":4157},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F92c5ca9dd70de3ade2af2eb835c96215cc50e815",{"type":1291,"url":1475},{"type":1283,"url":4160},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F86f58dcd-683f-4adc-a735-849f51e9abb2",{"type":1291,"url":1789},{"type":1286,"url":4163},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-fpwr-67px-3qhx",[1482],{"id":212,"slug":4166,"dossier":47,"summary":4167,"aliases":4168,"sourceIds":4170,"published":4171,"modified":4172,"checkedAt":7,"severity":4173,"references":4176,"versionKeys":4187,"packageCount":32,"repositoryCount":2312},"ghsa-fq56-3cx3-fjxp-d2885806","filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders",[4169],"CVE-2026-112935",[212],"2026-10-28T21:08:08Z","2026-10-28T21:15:04.933315565Z",[4174],{"type":1318,"score":4175},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4177,4179,4181,4183,4185,4186],{"type":1283,"url":4178},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-fq56-3cx3-fjxp",{"type":1286,"url":4180},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112935",{"type":1283,"url":4182},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F843",{"type":1283,"url":4184},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F740ff666b62a88496c8d7394e4e6230605e4d62b",{"type":1291,"url":2304},{"type":1283,"url":2306},[2308,2309,2310,2311],{"id":213,"slug":4189,"dossier":47,"summary":4190,"aliases":4191,"sourceIds":4194,"published":4195,"modified":4196,"checkedAt":7,"severity":4197,"references":4200,"versionKeys":4206,"packageCount":32,"repositoryCount":66},"ghsa-g3cq-j2xw-wf74-4475e17b","aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup",[4192,4193],"CVE-2026-54278","PYSEC-2026-2111",[213,4193],"2026-06-15T20:09:51Z","2026-09-10T03:51:08.751749295Z",[4198,4199],{"type":1279,"score":2000},{"type":1318,"score":1402},[4201,4203,4204],{"type":1286,"url":4202},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-g3cq-j2xw-wf74",{"type":1291,"url":1545},{"type":1326,"url":4205},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F4f7480e474cccc6a8cc2c92ad3f17a31dedf8232",[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":214,"slug":4208,"dossier":47,"summary":4209,"aliases":4210,"sourceIds":4214,"published":4215,"modified":4216,"checkedAt":7,"severity":4217,"references":4220,"versionKeys":4231,"packageCount":32,"repositoryCount":1661},"ghsa-g4qv-2jxx-769h-01f137f2","Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time",[4211,4212,4213],"BIT-pillow-2026-96643","CVE-2026-96643","PYSEC-2026-4342",[214,4213],"2026-10-21T21:20:32.797Z","2026-10-29T10:55:44.091799759Z",[4218,4219],{"type":1279,"score":1831},{"type":1318,"score":1354},[4221,4223,4225,4227,4229,4230],{"type":1286,"url":4222},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g4qv-2jxx-769h",{"type":1286,"url":4224},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96643",{"type":1705,"url":4226},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10073",{"type":1326,"url":4228},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F806e38381c781f32bbd22f4cd026678acd40fd6c",{"type":1291,"url":1292},{"type":1286,"url":1294},[1298,1299,1300,1301,1302,1303,1304,1305],{"id":215,"slug":4233,"dossier":47,"summary":4234,"aliases":4235,"sourceIds":4238,"published":4239,"modified":4240,"checkedAt":7,"severity":4241,"references":4244,"versionKeys":4255,"packageCount":32,"repositoryCount":1306},"ghsa-g7cr-3p24-7wf7-568f0c0a","Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer",[4236,4237],"BIT-pillow-2026-96778","CVE-2026-96778",[215],"2026-10-22T16:05:39Z","2026-10-29T10:56:05.933422167Z",[4242],{"type":1279,"score":4243},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[4245,4247,4249,4251,4253,4254],{"type":1283,"url":4246},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g7cr-3p24-7wf7",{"type":1286,"url":4248},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96778",{"type":1283,"url":4250},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10124",{"type":1283,"url":4252},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F02561b8dc6117d5670d4b469fecdd02c70854f9b",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":216,"slug":4257,"dossier":47,"summary":4258,"aliases":4259,"sourceIds":4262,"published":4263,"modified":4264,"checkedAt":7,"severity":4265,"references":4268,"versionKeys":4287,"packageCount":32,"repositoryCount":32},"ghsa-g7vv-2v7x-gj9p-5ef970c3","tqdm CLI arguments injection attack",[4260,4261],"CVE-2024-34062","PYSEC-2026-1976",[216,4261],"2024-05-03T19:33:28Z","2026-09-10T03:50:13.776534451Z",[4266],{"type":1318,"score":4267},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4269,4271,4273,4275,4277,4279,4281,4283,4285],{"type":1283,"url":4270},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fsecurity\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",{"type":1286,"url":4272},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34062",{"type":1283,"url":4274},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm\u002Fcommit\u002F4e613f84ed2ae029559f539464df83fa91feb316",{"type":1291,"url":4276},"https:\u002F\u002Fgithub.com\u002Ftqdm\u002Ftqdm",{"type":1283,"url":4278},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FPA3GIGHPWAHCTT4UF57LTPZGWHAX3GW6",{"type":1283,"url":4280},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FQRECVQCCESHBS3UJOWNXQUIX725TKNY6",{"type":1283,"url":4282},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FVA337CYUS4SLRFV2P6MX6MZ2LKFURKJC",{"type":1291,"url":4284},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ftqdm",{"type":1286,"url":4286},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g7vv-2v7x-gj9p",[4288],"pypi:tqdm@4.66.2",{"id":217,"slug":4290,"dossier":47,"summary":4291,"aliases":4292,"sourceIds":4296,"published":4297,"modified":4298,"checkedAt":7,"severity":4299,"references":4302,"versionKeys":4313,"packageCount":32,"repositoryCount":1306},"ghsa-g842-9rc4-69pw-38a3cbdb","Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS",[4293,4294,4295],"BIT-pillow-2026-96637","CVE-2026-96637","PYSEC-2026-4338",[217,4295],"2026-10-21T21:20:31.927Z","2026-10-29T10:55:56.102454725Z",[4300,4301],{"type":1279,"score":1831},{"type":1318,"score":1354},[4303,4305,4307,4309,4311,4312],{"type":1286,"url":4304},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-g842-9rc4-69pw",{"type":1286,"url":4306},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96637",{"type":1705,"url":4308},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10076",{"type":1326,"url":4310},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F7cb0e02389d8aac2a60896a490f572db0b07b841",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":218,"slug":4315,"dossier":47,"summary":4316,"aliases":4317,"sourceIds":4320,"published":4321,"modified":4322,"checkedAt":7,"severity":4323,"references":4325,"versionKeys":4338,"packageCount":32,"repositoryCount":452},"ghsa-g84x-mcqj-x9qq-fc677e5d","AIOHTTP vulnerable to DoS through chunked messages",[4318,4319],"CVE-2025-69229","PYSEC-2026-1106",[218,4319],"2026-01-05T23:13:29Z","2026-09-10T03:50:33.073865205Z",[4324],{"type":1279,"score":2000},[4326,4328,4330,4332,4334,4335,4336],{"type":1283,"url":4327},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-g84x-mcqj-x9qq",{"type":1286,"url":4329},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69229",{"type":1283,"url":4331},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F4ed97a4e46eaf61bd0f05063245f613469700229",{"type":1283,"url":4333},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdc3170b56904bdf814228fae70a5501a42a6c712",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":4337},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-g84x-mcqj-x9qq",[1549,1550,1551,1552,1553,1554,1555],{"id":219,"slug":4340,"dossier":47,"summary":4341,"aliases":4342,"sourceIds":4345,"published":4346,"modified":4347,"checkedAt":7,"severity":4348,"references":4353,"versionKeys":4363,"packageCount":32,"repositoryCount":1306},"ghsa-gc5v-m9x4-r6x2-b9828ad8","Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function",[4343,4344],"CVE-2026-25645","PYSEC-2026-2275",[219,4344],"2026-03-25T16:56:28Z","2026-09-10T03:50:39.207922076Z",[4349,4351],{"type":1318,"score":4350},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"type":1318,"score":4352},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",[4354,4356,4358,4360,4361],{"type":1286,"url":4355},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fsecurity\u002Fadvisories\u002FGHSA-gc5v-m9x4-r6x2",{"type":1286,"url":4357},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25645",{"type":1326,"url":4359},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Fcommit\u002F66d21cb07bd6255b1280291c4fafb71803cdb3b7",{"type":1291,"url":3507},{"type":1286,"url":4362},"https:\u002F\u002Fgithub.com\u002Fpsf\u002Frequests\u002Freleases\u002Ftag\u002Fv2.33.0",[3519,3520,4364,4365],"pypi:requests@2.32.4","pypi:requests@2.32.5",{"id":220,"slug":4367,"dossier":47,"summary":4368,"aliases":4369,"sourceIds":4372,"published":4373,"modified":4374,"checkedAt":7,"severity":4375,"references":4377,"versionKeys":4386,"packageCount":32,"repositoryCount":1306},"ghsa-gg2r-wvfm-q9rx-9e34ef8d","Pillow: MSP RLE decoder expands a tiny file into unbounded memory",[4370,4371],"BIT-pillow-2026-112892","CVE-2026-112892",[220],"2026-10-21T21:12:56Z","2026-10-26T08:55:54.537605973Z",[4376],{"type":1279,"score":1568},[4378,4380,4382,4384,4385],{"type":1283,"url":4379},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-gg2r-wvfm-q9rx",{"type":1286,"url":4381},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112892",{"type":1283,"url":4383},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F5dcb630b9798efd91929cb873d677aeee6ed0bb3",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":221,"slug":4388,"dossier":47,"summary":4389,"aliases":4390,"sourceIds":4393,"published":4394,"modified":4395,"checkedAt":7,"severity":4396,"references":4398,"versionKeys":4410,"packageCount":32,"repositoryCount":34},"ghsa-gh4c-6fx4-qh6g-a56f6cb1","urllib3: Chunked Deflate streaming can enter an infinite loop",[4391,4392],"CVE-2026-97688","PYSEC-2026-4176",[221,4392],"2026-09-30T15:00:38Z","2026-10-01T17:55:40.608255720Z",[4397],{"type":1279,"score":2764},[4399,4401,4403,4405,4406,4407,4408],{"type":1283,"url":4400},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",{"type":1286,"url":4402},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97688",{"type":1283,"url":4404},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fea2ad7b21a80da3632f80016526a18864586077f",{"type":1291,"url":1652},{"type":1283,"url":3341},{"type":1291,"url":1654},{"type":1286,"url":4409},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gh4c-6fx4-qh6g",[3346,3347],{"id":222,"slug":4412,"dossier":47,"summary":4413,"aliases":4414,"sourceIds":4417,"published":4418,"modified":4419,"checkedAt":7,"severity":4420,"references":4422,"versionKeys":4433,"packageCount":32,"repositoryCount":1661},"ghsa-gm62-xv2j-4w53-5befa184","urllib3 allows an unbounded number of links in the decompression chain",[4415,4416],"CVE-2025-66418","PYSEC-2026-1998",[222,4416],"2025-12-05T18:15:19Z","2026-09-10T03:50:58.741847479Z",[4421],{"type":1279,"score":1637},[4423,4425,4427,4429,4430,4431],{"type":1283,"url":4424},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",{"type":1286,"url":4426},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-66418",{"type":1326,"url":4428},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002F24d7b67eac89f94e11003424bcf0d8f7b72222a8",{"type":1291,"url":1652},{"type":1291,"url":1654},{"type":1286,"url":4432},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gm62-xv2j-4w53",[1656,1657,1658,1659,1660],{"id":223,"slug":4435,"dossier":47,"summary":4436,"aliases":4437,"sourceIds":4440,"published":4441,"modified":4442,"checkedAt":7,"severity":4443,"references":4446,"versionKeys":4461,"packageCount":32,"repositoryCount":32},"ghsa-gmj6-6f8f-6699-e3e02f35","Jinja has a sandbox breakout through malicious filenames",[4438,4439],"CVE-2024-56201","PYSEC-2026-1472",[223,4439],"2024-12-23T17:54:12Z","2026-09-10T03:50:56.152882717Z",[4444,4445],{"type":1318,"score":2438},{"type":1279,"score":3832},[4447,4449,4451,4453,4455,4456,4458,4459],{"type":1283,"url":4448},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",{"type":1286,"url":4450},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56201",{"type":1283,"url":4452},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fissues\u002F1792",{"type":1326,"url":4454},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F767b23617628419ae3709ccfb02f9602ae9fe51f",{"type":1291,"url":3841},{"type":1283,"url":4457},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Freleases\u002Ftag\u002F3.1.5",{"type":1291,"url":3847},{"type":1286,"url":4460},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-gmj6-6f8f-6699",[3851],{"id":224,"slug":4463,"dossier":47,"summary":4464,"aliases":4465,"sourceIds":4467,"published":4468,"modified":4469,"checkedAt":7,"severity":4470,"references":4473,"versionKeys":4482,"packageCount":32,"repositoryCount":1600},"ghsa-gx76-c99x-2c96-30159937","AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies",[4466],"CVE-2026-111749",[224],"2026-10-20T19:58:14Z","2026-10-20T20:15:05.188135798Z",[4471],{"type":1279,"score":4472},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[4474,4476,4478,4480,4481],{"type":1283,"url":4475},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-gx76-c99x-2c96",{"type":1286,"url":4477},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111749",{"type":1283,"url":4479},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6a07c171ef9f3be583e2907dcd1931372efca8d6",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":225,"slug":4484,"dossier":47,"summary":4485,"aliases":4486,"sourceIds":4490,"published":4491,"modified":4492,"checkedAt":7,"severity":4493,"references":4496,"versionKeys":4508,"packageCount":32,"repositoryCount":1306},"ghsa-h35f-9h28-mq5c-f3238ba1","setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC\u002FNFD) on macOS APFS\u002FHFS+",[4487,4488,4489],"BIT-setuptools-2026-59890","CVE-2026-59890","PYSEC-2026-3447",[225,4489],"2026-07-08T17:17:27.020Z","2026-09-10T03:50:52.323347787Z",[4494],{"type":1318,"score":4495},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:L\u002FA:N",[4497,4499,4501,4503,4505,4506],{"type":1477,"url":4498},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-h35f-9h28-mq5c",{"type":1286,"url":4500},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59890",{"type":1326,"url":4502},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002Fdd9f436a36486b4cb8a4c70a2321548b0be09b8f",{"type":1283,"url":4504},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fsetuptools\u002FPYSEC-2026-3447.yaml",{"type":1291,"url":2451},{"type":1286,"url":4507},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv83.0.0",[2457,2458,2459,2460,4509,4510,4511,4512,4513,4514,4515,4516],"pypi:setuptools@79.0.1","pypi:setuptools@80.0.1","pypi:setuptools@80.3.1","pypi:setuptools@80.4.0","pypi:setuptools@80.8.0","pypi:setuptools@80.9.0","pypi:setuptools@81.0.0","pypi:setuptools@82.0.1",{"id":226,"slug":4518,"dossier":47,"summary":4519,"aliases":4520,"sourceIds":4523,"published":4524,"modified":4525,"checkedAt":7,"severity":4526,"references":4529,"versionKeys":4550,"packageCount":32,"repositoryCount":32},"ghsa-h75v-3vvj-5mfj-d8fc6bb7","Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter",[4521,4522],"CVE-2024-34064","PYSEC-2026-1474",[226,4522],"2024-05-06T14:20:59Z","2026-09-10T03:50:13.786450101Z",[4527],{"type":1318,"score":4528},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:L\u002FI:L\u002FA:N",[4530,4532,4534,4536,4537,4539,4541,4543,4545,4547,4548],{"type":1283,"url":4531},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",{"type":1286,"url":4533},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-34064",{"type":1326,"url":4535},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F0668239dc6b44ef38e7a6c9f91f312fd4ca581cb",{"type":1291,"url":3841},{"type":1283,"url":4538},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2024\u002F12\u002Fmsg00009.html",{"type":1283,"url":4540},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002F567XIGSZMABG6TSMYWD7MIYNJSUQQRUC",{"type":1283,"url":4542},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FGCLF44KY43BSVMTE6S53B4V5WP3FRRSE",{"type":1283,"url":4544},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FSSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS",{"type":1283,"url":4546},"https:\u002F\u002Flists.fedoraproject.org\u002Farchives\u002Flist\u002Fpackage-announce@lists.fedoraproject.org\u002Fmessage\u002FZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS",{"type":1291,"url":3847},{"type":1286,"url":4549},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-h75v-3vvj-5mfj",[3851],{"id":227,"slug":4552,"dossier":47,"summary":4553,"aliases":4554,"sourceIds":4557,"published":4558,"modified":4559,"checkedAt":7,"severity":4560,"references":4563,"versionKeys":4572,"packageCount":32,"repositoryCount":442},"ghsa-hcc4-c3v8-rx92-ddf32b5c","AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector",[4555,4556],"CVE-2026-34513","PYSEC-2026-2095",[227,4556],"2026-04-01T21:16:59.267Z","2026-09-10T03:51:02.067006429Z",[4561,4562],{"type":1279,"score":1856},{"type":1318,"score":1402},[4564,4566,4568,4570,4571],{"type":1326,"url":4565},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hcc4-c3v8-rx92",{"type":1286,"url":4567},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34513",{"type":1326,"url":4569},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc4d77c3533122be353b8afca8e8675e3b4cbda98",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":228,"slug":4574,"dossier":47,"summary":4575,"aliases":4576,"sourceIds":4579,"published":4580,"modified":4581,"checkedAt":7,"severity":4582,"references":4587,"versionKeys":4595,"packageCount":32,"repositoryCount":66},"ghsa-hg6j-4rv6-33pg-d0ac8db0","AIOHTTP is vulnerable to cross-origin redirect with per-request cookies",[4577,4578],"CVE-2026-47265","PYSEC-2026-2105",[228,4578],"2026-06-02T20:16:37.903Z","2026-09-10T03:50:49.888335735Z",[4583,4585],{"type":1279,"score":4584},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U",{"type":1318,"score":4586},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4588,4590,4592,4594],{"type":1326,"url":4589},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hg6j-4rv6-33pg",{"type":1286,"url":4591},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-47265",{"type":1326,"url":4593},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Ff54c40851b0d6c4bbdab97ba518a223adda32478",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":229,"slug":4597,"dossier":47,"summary":4598,"aliases":4599,"sourceIds":4602,"published":4603,"modified":4604,"checkedAt":7,"severity":4605,"references":4609,"versionKeys":4615,"packageCount":32,"repositoryCount":66},"ghsa-hpj7-wq8m-9hgp-fac25647","aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges",[4600,4601],"CVE-2026-54276","PYSEC-2026-2109",[229,4601],"2026-06-15T20:09:06Z","2026-09-10T03:50:49.899674354Z",[4606,4607],{"type":1279,"score":1978},{"type":1318,"score":4608},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N",[4610,4612,4614],{"type":1286,"url":4611},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-hpj7-wq8m-9hgp",{"type":1326,"url":4613},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F38d16060037e1bfcd6d677abababa3c2a4bb58fa",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":230,"slug":4617,"dossier":47,"summary":4618,"aliases":4619,"sourceIds":4622,"published":4623,"modified":4624,"checkedAt":7,"severity":4625,"references":4629,"versionKeys":4646,"packageCount":32,"repositoryCount":471},"ghsa-hx9q-6w63-j58v-8d6e2248","orjson does not limit recursion for deeply nested JSON documents",[4620,4621],"CVE-2025-67221","PYSEC-2026-107",[230,4621],"2026-01-22T17:16:01.433Z","2026-09-10T03:50:33.258377926Z",[4626,4628],{"type":1279,"score":4627},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",{"type":1318,"score":1402},[4630,4632,4634,4636,4638,4640,4642,4644],{"type":1286,"url":4631},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-67221",{"type":1283,"url":4633},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson\u002Fissues\u002F620",{"type":1283,"url":4635},"https:\u002F\u002Fgithub.com\u002Fkpatsakis\u002FCVE-2025-67221\u002Fissues\u002F1",{"type":1283,"url":4637},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson\u002Fcommit\u002F62bb185b70785ded49c79c26f8c9781f1e6fe370",{"type":1291,"url":4639},"https:\u002F\u002Fgithub.com\u002Fijl\u002Forjson",{"type":1477,"url":4641},"https:\u002F\u002Fgithub.com\u002Fkpatsakis\u002Forjson_vulnerability",{"type":1283,"url":4643},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Forjson\u002FPYSEC-2026-107.yaml",{"type":1286,"url":4645},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hx9q-6w63-j58v",[4647,4648,4649,4650],"pypi:orjson@3.10.14","pypi:orjson@3.10.15","pypi:orjson@3.11.4","pypi:orjson@3.11.5",{"id":231,"slug":4652,"dossier":47,"summary":4653,"aliases":4654,"sourceIds":4657,"published":4658,"modified":4659,"checkedAt":7,"severity":4660,"references":4664,"versionKeys":4680,"packageCount":32,"repositoryCount":32},"ghsa-hxxf-235m-72v3-21da19b0","Deserialization of Untrusted Data in Hugging Face Transformers",[4655,4656],"CVE-2024-11394","PYSEC-2024-229",[231,4656],"2024-11-22T22:15:07Z","2026-09-10T03:50:20.811665084Z",[4661,4663],{"type":1318,"score":4662},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1318,"score":1424},[4665,4667,4669,4671,4672,4674,4676,4678],{"type":1286,"url":4666},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11394",{"type":1283,"url":4668},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fissues\u002F34840",{"type":1283,"url":4670},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F35296",{"type":1291,"url":1475},{"type":1283,"url":4673},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-229.yaml",{"type":1283,"url":4675},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515",{"type":1286,"url":4677},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1515\u002F",{"type":1286,"url":4679},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-hxxf-235m-72v3",[1482],{"id":232,"slug":4682,"dossier":47,"summary":4683,"aliases":4684,"sourceIds":4687,"published":4688,"modified":4689,"checkedAt":7,"severity":4690,"references":4692,"versionKeys":4701,"packageCount":32,"repositoryCount":1306},"ghsa-j4m9-6w36-pw47-8a42e0dd","Pillow: Invalid free in FreeType glyph rendering when a stroker is active",[4685,4686],"BIT-pillow-2026-112893","CVE-2026-112893",[232],"2026-10-21T20:06:34Z","2026-10-26T08:55:43.891551666Z",[4691],{"type":1279,"score":1280},[4693,4695,4697,4699,4700],{"type":1283,"url":4694},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-j4m9-6w36-pw47",{"type":1286,"url":4696},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112893",{"type":1283,"url":4698},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa7416de7f3a43128179d2cf68df3240ea8dafe13",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":233,"slug":4703,"dossier":47,"summary":4704,"aliases":4705,"sourceIds":4707,"published":4708,"modified":4709,"checkedAt":7,"severity":4710,"references":4713,"versionKeys":4723,"packageCount":32,"repositoryCount":2312},"ghsa-j8f7-rjxc-mr56-f1c144ea","filelock: ReadWriteLock follows a symlink at the lock path into SQLite",[4706],"CVE-2026-112936",[233],"2026-10-28T21:08:30Z","2026-10-28T21:15:04.169983430Z",[4711],{"type":1318,"score":4712},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[4714,4716,4718,4720,4721],{"type":1283,"url":4715},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-j8f7-rjxc-mr56",{"type":1286,"url":4717},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112936",{"type":1283,"url":4719},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4d45e83caf7e31f9a12fb44526bdc07f70114f04",{"type":1291,"url":2304},{"type":1283,"url":4722},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F4.0.9",[2308,2309,2310,2311],{"id":234,"slug":4725,"dossier":47,"summary":4726,"aliases":4727,"sourceIds":4730,"published":4731,"modified":4732,"checkedAt":7,"severity":4733,"references":4738,"versionKeys":4755,"packageCount":32,"repositoryCount":66},"ghsa-jg22-mg44-37j8-b8064c77","AIOHTTP is Vulnerable to Deserialization of Untrusted Data",[4728,4729],"CVE-2026-34993","PYSEC-2026-2104",[234,4729],"2026-06-02T20:16:34.857Z","2026-09-10T03:51:08.847676311Z",[4734,4736],{"type":1318,"score":4735},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:H\u002FUI:R\u002FS:C\u002FC:L\u002FI:H\u002FA:L",{"type":1318,"score":4737},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",[4739,4741,4743,4745,4746,4748,4750,4751,4752,4753],{"type":1326,"url":4740},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-jg22-mg44-37j8",{"type":1286,"url":4742},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34993",{"type":1326,"url":4744},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fdcf40f30637e8752c76781cf6703b5a236749a00",{"type":1291,"url":1545},{"type":1283,"url":4747},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34993",{"type":1283,"url":4749},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34993.json",{"type":1286,"url":2651},{"type":1286,"url":4071},{"type":1286,"url":4073},{"type":1705,"url":4754},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2484099",[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":235,"slug":4757,"dossier":47,"summary":4758,"aliases":4759,"sourceIds":4762,"published":4763,"modified":4764,"checkedAt":7,"severity":4765,"references":4767,"versionKeys":4776,"packageCount":32,"repositoryCount":1306},"ghsa-jg86-v3jv-hrpm-1380c45f","Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)",[4760,4761],"BIT-pillow-2026-112894","CVE-2026-112894",[235],"2026-10-21T21:11:44Z","2026-10-26T08:56:08.669907131Z",[4766],{"type":1279,"score":1568},[4768,4770,4772,4774,4775],{"type":1283,"url":4769},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jg86-v3jv-hrpm",{"type":1286,"url":4771},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112894",{"type":1283,"url":4773},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff6a852555f1a1bdff7781abf25f1a3b8bd6ce6cb",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":236,"slug":4778,"dossier":47,"summary":4779,"aliases":4780,"sourceIds":4783,"published":4784,"modified":4785,"checkedAt":7,"severity":4786,"references":4788,"versionKeys":4799,"packageCount":32,"repositoryCount":452},"ghsa-jj3x-wxrx-4x23-407bafac","AIOHTTP vulnerable to DoS when bypassing asserts",[4781,4782],"CVE-2025-69227","PYSEC-2026-1107",[236,4782],"2026-01-05T23:10:15Z","2026-09-10T03:50:33.308966616Z",[4787],{"type":1279,"score":2000},[4789,4791,4793,4795,4796,4797],{"type":1283,"url":4790},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-jj3x-wxrx-4x23",{"type":1286,"url":4792},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69227",{"type":1283,"url":4794},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbc1319ec3cbff9438a758951a30907b072561259",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":4798},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jj3x-wxrx-4x23",[1549,1550,1551,1552,1553,1554,1555],{"id":237,"slug":4801,"dossier":47,"summary":4802,"aliases":4803,"sourceIds":4807,"published":4808,"modified":4809,"checkedAt":7,"severity":4810,"references":4812,"versionKeys":4826,"packageCount":32,"repositoryCount":105},"ghsa-jjj6-mw9f-p565-ed2d1f46","Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()",[4804,4805,4806],"BIT-pillow-2026-59200","CVE-2026-59200","PYSEC-2026-3495",[237,4806],"2026-07-20T23:11:29Z","2026-09-10T03:50:12.341825852Z",[4811],{"type":1318,"score":1402},[4813,4815,4817,4819,4821,4822,4823,4824],{"type":1283,"url":4814},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",{"type":1286,"url":4816},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59200",{"type":1283,"url":4818},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9718",{"type":1283,"url":4820},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff7a31ea75e460e108c37126da1f47812f21f6b09",{"type":1291,"url":1292},{"type":1283,"url":2624},{"type":1291,"url":2626},{"type":1286,"url":4825},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjj6-mw9f-p565",[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":238,"slug":4828,"dossier":47,"summary":4829,"aliases":4830,"sourceIds":4833,"published":4834,"modified":4835,"checkedAt":7,"severity":4836,"references":4838,"versionKeys":4851,"packageCount":32,"repositoryCount":32},"ghsa-jjph-296x-mrcr-0f661d67","Transformers vulnerable to ReDoS attack through its get_imports() function",[4831,4832],"CVE-2025-3264","PYSEC-2026-1985",[238,4832],"2025-07-07T12:30:22Z","2026-07-07T17:56:51.899728258Z",[4837],{"type":1318,"score":2122},[4839,4841,4843,4845,4846,4848,4849],{"type":1286,"url":4840},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3264",{"type":1283,"url":4842},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F0720e206c6ba28887e4d60ef60a6a089f6c1cc76",{"type":1283,"url":4844},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F126abe3461762e5fc180e7e614391d1b4ab051ca",{"type":1291,"url":1475},{"type":1283,"url":4847},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F3c6f7822-9992-476d-8cf0-b0b1623427df",{"type":1291,"url":1789},{"type":1286,"url":4850},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jjph-296x-mrcr",[1482],{"id":239,"slug":4853,"dossier":47,"summary":4854,"aliases":4855,"sourceIds":4858,"published":4859,"modified":4860,"checkedAt":7,"severity":4861,"references":4864,"versionKeys":4872,"packageCount":32,"repositoryCount":442},"ghsa-jp82-jpqv-5vv3-4d50530e","Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname",[4856,4857],"CVE-2026-54282","PYSEC-2026-248",[239,4857],"2026-06-15T20:38:08Z","2026-09-10T03:50:50.050800090Z",[4862,4863],{"type":1318,"score":2931},{"type":1318,"score":1614},[4865,4867,4869,4870],{"type":1286,"url":4866},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-jp82-jpqv-5vv3",{"type":1286,"url":4868},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-54282",{"type":1291,"url":3149},{"type":1283,"url":4871},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fstarlette\u002FPYSEC-2026-248.yaml",[1521,1522,1523,3156,3157,3158,3225,3226,3227],{"id":240,"slug":4874,"dossier":47,"summary":4875,"aliases":4876,"sourceIds":4879,"published":4880,"modified":4881,"checkedAt":7,"severity":4882,"references":4887,"versionKeys":4900,"packageCount":32,"repositoryCount":32},"ghsa-jw8x-6495-233v-cb32b711","scikit-learn sensitive data leakage vulnerability",[4877,4878],"CVE-2024-5206","PYSEC-2024-110",[240,4878],"2024-06-06T19:16:00Z","2026-09-10T03:50:15.628224747Z",[4883,4885],{"type":1318,"score":4884},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",{"type":1318,"score":4886},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:N",[4888,4890,4892,4894,4896,4898],{"type":1286,"url":4889},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-5206",{"type":1326,"url":4891},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn\u002Fcommit\u002F70ca21f106b603b611da73012c9ade7cd8e438b8",{"type":1283,"url":4893},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fscikit-learn\u002FPYSEC-2024-110.yaml",{"type":1291,"url":4895},"https:\u002F\u002Fgithub.com\u002Fscikit-learn\u002Fscikit-learn",{"type":1283,"url":4897},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F14bc0917-a85b-4106-a170-d09d5191517c",{"type":1286,"url":4899},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-jw8x-6495-233v",[4901],"pypi:scikit-learn@1.3.2",{"id":241,"slug":4903,"dossier":47,"summary":4904,"aliases":4905,"sourceIds":4908,"published":4909,"modified":4910,"checkedAt":7,"severity":4911,"references":4916,"versionKeys":4925,"packageCount":32,"repositoryCount":442},"ghsa-m5qp-6w8w-w647-495897bd","AIOHTTP has a Multipart Header Size Bypass",[4906,4907],"CVE-2026-34516","PYSEC-2026-2098",[241,4907],"2026-04-01T21:16:59.723Z","2026-09-10T03:51:02.372876858Z",[4912,4913,4914],{"type":1318,"score":1402},{"type":1279,"score":2000},{"type":1279,"score":4915},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:U\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[4917,4919,4921,4923,4924],{"type":1326,"url":4918},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-m5qp-6w8w-w647",{"type":1286,"url":4920},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34516",{"type":1326,"url":4922},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F8a74257b3804c9aac0bf644af93070f68f6c5a6f",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":242,"slug":4927,"dossier":47,"summary":4928,"aliases":4929,"sourceIds":4932,"published":4933,"modified":4934,"checkedAt":7,"severity":4935,"references":4938,"versionKeys":4944,"packageCount":32,"repositoryCount":66},"ghsa-m6qw-4cw2-hm4m-3f6d3ee7","aiohttp: CRLF injection in multipart headers",[4930,4931],"CVE-2026-50269","PYSEC-2026-2106",[242,4931],"2026-06-15T20:07:26Z","2026-09-10T03:51:09.078868018Z",[4936,4937],{"type":1279,"score":1612},{"type":1318,"score":1402},[4939,4941,4943],{"type":1286,"url":4940},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-m6qw-4cw2-hm4m",{"type":1326,"url":4942},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fbf88077ebb14f4c29924b8e8904cba20c55c28b8",{"type":1291,"url":1545},[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":243,"slug":4946,"dossier":47,"summary":4947,"aliases":4948,"sourceIds":4951,"published":4952,"modified":4953,"checkedAt":7,"severity":4954,"references":4957,"versionKeys":4965,"packageCount":32,"repositoryCount":490},"ghsa-mf9v-mfxr-j63j-1a7db6d4","urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API",[4949,4950],"CVE-2026-44432","PYSEC-2026-142",[243,4950],"2026-05-11T14:51:45Z","2026-09-10T03:51:06.409994465Z",[4955,4956],{"type":1318,"score":1402},{"type":1279,"score":1637},[4958,4960,4962,4964],{"type":1286,"url":4959},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9v-mfxr-j63j",{"type":1286,"url":4961},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44432",{"type":1283,"url":4963},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Furllib3\u002FPYSEC-2026-142.yaml",{"type":1291,"url":1652},[3346],{"id":244,"slug":4967,"dossier":47,"summary":4968,"aliases":4969,"sourceIds":4972,"published":4973,"modified":4974,"checkedAt":7,"severity":4975,"references":4978,"versionKeys":4991,"packageCount":32,"repositoryCount":1600},"ghsa-mf9w-mj56-hr94-a492e0f4","python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback",[4970,4971],"CVE-2026-28684","PYSEC-2026-2270",[244,4971],"2026-04-20T17:16:33.087Z","2026-09-10T03:51:02.363430883Z",[4976],{"type":1318,"score":4977},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[4979,4981,4983,4985,4987,4989],{"type":1326,"url":4980},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fsecurity\u002Fadvisories\u002FGHSA-mf9w-mj56-hr94",{"type":1286,"url":4982},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-28684",{"type":1326,"url":4984},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311",{"type":1283,"url":4986},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Fcommit\u002F790c5c02991100aa1bf41ee5330aca75edc51311.patch",{"type":1291,"url":4988},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv",{"type":1286,"url":4990},"https:\u002F\u002Fgithub.com\u002Ftheskumar\u002Fpython-dotenv\u002Freleases\u002Ftag\u002Fv1.2.2",[4992,4993,4994,4995],"pypi:python-dotenv@1.0.1","pypi:python-dotenv@1.1.0","pypi:python-dotenv@1.1.1","pypi:python-dotenv@1.2.1",{"id":245,"slug":4997,"dossier":47,"summary":4998,"aliases":4999,"sourceIds":5002,"published":5003,"modified":5004,"checkedAt":7,"severity":5005,"references":5008,"versionKeys":5023,"packageCount":32,"repositoryCount":42},"ghsa-mfx4-hv73-q22v-b33d9650","AIOHTTP: HTTP request smuggling via WebSocket upgrade",[5000,5001],"CVE-2026-69243","PYSEC-2026-3546",[245,5001],"2026-08-03T20:46:10Z","2026-09-10T03:51:14.385788837Z",[5006],{"type":1279,"score":5007},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5009,5011,5013,5015,5016,5018,5019,5021],{"type":1283,"url":5010},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mfx4-hv73-q22v",{"type":1283,"url":5012},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F13017",{"type":1283,"url":5014},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",{"type":1291,"url":1545},{"type":1283,"url":5017},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Freleases\u002Ftag\u002Fv3.14.2",{"type":1291,"url":2252},{"type":1286,"url":5020},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mfx4-hv73-q22v",{"type":1286,"url":5022},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-69243",[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598],{"id":246,"slug":5025,"dossier":47,"summary":5026,"aliases":5027,"sourceIds":5030,"published":5031,"modified":5032,"checkedAt":7,"severity":5033,"references":5035,"versionKeys":5046,"packageCount":32,"repositoryCount":34},"ghsa-mj87-hwqh-73pj-92a4d569","python-multipart affected by Denial of Service via large multipart preamble or epilogue data",[5028,5029],"CVE-2026-40347","PYSEC-2026-3038",[246,5029],"2026-04-15T19:45:44Z","2026-09-10T03:51:02.322677211Z",[5034],{"type":1318,"score":1502},[5036,5038,5040,5041,5043,5044],{"type":1283,"url":5037},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-mj87-hwqh-73pj",{"type":1286,"url":5039},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40347",{"type":1291,"url":2356},{"type":1283,"url":5042},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Freleases\u002Ftag\u002F0.0.26",{"type":1291,"url":2358},{"type":1286,"url":5045},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mj87-hwqh-73pj",[2482,2483,2362],{"id":247,"slug":5048,"dossier":47,"summary":5049,"aliases":5050,"sourceIds":5053,"published":5054,"modified":5055,"checkedAt":7,"severity":5056,"references":5058,"versionKeys":5071,"packageCount":32,"repositoryCount":42},"ghsa-mq44-7p77-q5h7-6bd0337a","AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate",[5051,5052],"CVE-2026-59881","PYSEC-2026-3547",[247,5052],"2026-08-03T20:40:55Z","2026-09-10T03:51:14.489650589Z",[5057],{"type":1279,"score":2764},[5059,5061,5063,5065,5067,5068,5069],{"type":1283,"url":5060},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mq44-7p77-q5h7",{"type":1286,"url":5062},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59881",{"type":1283,"url":5064},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fpull\u002F12978",{"type":1283,"url":5066},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F47fb6ae354d4fa22048f4dbe7dbf82b625f0a2f6",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":5070},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mq44-7p77-q5h7",[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598],{"id":248,"slug":5073,"dossier":47,"summary":5074,"aliases":5075,"sourceIds":5078,"published":5079,"modified":5080,"checkedAt":7,"severity":5081,"references":5083,"versionKeys":5094,"packageCount":32,"repositoryCount":452},"ghsa-mqqc-3gqh-h2x8-6d702daf","AIOHTTP has unicode match groups in regexes for ASCII protocol elements",[5076,5077],"CVE-2025-69225","PYSEC-2026-1109",[248,5077],"2026-01-05T23:09:30Z","2026-09-10T03:50:33.538693726Z",[5082],{"type":1279,"score":1612},[5084,5086,5088,5090,5091,5092],{"type":1283,"url":5085},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mqqc-3gqh-h2x8",{"type":1286,"url":5087},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-69225",{"type":1326,"url":5089},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002Fc7b7a044f88c71cefda95ec75cdcfaa4792b3b96",{"type":1291,"url":1545},{"type":1291,"url":2252},{"type":1286,"url":5093},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-mqqc-3gqh-h2x8",[1549,1550,1551,1552,1553,1554,1555],{"id":249,"slug":5096,"dossier":47,"summary":5097,"aliases":5098,"sourceIds":5101,"published":5102,"modified":5103,"checkedAt":7,"severity":5104,"references":5106,"versionKeys":5117,"packageCount":32,"repositoryCount":1306},"ghsa-mrfp-p49p-3hf2-6cfe1cba","Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion",[5099,5100],"BIT-pillow-2026-96640","CVE-2026-96640",[249],"2026-10-22T16:00:47Z","2026-10-29T10:55:39.916451864Z",[5105],{"type":1279,"score":1280},[5107,5109,5111,5113,5115,5116],{"type":1283,"url":5108},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-mrfp-p49p-3hf2",{"type":1286,"url":5110},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96640",{"type":1283,"url":5112},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10093",{"type":1283,"url":5114},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F6f0e7ee1f9c2fe227906f8a4b926e6622b702bc7",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":250,"slug":5119,"dossier":47,"summary":5120,"aliases":5121,"sourceIds":5124,"published":5125,"modified":5126,"checkedAt":7,"severity":5127,"references":5130,"versionKeys":5139,"packageCount":32,"repositoryCount":442},"ghsa-mwh4-6h8g-pg8w-881420d8","AIOHTTP has HTTP response splitting via \\r in reason phrase",[5122,5123],"CVE-2026-34519","PYSEC-2026-2101",[250,5123],"2026-04-01T21:17:00.170Z","2026-09-10T03:50:44.819886754Z",[5128,5129],{"type":1279,"score":1612},{"type":1318,"score":1614},[5131,5133,5135,5137,5138],{"type":1326,"url":5132},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-mwh4-6h8g-pg8w",{"type":1286,"url":5134},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34519",{"type":1326,"url":5136},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F53b35a2f8869c37a133e60bf1a82a1c01642ba2b",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":251,"slug":5141,"dossier":47,"summary":5142,"aliases":5143,"sourceIds":5146,"published":5147,"modified":5148,"checkedAt":7,"severity":5149,"references":5151,"versionKeys":5160,"packageCount":32,"repositoryCount":1306},"ghsa-p4wg-p73j-c528-fd1a8a19","Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)",[5144,5145],"BIT-pillow-2026-112895","CVE-2026-112895",[251],"2026-10-20T20:50:49Z","2026-10-26T08:55:38.434240536Z",[5150],{"type":1279,"score":1568},[5152,5154,5156,5158,5159],{"type":1283,"url":5153},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p4wg-p73j-c528",{"type":1286,"url":5155},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112895",{"type":1283,"url":5157},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fe2ae7eacad6de68c37eb28b633a97bebacf2c5bf",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":252,"slug":5162,"dossier":47,"summary":5163,"aliases":5164,"sourceIds":5168,"published":5169,"modified":5170,"checkedAt":7,"severity":5171,"references":5173,"versionKeys":5183,"packageCount":32,"repositoryCount":1306},"ghsa-p8hx-v2p6-rp84-525428cb","Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek \u002F DcxImageFile.seek)",[5165,5166,5167],"BIT-pillow-2026-96636","CVE-2026-96636","PYSEC-2026-4337",[252,5167],"2026-10-21T21:20:31.760Z","2026-10-29T10:55:49.521326948Z",[5172],{"type":1318,"score":1354},[5174,5176,5178,5180,5181,5182],{"type":1286,"url":5175},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-p8hx-v2p6-rp84",{"type":1286,"url":5177},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96636",{"type":1705,"url":5179},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10011",{"type":1326,"url":2567},{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":253,"slug":5185,"dossier":47,"summary":5186,"aliases":5187,"sourceIds":5190,"published":5191,"modified":5192,"checkedAt":7,"severity":5193,"references":5196,"versionKeys":5205,"packageCount":32,"repositoryCount":442},"ghsa-p998-jp59-783m-17c88f0d","AIOHTTP affected by UNC SSRF\u002FNTLMv2 Credential Theft\u002FLocal File Read in static resource handler on Windows",[5188,5189],"CVE-2026-34515","PYSEC-2026-2097",[253,5189],"2026-04-01T21:16:59.570Z","2026-09-10T03:51:02.565661873Z",[5194,5195],{"type":1279,"score":4584},{"type":1318,"score":4586},[5197,5199,5201,5203,5204],{"type":1326,"url":5198},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-p998-jp59-783m",{"type":1286,"url":5200},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-34515",{"type":1326,"url":5202},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0ae2aa076c84573df83fc1fdc39eec0f5862fe3d",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":254,"slug":5207,"dossier":47,"summary":5208,"aliases":5209,"sourceIds":5213,"published":5214,"modified":5215,"checkedAt":7,"severity":5216,"references":5220,"versionKeys":5229,"packageCount":32,"repositoryCount":1306},"ghsa-pchr-8j38-3x4p-42f3b4df","Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read",[5210,5211,5212],"BIT-pillow-2026-112896","CVE-2026-112896","PYSEC-2026-4334",[254,5212],"2026-10-19T22:17:09.760Z","2026-10-28T11:10:41.233140457Z",[5217,5218],{"type":1279,"score":3732},{"type":1318,"score":5219},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[5221,5223,5225,5227,5228],{"type":1477,"url":5222},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pchr-8j38-3x4p",{"type":1286,"url":5224},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112896",{"type":1326,"url":5226},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fd03dc3c587a9b0bdc9e4304d70d59a635a87b742",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":255,"slug":5231,"dossier":47,"summary":5232,"aliases":5233,"sourceIds":5237,"published":5238,"modified":5239,"checkedAt":7,"severity":5240,"references":5243,"versionKeys":5256,"packageCount":32,"repositoryCount":34},"ghsa-pg7v-jwj7-p798-7c77aab5","Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service",[5234,5235,5236],"BIT-pillow-2026-59203","CVE-2026-59203","PYSEC-2026-3452",[255,5236],"2026-07-14T16:17:02.063Z","2026-09-10T03:50:52.876709782Z",[5241,5242],{"type":1318,"score":1502},{"type":1318,"score":1402},[5244,5246,5248,5250,5252,5254,5255],{"type":1477,"url":5245},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pg7v-jwj7-p798",{"type":1286,"url":5247},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59203",{"type":1326,"url":5249},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9708",{"type":1326,"url":5251},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F03992618118b4a76b6163cd72ab5ecd684133b83",{"type":1283,"url":5253},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-3452.yaml",{"type":1291,"url":1292},{"type":1286,"url":2624},[1301,1302,1303,1304],{"id":256,"slug":5258,"dossier":47,"summary":5259,"aliases":5260,"sourceIds":5263,"published":4834,"modified":5264,"checkedAt":7,"severity":5265,"references":5268,"versionKeys":5281,"packageCount":32,"repositoryCount":490},"ghsa-phhr-52qp-3mj4-6f5d82e3","Transformers's Improper Input Validation vulnerability can be exploited through username injection",[5261,5262],"CVE-2025-3777","PYSEC-2026-1986",[256,5262],"2026-09-10T03:50:26.198077196Z",[5266],{"type":1318,"score":5267},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:R\u002FS:U\u002FC:L\u002FI:N\u002FA:N",[5269,5271,5273,5274,5276,5278,5279],{"type":1286,"url":5270},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3777",{"type":1283,"url":5272},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F4dda5f71b35fb70cf602187eef84bb17a50b9082",{"type":1291,"url":1475},{"type":1283,"url":5275},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fblame\u002Fa7d2bbaaa8aac64f7c1ee8c1421cfe84b38359a4\u002Fsrc\u002Ftransformers\u002Fimage_utils.py",{"type":1283,"url":5277},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fccba0730-9248-4853-b7ff-5c20e6364f09",{"type":1291,"url":1789},{"type":1286,"url":5280},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-phhr-52qp-3mj4",[1482,1483,1484],{"id":257,"slug":5283,"dossier":47,"summary":5284,"aliases":5285,"sourceIds":5289,"published":5290,"modified":5291,"checkedAt":7,"severity":5292,"references":5294,"versionKeys":5305,"packageCount":32,"repositoryCount":105},"ghsa-phj9-mv4w-65pm-481e7dc3","Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`",[5286,5287,5288],"BIT-pillow-2026-55380","CVE-2026-55380","PYSEC-2026-2256",[257,5288],"2026-07-06T19:17:08.703Z","2026-09-10T03:51:11.734605509Z",[5293],{"type":1318,"score":1402},[5295,5297,5299,5301,5303,5304],{"type":1477,"url":5296},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-phj9-mv4w-65pm",{"type":1286,"url":5298},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-55380",{"type":1326,"url":5300},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Ff39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675",{"type":1283,"url":5302},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-2256.yaml",{"type":1291,"url":1292},{"type":1286,"url":1918},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":258,"slug":5307,"dossier":47,"summary":5308,"aliases":5309,"sourceIds":5312,"published":5313,"modified":5314,"checkedAt":7,"severity":5315,"references":5317,"versionKeys":5326,"packageCount":32,"repositoryCount":34},"ghsa-pp6c-gr5w-3c5g-de40aafe","python-multipart has Denial of Service via unbounded multipart part headers",[5310,5311],"CVE-2026-42561","PYSEC-2026-3039",[258,5311],"2026-05-06T21:56:14Z","2026-09-10T03:50:47.215892833Z",[5316],{"type":1318,"score":1402},[5318,5320,5322,5323,5324],{"type":1283,"url":5319},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-pp6c-gr5w-3c5g",{"type":1286,"url":5321},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42561",{"type":1291,"url":2356},{"type":1291,"url":2358},{"type":1286,"url":5325},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pp6c-gr5w-3c5g",[2482,2483,2362],{"id":259,"slug":5328,"dossier":47,"summary":5329,"aliases":5330,"sourceIds":5333,"published":5334,"modified":5335,"checkedAt":7,"severity":5336,"references":5338,"versionKeys":5350,"packageCount":32,"repositoryCount":452},"ghsa-pq67-6m6q-mj2v-3522d1d4","urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation",[5331,5332],"CVE-2025-50181","PYSEC-2026-1999",[259,5332],"2025-06-18T17:50:00Z","2026-09-10T03:50:25.299291456Z",[5337],{"type":1318,"score":1953},[5339,5341,5343,5345,5346,5347,5348],{"type":1283,"url":5340},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",{"type":1286,"url":5342},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-50181",{"type":1326,"url":5344},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Ff05b1329126d5be6de501f9d1e3e36738bc08857",{"type":1291,"url":1652},{"type":1283,"url":1963},{"type":1291,"url":1654},{"type":1286,"url":5349},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-pq67-6m6q-mj2v",[1656,1657,1658,1659],{"id":260,"slug":5352,"dossier":47,"summary":5353,"aliases":5354,"sourceIds":5356,"published":5357,"modified":5358,"checkedAt":7,"severity":5359,"references":5362,"versionKeys":5371,"packageCount":32,"repositoryCount":1600},"ghsa-pqxq-w44r-73xw-f260bc82","AIOHTTP: Pure-Python parser request smuggling",[5355],"CVE-2026-111750",[260],"2026-10-20T19:52:21Z","2026-10-20T20:00:04.694820004Z",[5360],{"type":1279,"score":5361},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:L\u002FSA:L",[5363,5365,5367,5369,5370],{"type":1283,"url":5364},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-pqxq-w44r-73xw",{"type":1286,"url":5366},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-111750",{"type":1283,"url":5368},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F9b27347e61454d9f8ca2055f4c67a37dee336e83",{"type":1291,"url":1545},{"type":1283,"url":1596},[1549,1550,1551,1552,1553,1554,1555,1556,1557,1598,1599],{"id":261,"slug":5373,"dossier":47,"summary":5374,"aliases":5375,"sourceIds":5379,"published":5380,"modified":5381,"checkedAt":7,"severity":5382,"references":5385,"versionKeys":5397,"packageCount":32,"repositoryCount":1661},"ghsa-pwv6-vv43-88gr-c5f811d0","Pillow has an OOB Write with Invalid PSD Tile Extents (Integer Overflow)",[5376,5377,5378],"BIT-pillow-2026-42311","CVE-2026-42311","PYSEC-2026-2252",[261,5378],"2026-05-04T20:20:31Z","2026-09-10T03:50:47.242104143Z",[5383,5384],{"type":1279,"score":3755},{"type":1318,"score":2863},[5386,5387,5389,5391,5393,5395,5396],{"type":1283,"url":3759},{"type":1326,"url":5388},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-pwv6-vv43-88gr",{"type":1286,"url":5390},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42311",{"type":1326,"url":5392},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9520",{"type":1326,"url":5394},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F58f9a1d166dcb0c274807d4423522d205b0c35ea",{"type":1291,"url":1292},{"type":1286,"url":2598},[1296,1297,1298,1299,1300,1301,1302,1303],{"id":262,"slug":5399,"dossier":47,"summary":5400,"aliases":5401,"sourceIds":5404,"published":4834,"modified":5405,"checkedAt":7,"severity":5406,"references":5408,"versionKeys":5419,"packageCount":32,"repositoryCount":32},"ghsa-q2wp-rjmx-x6x9-43135d3d","Transformers's ReDoS vulnerability in get_configuration_file can lead to catastrophic backtracking",[5402,5403],"CVE-2025-3263","PYSEC-2026-1987",[262,5403],"2026-07-07T17:56:57.889099913Z",[5407],{"type":1318,"score":2122},[5409,5411,5412,5413,5414,5416,5417],{"type":1286,"url":5410},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3263",{"type":1283,"url":4842},{"type":1283,"url":4844},{"type":1291,"url":1475},{"type":1283,"url":5415},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Fc7a69150-54f8-4e81-8094-791e7a2a0f29",{"type":1291,"url":1789},{"type":1286,"url":5418},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2wp-rjmx-x6x9",[1482],{"id":263,"slug":5421,"dossier":47,"summary":5422,"aliases":5423,"sourceIds":5426,"published":5427,"modified":5428,"checkedAt":7,"severity":5429,"references":5433,"versionKeys":5446,"packageCount":32,"repositoryCount":32},"ghsa-q2x7-8rv6-6q7h-1113a288","Jinja has a sandbox breakout through indirect reference to format method",[5424,5425],"CVE-2024-56326","PYSEC-2026-1475",[263,5425],"2024-12-23T17:56:08Z","2026-09-10T03:50:21.662855250Z",[5430,5432],{"type":1318,"score":5431},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1279,"score":3832},[5434,5436,5438,5440,5441,5442,5443,5444],{"type":1283,"url":5435},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fsecurity\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",{"type":1286,"url":5437},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-56326",{"type":1326,"url":5439},"https:\u002F\u002Fgithub.com\u002Fpallets\u002Fjinja\u002Fcommit\u002F48b0687e05a5466a91cd5812d604fa37ad0943b4",{"type":1291,"url":3841},{"type":1283,"url":4457},{"type":1283,"url":3843},{"type":1291,"url":3847},{"type":1286,"url":5445},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-q2x7-8rv6-6q7h",[3851],{"id":264,"slug":5448,"dossier":47,"summary":5449,"aliases":5450,"sourceIds":5453,"published":5454,"modified":5455,"checkedAt":7,"severity":5456,"references":5459,"versionKeys":5467,"packageCount":32,"repositoryCount":1306},"ghsa-q45j-58j2-45rg-cd238628","Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips",[5451,5452],"BIT-pillow-2026-112897","CVE-2026-112897",[264],"2026-10-20T20:52:43Z","2026-10-26T08:56:08.265781051Z",[5457],{"type":1279,"score":5458},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5460,5462,5464,5465,5466],{"type":1283,"url":5461},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-q45j-58j2-45rg",{"type":1286,"url":5463},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112897",{"type":1283,"url":3739},{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":265,"slug":5469,"dossier":47,"summary":5470,"aliases":5471,"sourceIds":5474,"published":5475,"modified":5476,"checkedAt":7,"severity":5477,"references":5481,"versionKeys":5487,"packageCount":32,"repositoryCount":1306},"ghsa-qccp-gfcp-xxvc-0d988969","urllib3: Sensitive headers forwarded across origins in proxied low-level redirects",[5472,5473],"CVE-2026-44431","PYSEC-2026-141",[265,5473],"2026-05-11T14:51:20Z","2026-09-10T03:50:47.272765640Z",[5478,5479],{"type":1318,"score":2739},{"type":1279,"score":5480},"CVSS:4.0\u002FAV:N\u002FAC:H\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5482,5484,5486],{"type":1286,"url":5483},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-qccp-gfcp-xxvc",{"type":1286,"url":5485},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-44431",{"type":1291,"url":1652},[1656,1657,1658,1659,1660,3346],{"id":266,"slug":5489,"dossier":47,"summary":5490,"aliases":5491,"sourceIds":5495,"published":5496,"modified":5497,"checkedAt":7,"severity":5498,"references":5502,"versionKeys":5520,"packageCount":32,"repositoryCount":2679},"ghsa-qfhq-4f3w-5fph-33bc3f14","PyTorch is vulnerable to memory corruption through its torch.lstm_cell function",[5492,5493,5494],"BIT-pytorch-2025-3001","CVE-2025-3001","PYSEC-2025-195",[266],"2025-03-31T18:31:08Z","2026-06-10T18:26:26.736808954Z",[5499,5500],{"type":1318,"score":3380},{"type":1279,"score":5501},"CVSS:4.0\u002FAV:L\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:P",[5503,5505,5507,5509,5511,5513,5514,5516,5518],{"type":1286,"url":5504},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3001",{"type":1283,"url":5506},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626",{"type":1283,"url":5508},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149626#issue-2935860995",{"type":1283,"url":5510},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002F999d94b5ede5f4ec111ba7dd144129e2c2725b03",{"type":1283,"url":5512},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-195.yaml",{"type":1291,"url":1712},{"type":1283,"url":5515},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302050",{"type":1283,"url":5517},"https:\u002F\u002Fvuldb.com\u002F?id.302050",{"type":1283,"url":5519},"https:\u002F\u002Fvuldb.com\u002F?submit.524212",[1724,1725,1726,2672,2673,2674,2675,2676,2677,2678],{"id":267,"slug":5522,"dossier":47,"summary":5523,"aliases":5524,"sourceIds":5527,"published":5528,"modified":5529,"checkedAt":7,"severity":5530,"references":5533,"versionKeys":5547,"packageCount":32,"repositoryCount":2679},"ghsa-qmgc-5h2g-mvrw-199eacc8","filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock",[5525,5526],"CVE-2026-22701","PYSEC-2026-1374",[267,5526],"2026-01-13T18:44:55Z","2026-09-10T03:50:33.702580779Z",[5531],{"type":1318,"score":5532},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[5534,5536,5538,5540,5542,5543,5545],{"type":1283,"url":5535},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",{"type":1286,"url":5537},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22701",{"type":1283,"url":5539},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F255ed068bc85d1ef406e50a135e1459170dd1bf0",{"type":1283,"url":5541},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F41b42dd2c72aecf7da83dbda5903b8087dddc4d5",{"type":1291,"url":2304},{"type":1291,"url":5544},"https:\u002F\u002Fpypi.org\u002Fproject\u002Ffilelock",{"type":1286,"url":5546},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qmgc-5h2g-mvrw",[2845,2846,2847,2848],{"id":268,"slug":5549,"dossier":47,"summary":5550,"aliases":5551,"sourceIds":5554,"published":5555,"modified":5556,"checkedAt":7,"severity":5557,"references":5560,"versionKeys":5574,"packageCount":32,"repositoryCount":32},"ghsa-qq3j-4f4f-9583-cd76c72c","Hugging Face Transformers Regular Expression Denial of Service",[5552,5553],"CVE-2025-2099","PYSEC-2025-40",[268,5553],"2025-05-19T12:15:19Z","2026-06-10T17:02:48.111891265Z",[5558,5559],{"type":1318,"score":2122},{"type":1318,"score":1402},[5561,5563,5565,5567,5568,5570,5572],{"type":1286,"url":5562},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2099",{"type":1283,"url":5564},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F36648",{"type":1326,"url":5566},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F8cb522b4190bd556ce51be04942720650b1a3e57",{"type":1291,"url":1475},{"type":1283,"url":5569},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2025-40.yaml",{"type":1283,"url":5571},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F97b780f3-ffca-424f-ad5d-0e1c57a5bde4",{"type":1286,"url":5573},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qq3j-4f4f-9583",[1482],{"id":269,"slug":5576,"dossier":47,"summary":4653,"aliases":5577,"sourceIds":5580,"published":5581,"modified":5582,"checkedAt":7,"severity":5583,"references":5587,"versionKeys":5601,"packageCount":32,"repositoryCount":32},"ghsa-qxrp-vhvm-j765-63c6e9a2",[5578,5579],"CVE-2024-11392","PYSEC-2024-227",[269,5579],"2024-11-22T22:15:06Z","2026-09-10T03:50:21.016710762Z",[5584,5586],{"type":1318,"score":5585},"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"type":1318,"score":1424},[5588,5590,5591,5592,5593,5595,5597,5599],{"type":1286,"url":5589},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11392",{"type":1283,"url":4668},{"type":1283,"url":4670},{"type":1291,"url":1475},{"type":1283,"url":5594},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-227.yaml",{"type":1283,"url":5596},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513",{"type":1286,"url":5598},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1513\u002F",{"type":1286,"url":5600},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-qxrp-vhvm-j765",[1482],{"id":270,"slug":5603,"dossier":47,"summary":5604,"aliases":5605,"sourceIds":5609,"published":5610,"modified":5611,"checkedAt":7,"severity":5612,"references":5615,"versionKeys":5629,"packageCount":32,"repositoryCount":1661},"ghsa-r73j-pqj5-w3x7-8d4d543f","Pillow has a PDF Parsing Trailer Infinite Loop (DoS)",[5606,5607,5608],"BIT-pillow-2026-42310","CVE-2026-42310","PYSEC-2026-2874",[270,5608],"2026-05-04T20:19:30Z","2026-09-10T03:50:55.309086884Z",[5613,5614],{"type":1318,"score":1700},{"type":1279,"score":2584},[5616,5618,5620,5622,5624,5625,5626,5627],{"type":1283,"url":5617},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",{"type":1286,"url":5619},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42310",{"type":1283,"url":5621},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9519",{"type":1283,"url":5623},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3bf614e4b8615d0ce1d5039efaf6db447fe7c468",{"type":1291,"url":1292},{"type":1283,"url":2598},{"type":1291,"url":2626},{"type":1286,"url":5628},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-r73j-pqj5-w3x7",[1296,1297,1298,1299,1300,1301,1302,1303],{"id":271,"slug":5631,"dossier":47,"summary":5632,"aliases":5633,"sourceIds":5636,"published":5637,"modified":5638,"checkedAt":7,"severity":5639,"references":5641,"versionKeys":5656,"packageCount":32,"repositoryCount":471},"ghsa-rcv9-qm8p-9p6j-edc1db04","Hugging Face Transformers library has Regular Expression Denial of Service",[5634,5635],"CVE-2025-6051","PYSEC-2026-1988",[271,5635],"2025-09-14T18:30:26Z","2026-09-10T03:50:28.694224028Z",[5640],{"type":1318,"score":2122},[5642,5644,5646,5648,5650,5651,5653,5654],{"type":1286,"url":5643},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-6051",{"type":1283,"url":5645},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F38844",{"type":1283,"url":5647},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002F54a02160eb030da9be18231c77791f2eb3a52216",{"type":1283,"url":5649},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fba8eaba9865618253f997784aa565b96206426f0",{"type":1291,"url":1475},{"type":1283,"url":5652},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002Faf929523-7b59-418a-bf55-301830b2ac9d",{"type":1291,"url":1789},{"type":1286,"url":5655},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rcv9-qm8p-9p6j",[1482,1483,1484,1485],{"id":272,"slug":5658,"dossier":47,"summary":5659,"aliases":5660,"sourceIds":5663,"published":5664,"modified":5665,"checkedAt":7,"severity":5666,"references":5669,"versionKeys":5678,"packageCount":32,"repositoryCount":1306},"ghsa-rfgq-q3w2-pmv2-908c42cd","Pillow: Image.quantize() with empty palette leaks uninitialized stack memory",[5661,5662],"BIT-pillow-2026-112898","CVE-2026-112898",[272],"2026-10-21T20:44:07Z","2026-10-26T08:55:50.383984569Z",[5667],{"type":1279,"score":5668},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:N\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[5670,5672,5674,5676,5677],{"type":1283,"url":5671},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-rfgq-q3w2-pmv2",{"type":1286,"url":5673},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112898",{"type":1283,"url":5675},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13943c8f857b22f073d30f0ef9b725a0d255f1a4",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":273,"slug":5680,"dossier":47,"summary":5681,"aliases":5682,"sourceIds":5684,"published":5685,"modified":5686,"checkedAt":7,"severity":5687,"references":5689,"versionKeys":5700,"packageCount":32,"repositoryCount":2312},"ghsa-rfpc-qcw5-3pc4-0d3cdd9c","filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker",[5683],"CVE-2026-112939",[273],"2026-10-28T21:08:45Z","2026-10-28T21:15:05.584943666Z",[5688],{"type":1318,"score":4175},[5690,5692,5694,5696,5698,5699],{"type":1283,"url":5691},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-rfpc-qcw5-3pc4",{"type":1286,"url":5693},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112939",{"type":1283,"url":5695},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fpull\u002F836",{"type":1283,"url":5697},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002Feeceaa846cbe4df72718d94c8371ca1ab8f5b3cc",{"type":1291,"url":2304},{"type":1283,"url":2306},[2308,2309,2310,2311],{"id":274,"slug":5702,"dossier":47,"summary":5703,"aliases":5704,"sourceIds":5707,"published":5708,"modified":5709,"checkedAt":7,"severity":5710,"references":5713,"versionKeys":5726,"packageCount":32,"repositoryCount":1600},"ghsa-rgxp-2hwp-jwgg-76cdda06","Apache Arrow: Potential use-after-free when reading IPC file with pre-buffering",[5705,5706],"CVE-2026-25087","PYSEC-2026-113",[274,5706],"2026-02-17T14:16:01.947Z","2026-09-10T03:50:35.750182003Z",[5711],{"type":1318,"score":5712},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:H",[5714,5716,5718,5720,5722,5724],{"type":1286,"url":5715},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-25087",{"type":1326,"url":5717},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow\u002Fpull\u002F48925",{"type":1291,"url":5719},"https:\u002F\u002Fgithub.com\u002Fapache\u002Farrow",{"type":1283,"url":5721},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpyarrow\u002FPYSEC-2026-113.yaml",{"type":1286,"url":5723},"https:\u002F\u002Flists.apache.org\u002Fthread\u002Fmpm4ld1qony30tchfpjtk5b11tcyvmwh",{"type":1286,"url":5725},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-rgxp-2hwp-jwgg",[5727,5728,5729,5730],"pypi:pyarrow@18.1.0","pypi:pyarrow@20.0.0","pypi:pyarrow@21.0.0","pypi:pyarrow@22.0.0",{"id":275,"slug":5732,"dossier":47,"summary":5733,"aliases":5734,"sourceIds":5738,"published":3960,"modified":5739,"checkedAt":7,"severity":5740,"references":5743,"versionKeys":5761,"packageCount":32,"repositoryCount":1661},"ghsa-rrmf-rvhw-rf47-389d8330","PyTorch is vulnerable to memory corruption through its torch.jit.script function",[5735,5736,5737],"BIT-pytorch-2025-3000","CVE-2025-3000","PYSEC-2025-194",[275],"2026-09-10T03:49:48.419046410Z",[5741,5742],{"type":1318,"score":3380},{"type":1279,"score":5501},[5744,5746,5748,5750,5752,5754,5755,5757,5759],{"type":1286,"url":5745},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-3000",{"type":1283,"url":5747},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623",{"type":1283,"url":5749},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F149623#issue-2935703015",{"type":1283,"url":5751},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcommit\u002Fb90c94991cdf8b87c8f7439f79518e0ef2c4ca4f",{"type":1283,"url":5753},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-194.yaml",{"type":1291,"url":1712},{"type":1283,"url":5756},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302049",{"type":1283,"url":5758},"https:\u002F\u002Fvuldb.com\u002F?id.302049",{"type":1283,"url":5760},"https:\u002F\u002Fvuldb.com\u002F?submit.524197",[5762,5763,5764,1724,1725,1726,2672,2673,2674,2675,2676,2677,2678],"pypi:torch@2.10.0","pypi:torch@2.11.0","pypi:torch@2.12.1",{"id":276,"slug":5766,"dossier":47,"summary":5767,"aliases":5768,"sourceIds":5770,"published":5771,"modified":5772,"checkedAt":7,"severity":5773,"references":5776,"versionKeys":5785,"packageCount":32,"repositoryCount":2312},"ghsa-v4x8-3wr5-3wq8-fa48bf99","filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files",[5769],"CVE-2026-112940",[276],"2026-10-23T21:59:08Z","2026-10-23T22:15:04.432475030Z",[5774],{"type":1318,"score":5775},"CVSS:3.1\u002FAV:L\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[5777,5779,5781,5782,5783,5784],{"type":1283,"url":5778},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-v4x8-3wr5-3wq8",{"type":1286,"url":5780},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112940",{"type":1283,"url":3588},{"type":1283,"url":3590},{"type":1291,"url":2304},{"type":1283,"url":2306},[2308,2309,2310,2311],{"id":277,"slug":5787,"dossier":47,"summary":5788,"aliases":5789,"sourceIds":5792,"published":5793,"modified":5794,"checkedAt":7,"severity":5795,"references":5798,"versionKeys":5807,"packageCount":32,"repositoryCount":104},"ghsa-v9pg-7xvm-68hf-bd9c7524","python-multipart: Negative Content-Length in parse_form buffers the entire body in memory",[5790,5791],"CVE-2026-53540","PYSEC-2026-3040",[277,5791],"2026-06-15T20:23:45Z","2026-09-10T03:50:50.590441047Z",[5796],{"type":1318,"score":5797},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:L",[5799,5801,5802,5803,5805],{"type":1283,"url":5800},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pg-7xvm-68hf",{"type":1291,"url":2356},{"type":1291,"url":2358},{"type":1286,"url":5804},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-v9pg-7xvm-68hf",{"type":1286,"url":5806},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53540",[2482,2483,2484,2362],{"id":278,"slug":5809,"dossier":47,"summary":5810,"aliases":5811,"sourceIds":5815,"published":5816,"modified":5817,"checkedAt":7,"severity":5818,"references":5820,"versionKeys":5831,"packageCount":32,"repositoryCount":1661},"ghsa-v9pv-5gc8-w2m6-ece1573e","Pillow multi-frame loaders can reuse stale native image storage after mode transitions",[5812,5813,5814],"BIT-pillow-2026-96639","CVE-2026-96639","PYSEC-2026-4339",[278,5814],"2026-10-21T21:20:32.217Z","2026-10-29T10:55:37.663049285Z",[5819],{"type":1318,"score":2219},[5821,5823,5825,5827,5829,5830],{"type":1286,"url":5822},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-v9pv-5gc8-w2m6",{"type":1286,"url":5824},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-96639",{"type":1705,"url":5826},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10105",{"type":1326,"url":5828},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F78d97d994579aef81aafe123773d525f40f2522a",{"type":1291,"url":1292},{"type":1286,"url":1294},[1298,1299,1300,1301,1302,1303,1304,1305],{"id":279,"slug":5833,"dossier":47,"summary":5834,"aliases":5835,"sourceIds":5838,"published":5839,"modified":5840,"checkedAt":7,"severity":5841,"references":5843,"versionKeys":5854,"packageCount":32,"repositoryCount":104},"ghsa-vffw-93wf-4j4q-3828c302","python-multipart: Content-Disposition parameter smuggling via RFC 2231\u002F5987 extended parameters",[5836,5837],"CVE-2026-53537","PYSEC-2026-3041",[279,5837],"2026-06-15T20:20:51Z","2026-09-10T03:50:50.585695996Z",[5842],{"type":1318,"score":2931},[5844,5846,5848,5849,5851,5853],{"type":1283,"url":5845},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-vffw-93wf-4j4q",{"type":1286,"url":5847},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-53537",{"type":1291,"url":2356},{"type":1286,"url":5850},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vffw-93wf-4j4q",{"type":1283,"url":5852},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Fblob\u002Fmain\u002Fvulns\u002Fpython-multipart\u002FPYSEC-2026-3041.yaml",{"type":1291,"url":2358},[2482,2483,2484,2362],{"id":280,"slug":5856,"dossier":47,"summary":5857,"aliases":5858,"sourceIds":5862,"published":3960,"modified":5863,"checkedAt":7,"severity":5864,"references":5867,"versionKeys":5882,"packageCount":32,"repositoryCount":66},"ghsa-vgrw-7cvw-pwgx-766c6098","PyTorch is vulnerable to memory corruption through its unpack_sequence function",[5859,5860,5861],"BIT-pytorch-2025-2999","CVE-2025-2999","PYSEC-2025-193",[280],"2026-06-10T17:41:15.774477397Z",[5865,5866],{"type":1318,"score":3380},{"type":1279,"score":3965},[5868,5870,5871,5872,5873,5875,5876,5878,5880],{"type":1286,"url":5869},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2999",{"type":1283,"url":3970},{"type":1283,"url":3972},{"type":1283,"url":3974},{"type":1283,"url":5874},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-193.yaml",{"type":1291,"url":1712},{"type":1283,"url":5877},"https:\u002F\u002Fvuldb.com\u002F?ctiid.302048",{"type":1283,"url":5879},"https:\u002F\u002Fvuldb.com\u002F?id.302048",{"type":1283,"url":5881},"https:\u002F\u002Fvuldb.com\u002F?submit.524198",[1724,1725,1726,2672,2673,2674,2675],{"id":281,"slug":5884,"dossier":47,"summary":5885,"aliases":5886,"sourceIds":5890,"published":5891,"modified":5892,"checkedAt":7,"severity":5893,"references":5895,"versionKeys":5909,"packageCount":32,"repositoryCount":105},"ghsa-vjc4-5qp5-m44j-08063b19","Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service",[5887,5888,5889],"BIT-pillow-2026-59204","CVE-2026-59204","PYSEC-2026-3496",[281,5889],"2026-07-20T23:18:32Z","2026-09-10T03:50:53.107920034Z",[5894],{"type":1279,"score":1568},[5896,5898,5900,5902,5904,5905,5906,5907],{"type":1283,"url":5897},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",{"type":1286,"url":5899},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59204",{"type":1283,"url":5901},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9704",{"type":1283,"url":5903},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F13ada41172142f2fd9f0906f615a00ea623a11ca",{"type":1291,"url":1292},{"type":1283,"url":2624},{"type":1291,"url":2626},{"type":1286,"url":5908},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vjc4-5qp5-m44j",[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":282,"slug":5911,"dossier":47,"summary":5912,"aliases":5913,"sourceIds":5916,"published":5917,"modified":5918,"checkedAt":7,"severity":5919,"references":5922,"versionKeys":5937,"packageCount":32,"repositoryCount":490},"ghsa-vqfr-h8mv-ghfj-49515033","h11 accepts some malformed Chunked-Encoding bodies",[5914,5915],"CVE-2025-43859","PYSEC-2026-348",[282,5915],"2025-04-24T16:07:56Z","2026-10-27T16:45:03.535584040Z",[5920],{"type":1318,"score":5921},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:N",[5923,5925,5927,5929,5931,5933,5935],{"type":1283,"url":5924},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fsecurity\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",{"type":1286,"url":5926},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-43859",{"type":1283,"url":5928},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11\u002Fcommit\u002F114803a29ce50116dc47951c690ad4892b1a36ed",{"type":1283,"url":5930},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fh11\u002FPYSEC-2026-348.yaml",{"type":1291,"url":5932},"https:\u002F\u002Fgithub.com\u002Fpython-hyper\u002Fh11",{"type":1291,"url":5934},"https:\u002F\u002Fpypi.org\u002Fproject\u002Fh11",{"type":1286,"url":5936},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vqfr-h8mv-ghfj",[5938],"pypi:h11@0.14.0",{"id":283,"slug":5940,"dossier":47,"summary":5941,"aliases":5942,"sourceIds":5944,"published":5945,"modified":5946,"checkedAt":7,"severity":5947,"references":5949,"versionKeys":5956,"packageCount":32,"repositoryCount":1306},"ghsa-vx6w-vv9f-6gvg-f0d0a86e","Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit",[5943],"CVE-2026-112899",[283],"2026-10-20T20:53:21Z","2026-10-20T21:00:04.428653055Z",[5948],{"type":1279,"score":2764},[5950,5952,5954,5955],{"type":1283,"url":5951},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-vx6w-vv9f-6gvg",{"type":1283,"url":5953},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3e8cc105588d1dfe062fcada0b6058c1b5f14b65",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":284,"slug":5958,"dossier":91,"summary":5959,"aliases":5960,"sourceIds":5963,"published":5964,"modified":5965,"checkedAt":7,"severity":5966,"references":5968,"versionKeys":5980,"packageCount":32,"repositoryCount":2779},"ghsa-vxq7-64xx-v4gw-3e875898","urllib3: HTTPResponse.stream()\u002Fread_chunked() buffers an unbounded chunk-size line into memory",[5961,5962],"CVE-2026-97689","PYSEC-2026-4177",[284,5962],"2026-09-30T14:46:18Z","2026-10-01T17:55:57.514829071Z",[5967],{"type":1279,"score":1637},[5969,5971,5973,5975,5976,5977,5978],{"type":1283,"url":5970},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fsecurity\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",{"type":1286,"url":5972},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-97689",{"type":1283,"url":5974},"https:\u002F\u002Fgithub.com\u002Furllib3\u002Furllib3\u002Fcommit\u002Fcd770b059b543be29298ea5c52afb0b1b090f5ed",{"type":1291,"url":1652},{"type":1283,"url":3341},{"type":1291,"url":1654},{"type":1286,"url":5979},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-vxq7-64xx-v4gw",[1656,1657,1658,1659,1660,3346,3347],{"id":285,"slug":5982,"dossier":47,"summary":5983,"aliases":5984,"sourceIds":5987,"published":5988,"modified":5989,"checkedAt":7,"severity":5990,"references":5994,"versionKeys":6003,"packageCount":32,"repositoryCount":442},"ghsa-w2fm-2cpv-w7v5-c2f7701a","aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage",[5985,5986],"CVE-2026-22815","PYSEC-2026-2094",[285,5986],"2026-04-01T19:45:17Z","2026-09-10T03:51:03.588955358Z",[5991,5992],{"type":1279,"score":2764},{"type":1279,"score":5993},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",[5995,5997,5999,6001,6002],{"type":1326,"url":5996},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-w2fm-2cpv-w7v5",{"type":1286,"url":5998},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-22815",{"type":1326,"url":6000},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F0c2e9da51126238a421568eb7c5b53e5b5d17b36",{"type":1291,"url":1545},{"type":1286,"url":1624},[1549,1550,1551,1552,1553,1554,1555,1556],{"id":286,"slug":6005,"dossier":47,"summary":6006,"aliases":6007,"sourceIds":6010,"published":6011,"modified":6012,"checkedAt":7,"severity":6013,"references":6016,"versionKeys":6033,"packageCount":32,"repositoryCount":2679},"ghsa-w853-jp5j-5j7f-2786386f","filelock has a TOCTOU race condition which allows symlink attacks during lock file creation",[6008,6009],"CVE-2025-68146","PYSEC-2026-1375",[286,6009],"2025-12-16T20:52:55Z","2026-09-10T03:50:32.252960082Z",[6014],{"type":1318,"score":6015},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:H",[6017,6019,6021,6022,6024,6026,6028,6029,6031],{"type":1283,"url":6018},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fsecurity\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1283,"url":6020},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Fcommit\u002F4724d7f8c3393ec1f048c93933e6e3e6ec321f0e",{"type":1291,"url":2304},{"type":1283,"url":6023},"https:\u002F\u002Fgithub.com\u002Ftox-dev\u002Ffilelock\u002Freleases\u002Ftag\u002F3.20.1",{"type":1283,"url":6025},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fwin32\u002Ffileio\u002Ffile-attribute-constants",{"type":1283,"url":6027},"https:\u002F\u002Fpubs.opengroup.org\u002Fonlinepubs\u002F9699919799\u002Ffunctions\u002Fopen.html",{"type":1291,"url":5544},{"type":1286,"url":6030},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-w853-jp5j-5j7f",{"type":1286,"url":6032},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-68146",[2845,2846,2847,2848],{"id":287,"slug":6035,"dossier":47,"summary":6036,"aliases":6037,"sourceIds":6040,"published":6041,"modified":6042,"checkedAt":7,"severity":6043,"references":6046,"versionKeys":6055,"packageCount":32,"repositoryCount":1306},"ghsa-w889-685w-c8fh-9dd63a47","Pillow: Argument Injection in Ghostscript call, potentially leading into RCE",[6038,6039],"BIT-pillow-2026-112900","CVE-2026-112900",[287],"2026-10-21T19:58:44Z","2026-10-26T08:55:37.091976147Z",[6044],{"type":1279,"score":6045},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6047,6049,6051,6053,6054],{"type":1283,"url":6048},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-w889-685w-c8fh",{"type":1286,"url":6050},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112900",{"type":1283,"url":6052},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fa2c363141da31a265dd536c945677db4b64f3ec9",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":288,"slug":6057,"dossier":47,"summary":6058,"aliases":6059,"sourceIds":6063,"published":6064,"modified":6065,"checkedAt":7,"severity":6066,"references":6069,"versionKeys":6107,"packageCount":32,"repositoryCount":1661},"ghsa-whj4-6x5x-4v2j-eb5fc6a1","FITS GZIP decompression bomb in Pillow",[6060,6061,6062],"BIT-pillow-2026-40192","CVE-2026-40192","PYSEC-2026-2250",[288,6062],"2026-04-13T19:22:35Z","2026-09-10T03:51:03.847830288Z",[6067,6068],{"type":1318,"score":1402},{"type":1279,"score":1568},[6070,6072,6074,6076,6078,6079,6081,6083,6085,6087,6089,6091,6092,6094,6096,6098,6099,6101,6103,6105],{"type":1283,"url":6071},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-whj4-6x5x-4v2j",{"type":1286,"url":6073},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-40192",{"type":1283,"url":6075},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9521",{"type":1283,"url":6077},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F3cb854e8b2bab43f40e342e665f9340d861aa628",{"type":1291,"url":1292},{"type":1283,"url":6080},"https:\u002F\u002Fpillow.readthedocs.io\u002Fen\u002Fstable\u002Freleasenotes\u002F12.2.0.html#prevent-fits-decompression-bomb",{"type":1283,"url":6082},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-40192",{"type":1283,"url":6084},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-40192.json",{"type":1286,"url":6086},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16008",{"type":1286,"url":6088},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16009",{"type":1286,"url":6090},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:16030",{"type":1286,"url":3782},{"type":1286,"url":6093},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17609",{"type":1286,"url":6095},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:17611",{"type":1286,"url":6097},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:19375",{"type":1286,"url":3784},{"type":1286,"url":6100},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21017",{"type":1286,"url":6102},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22465",{"type":1286,"url":6104},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22629",{"type":1286,"url":6106},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:22840",[1296,1297,1298,1299,1300,1301,1302,1303],{"id":289,"slug":6109,"dossier":47,"summary":6110,"aliases":6111,"sourceIds":6115,"published":6116,"modified":6117,"checkedAt":7,"severity":6118,"references":6121,"versionKeys":6130,"packageCount":32,"repositoryCount":1661},"ghsa-wjx4-4jcj-g98j-e937161b","Pillow has an integer overflow when processing fonts",[6112,6113,6114],"BIT-pillow-2026-42308","CVE-2026-42308","PYSEC-2026-165",[289,6114],"2026-05-04T20:18:45Z","2026-09-10T03:50:47.950262681Z",[6119,6120],{"type":1318,"score":1700},{"type":1279,"score":2584},[6122,6124,6126,6128,6129],{"type":1286,"url":6123},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wjx4-4jcj-g98j",{"type":1286,"url":6125},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-42308",{"type":1283,"url":6127},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2026-165.yaml",{"type":1291,"url":1292},{"type":1286,"url":2598},[1296,1297,1298,1299,1300,1301,1302,1303],{"id":290,"slug":6132,"dossier":47,"summary":6133,"aliases":6134,"sourceIds":6137,"published":6138,"modified":6139,"checkedAt":7,"severity":6140,"references":6143,"versionKeys":6156,"packageCount":32,"repositoryCount":34},"ghsa-wp53-j4wj-2cfg-22cec3c5","Python-Multipart has Arbitrary File Write via Non-Default Configuration",[6135,6136],"CVE-2026-24486","PYSEC-2026-1852",[290,6136],"2026-01-26T23:28:05Z","2026-09-10T03:50:59.359593372Z",[6141],{"type":1318,"score":6142},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:H\u002FA:L",[6144,6146,6148,6150,6151,6153,6154],{"type":1283,"url":6145},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fsecurity\u002Fadvisories\u002FGHSA-wp53-j4wj-2cfg",{"type":1286,"url":6147},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-24486",{"type":1283,"url":6149},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Fcommit\u002F9433f4bbc9652bdde82bbe380984e32f8cfc89c4",{"type":1291,"url":2356},{"type":1283,"url":6152},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fpython-multipart\u002Freleases\u002Ftag\u002F0.0.22",{"type":1291,"url":2358},{"type":1286,"url":6155},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wp53-j4wj-2cfg",[2482,2483,2362],{"id":291,"slug":6158,"dossier":47,"summary":6159,"aliases":6160,"sourceIds":6162,"published":6163,"modified":6164,"checkedAt":7,"severity":6165,"references":6166,"versionKeys":6175,"packageCount":32,"repositoryCount":1306},"ghsa-wqgw-9xfh-qf2g-351c6680","Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data",[6161],"CVE-2026-128066",[291],"2026-11-12T23:35:39Z","2026-11-12T23:45:03.298534910Z",[],[6167,6169,6171,6173,6174],{"type":1283,"url":6168},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-wqgw-9xfh-qf2g",{"type":1283,"url":6170},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4908edaf7f416616784c7c03d8c1a60153710ffb",{"type":1283,"url":6172},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F4b63dffd8a6d980fa0e21b40832fa6cbf033eacf",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":292,"slug":6177,"dossier":47,"summary":6178,"aliases":6179,"sourceIds":6182,"published":6183,"modified":6184,"checkedAt":7,"severity":6185,"references":6187,"versionKeys":6209,"packageCount":32,"repositoryCount":442},"ghsa-wqp7-x3pw-xc5r-4caabf81","Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows",[6180,6181],"CVE-2026-48818","PYSEC-2026-2281",[292,6181],"2026-06-15T20:16:30Z","2026-09-10T03:50:51.079936646Z",[6186],{"type":1318,"score":4586},[6188,6190,6191,6193,6195,6197,6199,6201,6203,6205,6207],{"type":1286,"url":6189},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-wqp7-x3pw-xc5r",{"type":1291,"url":3149},{"type":1283,"url":6192},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-48818",{"type":1283,"url":6194},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-48818.json",{"type":1286,"url":6196},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30087",{"type":1286,"url":6198},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30088",{"type":1286,"url":6200},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:30089",{"type":1286,"url":6202},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Freleases\u002Ftag\u002F1.1.0",{"type":1705,"url":6204},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2490020",{"type":1326,"url":6206},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fcommit\u002Ffd53168a7767b6b55ba5af787fd88f49e33cabc5",{"type":1326,"url":6208},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fpull\u002F3287",[1521,1522,1523,3156,3157,3158,3225,3226,3227],{"id":293,"slug":6211,"dossier":47,"summary":4653,"aliases":6212,"sourceIds":6215,"published":4658,"modified":6216,"checkedAt":7,"severity":6217,"references":6220,"versionKeys":6234,"packageCount":32,"repositoryCount":32},"ghsa-wrfc-pvp9-mr9g-c6b03ddf",[6213,6214],"CVE-2024-11393","PYSEC-2024-228",[293,6214],"2026-09-10T03:50:55.987633957Z",[6218,6219],{"type":1318,"score":4662},{"type":1318,"score":1424},[6221,6223,6224,6225,6226,6228,6230,6232],{"type":1286,"url":6222},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2024-11393",{"type":1283,"url":4668},{"type":1283,"url":4670},{"type":1291,"url":1475},{"type":1283,"url":6227},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftransformers\u002FPYSEC-2024-228.yaml",{"type":1283,"url":6229},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514",{"type":1286,"url":6231},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-24-1514\u002F",{"type":1286,"url":6233},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-wrfc-pvp9-mr9g",[1482],{"id":294,"slug":6236,"dossier":47,"summary":6237,"aliases":6238,"sourceIds":6242,"published":6243,"modified":6244,"checkedAt":7,"severity":6245,"references":6250,"versionKeys":6266,"packageCount":32,"repositoryCount":500},"ghsa-x3gm-94wq-g975-a197ba31","PyTorch: Manipulation of the argument scale\u002Fzero_point leads to improper initialization via Quantized Sigmoid Module",[6239,6240,6241],"BIT-pytorch-2025-2149","CVE-2025-2149","PYSEC-2025-190",[294],"2025-03-10T15:30:47Z","2026-06-09T22:11:08.734544854Z",[6246,6248],{"type":1318,"score":6247},"CVSS:3.1\u002FAV:L\u002FAC:H\u002FPR:L\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N",{"type":1279,"score":6249},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:N\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N",[6251,6253,6255,6257,6259,6260,6262,6264],{"type":1286,"url":6252},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-2149",{"type":1283,"url":6254},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818",{"type":1283,"url":6256},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147818#issue-2877301660",{"type":1283,"url":6258},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Ftorch\u002FPYSEC-2025-190.yaml",{"type":1291,"url":1712},{"type":1283,"url":6261},"https:\u002F\u002Fvuldb.com\u002F?ctiid.299060",{"type":1283,"url":6263},"https:\u002F\u002Fvuldb.com\u002F?id.299060",{"type":1283,"url":6265},"https:\u002F\u002Fvuldb.com\u002F?submit.506563",[1724,1725],{"id":295,"slug":6268,"dossier":47,"summary":6269,"aliases":6270,"sourceIds":6273,"published":6274,"modified":6275,"checkedAt":7,"severity":6276,"references":6278,"versionKeys":6285,"packageCount":32,"repositoryCount":442},"ghsa-x746-7m8f-x49c-c0349d3f","Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`",[6271,6272],"CVE-2026-48817","PYSEC-2026-2280",[295,6272],"2026-06-15T20:16:05Z","2026-09-10T03:50:12.272722043Z",[6277],{"type":1318,"score":1614},[6279,6281,6283,6284],{"type":1286,"url":6280},"https:\u002F\u002Fgithub.com\u002FKludex\u002Fstarlette\u002Fsecurity\u002Fadvisories\u002FGHSA-x746-7m8f-x49c",{"type":1286,"url":6282},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48817",{"type":1291,"url":3149},{"type":1286,"url":6202},[1521,1522,1523,3156,3157,3158,3225,3226,3227],{"id":296,"slug":6287,"dossier":47,"summary":6288,"aliases":6289,"sourceIds":6292,"published":6293,"modified":6294,"checkedAt":7,"severity":6295,"references":6297,"versionKeys":6312,"packageCount":32,"repositoryCount":66},"ghsa-x9r9-c232-4q39-1586e326","Hugging Face Transformers downloads custom generation code before trust consent",[6290,6291],"CVE-2026-80047","PYSEC-2026-4174",[296,6291],"2026-09-01T15:31:13Z","2026-10-01T17:55:55.397425521Z",[6296],{"type":1318,"score":5431},[6298,6300,6302,6304,6305,6307,6309,6310],{"type":1286,"url":6299},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-80047",{"type":1283,"url":6301},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F48620",{"type":1283,"url":6303},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Fcbc1651a032b923da7f4b44b3d0e6f68e6ba6b55",{"type":1291,"url":1475},{"type":1283,"url":6306},"https:\u002F\u002Fkb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1283,"url":6308},"https:\u002F\u002Fwww.kb.cert.org\u002Fvuls\u002Fid\u002F456290",{"type":1291,"url":1789},{"type":1286,"url":6311},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-x9r9-c232-4q39",[1483,1484,1485,1486,1487,1488,1489,1490,6313],"pypi:transformers@5.8.0",{"id":297,"slug":6315,"dossier":47,"summary":6316,"aliases":6317,"sourceIds":6320,"published":6321,"modified":6322,"checkedAt":7,"severity":6323,"references":6326,"versionKeys":6332,"packageCount":32,"repositoryCount":66},"ghsa-xcgm-r5h9-7989-77bcbc26","aiohttp: Incomplete websocket frame payloads bypass memory limits",[6318,6319],"CVE-2026-54274","PYSEC-2026-2108",[297,6319],"2026-06-15T20:11:22Z","2026-09-10T03:50:12.346397944Z",[6324,6325],{"type":1279,"score":2000},{"type":1318,"score":1402},[6327,6329,6330],{"type":1286,"url":6328},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fsecurity\u002Fadvisories\u002FGHSA-xcgm-r5h9-7989",{"type":1291,"url":1545},{"type":1326,"url":6331},"https:\u002F\u002Fgithub.com\u002Faio-libs\u002Faiohttp\u002Fcommit\u002F14b6ee851fb16ec199acb950de0c82d476799e7d",[1549,1550,1551,1552,1553,1554,1555,1556,1557],{"id":298,"slug":6334,"dossier":47,"summary":6335,"aliases":6336,"sourceIds":6338,"published":6339,"modified":6340,"checkedAt":7,"severity":6341,"references":6344,"versionKeys":6353,"packageCount":32,"repositoryCount":1306},"ghsa-xcvg-w56q-r89m-87c516ac","Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size",[6337],"CVE-2026-128067",[298],"2026-11-12T23:34:43Z","2026-11-12T23:45:03.322245161Z",[6342],{"type":1279,"score":6343},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:L\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",[6345,6347,6349,6351,6352],{"type":1283,"url":6346},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xcvg-w56q-r89m",{"type":1283,"url":6348},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F53318b50e8e9e85a57d033d4d879e1398d97aeb1",{"type":1283,"url":6350},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fec5f1cbcf67275641abaad5c065ffb64a0a804a9",{"type":1291,"url":1292},{"type":1283,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":299,"slug":6355,"dossier":47,"summary":6356,"aliases":6357,"sourceIds":6361,"published":6362,"modified":6363,"checkedAt":7,"severity":6364,"references":6366,"versionKeys":6380,"packageCount":32,"repositoryCount":471},"ghsa-xg8h-j46f-w952-da36a616","Pillow vulnerability can cause write buffer overflow on BCn encoding",[6358,6359,6360],"BIT-pillow-2025-48379","CVE-2025-48379","PYSEC-2025-61",[299,6360],"2025-07-01T17:29:37Z","2026-09-10T03:50:26.431657121Z",[6365],{"type":1318,"score":5775},[6367,6369,6371,6373,6375,6377,6378],{"type":1286,"url":6368},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xg8h-j46f-w952",{"type":1286,"url":6370},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48379",{"type":1283,"url":6372},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9041",{"type":1326,"url":6374},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fef98b3510e3e4f14b547762764813d7e5ca3c5a4",{"type":1283,"url":6376},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fadvisory-database\u002Ftree\u002Fmain\u002Fvulns\u002Fpillow\u002FPYSEC-2025-61.yaml",{"type":1291,"url":1292},{"type":1283,"url":6379},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Freleases\u002Ftag\u002F11.3.0",[1299],{"id":300,"slug":6382,"dossier":47,"summary":6383,"aliases":6384,"sourceIds":6388,"published":6389,"modified":6390,"checkedAt":7,"severity":6391,"references":6394,"versionKeys":6403,"packageCount":32,"repositoryCount":1306},"ghsa-xgh8-jp6q-p5x8-0a8d4f1f","Pillow: ReDoS in XbmImagePlugin: 512-byte file stalls Image.open() for minutes",[6385,6386,6387],"BIT-pillow-2026-112901","CVE-2026-112901","PYSEC-2026-4335",[300,6387],"2026-10-19T22:17:10.293Z","2026-10-28T11:10:55.647541842Z",[6392,6393],{"type":1279,"score":2764},{"type":1318,"score":1402},[6395,6397,6399,6401,6402],{"type":1326,"url":6396},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xgh8-jp6q-p5x8",{"type":1286,"url":6398},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112901",{"type":1326,"url":6400},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F2852a3e3d568997ddec745fc800991f138878f4b",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":301,"slug":6405,"dossier":47,"summary":6406,"aliases":6407,"sourceIds":6411,"published":6412,"modified":6413,"checkedAt":7,"severity":6414,"references":6417,"versionKeys":6428,"packageCount":32,"repositoryCount":105},"ghsa-xj96-63gp-2gmr-85e1cf15","Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`",[6408,6409,6410],"BIT-pillow-2026-59197","CVE-2026-59197","PYSEC-2026-3454",[301,6410],"2026-07-14T17:17:14.487Z","2026-09-10T03:50:53.192759645Z",[6415],{"type":1318,"score":6416},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:H",[6418,6420,6422,6424,6426,6427],{"type":1477,"url":6419},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xj96-63gp-2gmr",{"type":1286,"url":6421},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-59197",{"type":1326,"url":6423},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F9695",{"type":1326,"url":6425},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Fcce3bdb867c77a3420261ed1bfdb6b0787ec8fc1",{"type":1291,"url":1292},{"type":1286,"url":2624},[1296,1297,1298,1299,1300,1301,1302,1303,1304],{"id":302,"slug":6430,"dossier":47,"summary":6431,"aliases":6432,"sourceIds":6433,"published":6434,"modified":6435,"checkedAt":7,"severity":6436,"references":6439,"versionKeys":6449,"packageCount":32,"repositoryCount":1306},"ghsa-xmj3-9gf7-h52w-d99c0028","setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description",[],[302],"2026-10-23T21:44:11Z","2026-10-23T22:00:03.739009766Z",[6437],{"type":1279,"score":6438},"CVSS:4.0\u002FAV:L\u002FAC:H\u002FAT:P\u002FPR:L\u002FUI:A\u002FVC:N\u002FVI:L\u002FVA:L\u002FSC:N\u002FSI:N\u002FSA:N",[6440,6442,6444,6446,6447],{"type":1283,"url":6441},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fsecurity\u002Fadvisories\u002FGHSA-xmj3-9gf7-h52w",{"type":1283,"url":6443},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fpull\u002F5329",{"type":1283,"url":6445},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Fcommit\u002F6d07b8d17890dda58d944ac51e58f54af92d52af",{"type":1291,"url":2451},{"type":1283,"url":6448},"https:\u002F\u002Fgithub.com\u002Fpypa\u002Fsetuptools\u002Freleases\u002Ftag\u002Fv84.1.0",[2457,2458,2459,2460,4509,4510,4511,4512,4513,4514,4515,4516],{"id":303,"slug":6451,"dossier":47,"summary":6452,"aliases":6453,"sourceIds":6456,"published":6457,"modified":6458,"checkedAt":7,"severity":6459,"references":6462,"versionKeys":6475,"packageCount":32,"repositoryCount":42},"ghsa-xrqw-3rrv-vx5w-3d985837","Transformers save_pretrained path traversal allows arbitrary file writes through chat template names",[6454,6455],"CVE-2026-9856","PYSEC-2026-3929",[303,6455],"2026-08-02T18:30:20Z","2026-09-10T12:25:36.528730268Z",[6460],{"type":1318,"score":6461},"CVSS:3.0\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:H\u002FA:L",[6463,6465,6467,6469,6470,6472,6473],{"type":1286,"url":6464},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-9856",{"type":1283,"url":6466},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fpull\u002F46191",{"type":1283,"url":6468},"https:\u002F\u002Fgithub.com\u002Fhuggingface\u002Ftransformers\u002Fcommit\u002Feaaaf8494dd5386634ae37d1d122212fdc315be5",{"type":1291,"url":1475},{"type":1283,"url":6471},"https:\u002F\u002Fhuntr.com\u002Fbounties\u002F362824d5-fe18-40e8-a6cf-62277f97a170",{"type":1291,"url":1789},{"type":1286,"url":6474},"https:\u002F\u002Fgithub.com\u002Fadvisories\u002FGHSA-xrqw-3rrv-vx5w",[1482,1483,1484,1485,1486,1487,1488,1489,1490,6313],{"id":304,"slug":6477,"dossier":47,"summary":6478,"aliases":6479,"sourceIds":6482,"published":6483,"modified":6484,"checkedAt":7,"severity":6485,"references":6490,"versionKeys":6505,"packageCount":32,"repositoryCount":1306},"ghsa-xvh5-g6gv-559v-e12340aa","Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags",[6480,6481],"CVE-2026-112902","PYSEC-2026-4363",[304,6481],"2026-10-21T21:29:16Z","2026-11-11T10:20:03.066593346Z",[6486,6488],{"type":1279,"score":6487},"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:H\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N",{"type":1318,"score":6489},"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:N\u002FA:H",[6491,6493,6495,6497,6499,6501,6503,6504],{"type":1326,"url":6492},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fsecurity\u002Fadvisories\u002FGHSA-xvh5-g6gv-559v",{"type":1286,"url":6494},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-112902",{"type":1283,"url":6496},"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fadvisory-database\u002Fpull\u002F10903",{"type":1326,"url":6498},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fpull\u002F10227",{"type":1326,"url":6500},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002F570df030c0d30c2bf5336b2ab59f3902d8ab0b6d",{"type":1283,"url":6502},"https:\u002F\u002Fgithub.com\u002Fpython-pillow\u002FPillow\u002Fcommit\u002Faf56ace297b0991d02988fcc2ea933e4824b4fb3",{"type":1291,"url":1292},{"type":1286,"url":1294},[1296,1297,1298,1299,1300,1301,1302,1303,1304,1305],{"id":305,"slug":6507,"dossier":47,"summary":84,"aliases":6508,"sourceIds":6511,"published":6512,"modified":6513,"checkedAt":7,"severity":6514,"references":6516,"versionKeys":6525,"packageCount":32,"repositoryCount":500},"pysec-2025-198-62b25ed4",[6509,6510],"BIT-pytorch-2025-46148","CVE-2025-46148",[305],"2025-09-25T15:16:12.007Z","2026-05-20T09:19:19.437232Z",[6515],{"type":1318,"score":2739},[6517,6519,6521,6523],{"type":1286,"url":6518},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F4bcefba4004f8271e64b5185c95a248a",{"type":1286,"url":6520},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F65a587a579dfdff887b9b35bb79b9093",{"type":1705,"url":6522},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151198",{"type":1326,"url":6524},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F152993",[1724,1725],{"id":306,"slug":6527,"dossier":47,"summary":84,"aliases":6528,"sourceIds":6531,"published":6532,"modified":6533,"checkedAt":7,"severity":6534,"references":6536,"versionKeys":6542,"packageCount":32,"repositoryCount":32},"pysec-2025-199-c528cb5a",[6529,6530],"BIT-pytorch-2025-46149","CVE-2025-46149",[306],"2025-09-25T15:16:12.153Z","2026-05-20T09:19:19.498677Z",[6535],{"type":1318,"score":2739},[6537,6538,6540],{"type":1286,"url":6518},{"type":1705,"url":6539},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147848",{"type":1326,"url":6541},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F147961",[1725],{"id":307,"slug":6544,"dossier":47,"summary":84,"aliases":6545,"sourceIds":6548,"published":6549,"modified":6550,"checkedAt":7,"severity":6551,"references":6553,"versionKeys":6561,"packageCount":32,"repositoryCount":32},"pysec-2025-200-d11172cd",[6546,6547],"BIT-pytorch-2025-46150","CVE-2025-46150",[307],"2025-09-25T15:16:12.303Z","2026-05-20T09:19:19.559970Z",[6552],{"type":1318,"score":2739},[6554,6555,6557,6559],{"type":1286,"url":6518},{"type":1705,"url":6556},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538",{"type":1705,"url":6558},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F141538#issuecomment-2537424658",{"type":1326,"url":6560},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F144395",[1725],{"id":308,"slug":6563,"dossier":47,"summary":84,"aliases":6564,"sourceIds":6567,"published":6568,"modified":6569,"checkedAt":7,"severity":6570,"references":6572,"versionKeys":6578,"packageCount":32,"repositoryCount":32},"pysec-2025-201-c002b022",[6565,6566],"BIT-pytorch-2025-46152","CVE-2025-46152",[308],"2025-09-25T15:16:12.470Z","2026-05-20T09:19:19.618679Z",[6571],{"type":1318,"score":1502},[6573,6574,6576],{"type":1286,"url":6518},{"type":1705,"url":6575},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F143555",{"type":1326,"url":6577},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143635",[1725],{"id":309,"slug":6580,"dossier":47,"summary":84,"aliases":6581,"sourceIds":6584,"published":6585,"modified":6586,"checkedAt":7,"severity":6587,"references":6589,"versionKeys":6599,"packageCount":32,"repositoryCount":32},"pysec-2025-202-f0ff1751",[6582,6583],"BIT-pytorch-2025-46153","CVE-2025-46153",[309],"2025-09-25T15:16:12.603Z","2026-05-20T09:19:19.678555Z",[6588],{"type":1318,"score":2739},[6590,6592,6593,6595,6597],{"type":1283,"url":6591},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fcompare\u002Fv2.6.0...v2.7.0",{"type":1286,"url":6518},{"type":1286,"url":6594},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002Fe636f2e7a306105b7e96809e2b85c28a",{"type":1705,"url":6596},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F142853",{"type":1326,"url":6598},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F143460",[1725],{"id":310,"slug":6601,"dossier":47,"summary":84,"aliases":6602,"sourceIds":6605,"published":6606,"modified":6607,"checkedAt":7,"severity":6608,"references":6610,"versionKeys":6615,"packageCount":32,"repositoryCount":6616},"pysec-2025-203-2febb201",[6603,6604],"BIT-pytorch-2025-55551","CVE-2025-55551",[310],"2025-09-25T15:16:12.887Z","2026-05-20T09:19:19.739357Z",[6609],{"type":1318,"score":1402},[6611,6613],{"type":1286,"url":6612},"https:\u002F\u002Fgist.github.com\u002Fshaoyuyoung\u002F0e7d2a586297ae9c8ed14d8706749efc",{"type":1705,"url":6614},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151401",[1724,1725,1726,2672,2673,2674],9,{"id":311,"slug":6618,"dossier":47,"summary":84,"aliases":6619,"sourceIds":6622,"published":6623,"modified":6624,"checkedAt":7,"severity":6625,"references":6627,"versionKeys":6631,"packageCount":32,"repositoryCount":6616},"pysec-2025-204-cdae47da",[6620,6621],"BIT-pytorch-2025-55552","CVE-2025-55552",[311],"2025-09-25T16:15:34.320Z","2026-05-20T09:19:19.802802Z",[6626],{"type":1318,"score":1402},[6628,6629],{"type":1286,"url":6612},{"type":1705,"url":6630},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F147847",[1724,1725,1726,2672,2673,2674],{"id":312,"slug":6633,"dossier":47,"summary":84,"aliases":6634,"sourceIds":6637,"published":6638,"modified":6639,"checkedAt":7,"severity":6640,"references":6642,"versionKeys":6648,"packageCount":32,"repositoryCount":490},"pysec-2025-205-fd5e58fd",[6635,6636],"BIT-pytorch-2025-55553","CVE-2025-55553",[312],"2025-09-25T16:15:34.460Z","2026-05-20T09:19:19.866970Z",[6641],{"type":1318,"score":1402},[6643,6644,6646],{"type":1286,"url":6612},{"type":1705,"url":6645},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151432",{"type":1326,"url":6647},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F154645",[1724,1725,1726],{"id":313,"slug":6650,"dossier":47,"summary":84,"aliases":6651,"sourceIds":6654,"published":6655,"modified":6656,"checkedAt":7,"severity":6657,"references":6659,"versionKeys":6663,"packageCount":32,"repositoryCount":6616},"pysec-2025-206-58322476",[6652,6653],"BIT-pytorch-2025-55554","CVE-2025-55554",[313],"2025-09-25T16:15:34.593Z","2026-05-20T09:19:19.928295Z",[6658],{"type":1318,"score":1502},[6660,6661],{"type":1286,"url":6612},{"type":1705,"url":6662},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151510",[1724,1725,1726,2672,2673,2674],{"id":314,"slug":6665,"dossier":47,"summary":84,"aliases":6666,"sourceIds":6669,"published":6670,"modified":6671,"checkedAt":7,"severity":6672,"references":6674,"versionKeys":6680,"packageCount":32,"repositoryCount":490},"pysec-2025-207-2abef3fc",[6667,6668],"BIT-pytorch-2025-55557","CVE-2025-55557",[314],"2025-09-25T16:15:34.833Z","2026-05-20T09:19:19.989717Z",[6673],{"type":1318,"score":1402},[6675,6676,6678],{"type":1286,"url":6612},{"type":1705,"url":6677},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151738",{"type":1326,"url":6679},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151931",[1724,1725,1726],{"id":315,"slug":6682,"dossier":47,"summary":84,"aliases":6683,"sourceIds":6686,"published":6687,"modified":6688,"checkedAt":7,"severity":6689,"references":6691,"versionKeys":6697,"packageCount":32,"repositoryCount":490},"pysec-2025-208-6e93fe9d",[6684,6685],"BIT-pytorch-2025-55558","CVE-2025-55558",[315],"2025-09-25T16:15:34.960Z","2026-05-20T09:19:20.054109Z",[6690],{"type":1318,"score":1402},[6692,6693,6695],{"type":1286,"url":6612},{"type":1705,"url":6694},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151523",{"type":1326,"url":6696},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151887",[1724,1725,1726],{"id":316,"slug":6699,"dossier":47,"summary":84,"aliases":6700,"sourceIds":6703,"published":6704,"modified":6705,"checkedAt":7,"severity":6706,"references":6708,"versionKeys":6714,"packageCount":32,"repositoryCount":490},"pysec-2025-209-e6f352b0",[6701,6702],"BIT-pytorch-2025-55560","CVE-2025-55560",[316],"2025-09-25T16:15:35.197Z","2026-05-20T09:19:20.117285Z",[6707],{"type":1318,"score":1402},[6709,6710,6712],{"type":1286,"url":6612},{"type":1705,"url":6711},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fissues\u002F151522",{"type":1326,"url":6713},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F151897",[1724,1725,1726],{"id":317,"slug":6716,"dossier":47,"summary":84,"aliases":6717,"sourceIds":6719,"published":6720,"modified":6721,"checkedAt":7,"severity":6722,"references":6724,"versionKeys":6727,"packageCount":32,"repositoryCount":2312},"pysec-2025-211-d8bd15de",[6718],"CVE-2025-14920",[317],"2025-12-23T21:15:47.183Z","2026-05-21T15:00:32.080516132Z",[6723],{"type":1318,"score":1468},[6725],{"type":1286,"url":6726},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1150\u002F",[1482,1483,1484,1485,1486],{"id":318,"slug":6729,"dossier":47,"summary":84,"aliases":6730,"sourceIds":6732,"published":6733,"modified":6734,"checkedAt":7,"severity":6735,"references":6737,"versionKeys":6740,"packageCount":32,"repositoryCount":2312},"pysec-2025-212-a011b97d",[6731],"CVE-2025-14921",[318],"2025-12-23T21:15:47.340Z","2026-05-21T15:00:32.052313357Z",[6736],{"type":1318,"score":1468},[6738],{"type":1286,"url":6739},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1149\u002F",[1482,1483,1484,1485,1486],{"id":319,"slug":6742,"dossier":47,"summary":84,"aliases":6743,"sourceIds":6745,"published":6746,"modified":6747,"checkedAt":7,"severity":6748,"references":6750,"versionKeys":6753,"packageCount":32,"repositoryCount":2312},"pysec-2025-213-9043dc9b",[6744],"CVE-2025-14924",[319],"2025-12-23T21:15:47.600Z","2026-05-21T15:00:32.048516839Z",[6749],{"type":1318,"score":1468},[6751],{"type":1286,"url":6752},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1141\u002F",[1482,1483,1484,1485,1486],{"id":320,"slug":6755,"dossier":47,"summary":84,"aliases":6756,"sourceIds":6758,"published":6759,"modified":6760,"checkedAt":7,"severity":6761,"references":6763,"versionKeys":6766,"packageCount":32,"repositoryCount":2312},"pysec-2025-214-eb241255",[6757],"CVE-2025-14926",[320],"2025-12-23T21:15:47.857Z","2026-05-21T15:00:32.929011749Z",[6762],{"type":1318,"score":1468},[6764],{"type":1286,"url":6765},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1147\u002F",[1482,1483,1484,1485,1486],{"id":321,"slug":6768,"dossier":47,"summary":84,"aliases":6769,"sourceIds":6771,"published":6772,"modified":6773,"checkedAt":7,"severity":6774,"references":6776,"versionKeys":6779,"packageCount":32,"repositoryCount":2312},"pysec-2025-215-6064f491",[6770],"CVE-2025-14927",[321],"2025-12-23T21:15:47.987Z","2026-05-21T15:00:32.888290877Z",[6775],{"type":1318,"score":1468},[6777],{"type":1286,"url":6778},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1148\u002F",[1482,1483,1484,1485,1486],{"id":322,"slug":6781,"dossier":47,"summary":84,"aliases":6782,"sourceIds":6784,"published":6785,"modified":6786,"checkedAt":7,"severity":6787,"references":6789,"versionKeys":6792,"packageCount":32,"repositoryCount":2312},"pysec-2025-216-5708ed01",[6783],"CVE-2025-14928",[322],"2025-12-23T21:15:48.110Z","2026-05-21T15:00:32.939311939Z",[6788],{"type":1318,"score":1468},[6790],{"type":1286,"url":6791},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1146\u002F",[1482,1483,1484,1485,1486],{"id":323,"slug":6794,"dossier":47,"summary":84,"aliases":6795,"sourceIds":6797,"published":6798,"modified":6799,"checkedAt":7,"severity":6800,"references":6802,"versionKeys":6805,"packageCount":32,"repositoryCount":66},"pysec-2025-217-2c1ad388",[6796],"CVE-2025-14929",[323],"2025-12-23T21:15:48.240Z","2026-05-21T15:00:24.271970226Z",[6801],{"type":1318,"score":1468},[6803],{"type":1286,"url":6804},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1144\u002F",[1482,1483,1484,1485,1486,1487,1488,1489,1490],{"id":324,"slug":6807,"dossier":47,"summary":84,"aliases":6808,"sourceIds":6810,"published":6811,"modified":6812,"checkedAt":7,"severity":6813,"references":6815,"versionKeys":6818,"packageCount":32,"repositoryCount":452},"pysec-2025-218-39811fc3",[6809],"CVE-2025-14930",[324],"2025-12-23T21:15:48.367Z","2026-05-21T15:00:33.791364554Z",[6814],{"type":1318,"score":1468},[6816],{"type":1286,"url":6817},"https:\u002F\u002Fwww.zerodayinitiative.com\u002Fadvisories\u002FZDI-25-1145\u002F",[1482,1483,1484,1485,1486,1487],{"id":325,"slug":6820,"dossier":47,"summary":84,"aliases":6821,"sourceIds":6824,"published":6825,"modified":6826,"checkedAt":7,"severity":6827,"references":6829,"versionKeys":6840,"packageCount":32,"repositoryCount":1456},"pysec-2026-139-96951ff6",[6822,6823],"BIT-pytorch-2026-4538","CVE-2026-4538",[325],"2026-03-22T05:16:20.273Z","2026-05-21T15:00:31.962442644Z",[6828],{"type":1318,"score":5431},[6830,6832,6834,6836,6838],{"type":1283,"url":6831},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002F",{"type":1286,"url":6833},"https:\u002F\u002Fvuldb.com\u002F?id.352326",{"type":1286,"url":6835},"https:\u002F\u002Fvuldb.com\u002F?submit.774681",{"type":1705,"url":6837},"https:\u002F\u002Fvuldb.com\u002F?ctiid.352326",{"type":1326,"url":6839},"https:\u002F\u002Fgithub.com\u002Fpytorch\u002Fpytorch\u002Fpull\u002F176791",[5762,1724,1725,1726,2672,2673,2674,2675,2676,2677,2678],1794732143441]