{ "history": [ { "added": 0, "commit": "9504d068f8411b04a0ad67099d0d302242ba7d43", "date": "2026-11-01", "dependencies": 133, "errors": [], "fixable": 89, "go_version": null, "in_binary": null, "new_vulnerabilities": 0, "osv_confirmed": 59, "osv_only": 48, "ref": "3.4.0", "release_changed": false, "release_integrity": "none", "removed": 0, "resolved_vulnerabilities": 0, "scorecard": null, "upgraded": 0, "vulnerabilities": { "Critical": 3, "High": 49, "Low": 6, "Medium": 32, "Negligible": 0, "Unknown": 0 }, "workflow": { "High": 10, "Low": 3, "Medium": 4, "files": 10 } }, { "added": 0, "commit": "9504d068f8411b04a0ad67099d0d302242ba7d43", "date": "2026-11-02", "dependencies": 133, "errors": [], "fixable": 85, "go_version": null, "in_binary": null, "kev": 0, "kev_new": 0, "new_vulnerabilities": 0, "osv_confirmed": 49, "osv_only": 71, "ref": "3.4.0", "release_changed": false, "release_integrity": "none", "removed": 0, "resolved_vulnerabilities": 4, "scorecard": null, "scorecard_date": null, "scorecard_note": "the OpenSSF public dataset entry is 1435 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "scorecard_source": null, "upgraded": 0, "vulnerabilities": { "Critical": 2, "High": 47, "Low": 5, "Medium": 32, "Negligible": 0, "Unknown": 0 }, "vulnerable_packages": 11, "workflow": { "High": 10, "Low": 3, "Medium": 4, "files": 10 } } ], "latest": { "archived": false, "category": "Infrastructure as Code Security", "changes": { "added": [], "any": true, "baseline": false, "integrity_drift": 0, "license_changes": [], "new_vulnerabilities": [], "previous_ref": "3.4.0", "release_changed": false, "removed": [], "resolved_vulnerabilities": [ { "aliases": [], "ecosystem": "github", "fix_state": "fixed", "fixed_in": [ "1.14.3" ], "id": "GHSA-5xjx-3w67-w9x9", "location": ".github/workflows/build.yml", "osv_confirmed": false, "package": "pypa/gh-action-pypi-publish", "severity": "Critical", "url": "https://github.com/advisories/GHSA-5xjx-3w67-w9x9", "version": "v1" }, { "aliases": [ "CVE-2023-52137" ], "ecosystem": "github", "fix_state": "fixed", "fixed_in": [ "17" ], "id": "GHSA-ghm2-rq8q-wrhc", "location": ".github/workflows/codeql-analysis.yml", "osv_confirmed": false, "package": "tj-actions/verify-changed-files", "severity": "High", "url": "https://github.com/advisories/GHSA-ghm2-rq8q-wrhc", "version": "v13" }, { "aliases": [ "CVE-2025-30066" ], "ecosystem": "github", "fix_state": "fixed", "fixed_in": [ "46.0.1" ], "id": "GHSA-mrrh-fwg8-r2c3", "location": ".github/workflows/pr-test.yml", "osv_confirmed": false, "package": "tj-actions/changed-files", "severity": "High", "url": "https://github.com/advisories/GHSA-mrrh-fwg8-r2c3", "version": "v44" }, { "aliases": [], "ecosystem": "github", "fix_state": "fixed", "fixed_in": [ "1.13.0" ], "id": "GHSA-vxmw-7h4f-hqxh", "location": ".github/workflows/build.yml", "osv_confirmed": false, "package": "pypa/gh-action-pypi-publish", "severity": "Low", "url": "https://github.com/advisories/GHSA-vxmw-7h4f-hqxh", "version": "v1" } ], "upgraded": [], "workflow_new": 0, "workflow_resolved": 0 }, "commit": "9504d068f8411b04a0ad67099d0d302242ba7d43", "compliance": { "overall_score": 55, "standards": { "bsi_tr03183": { "failed_checks": [ "Component Creator", "Distribution Licences", "SHA-512 Hash", "Dependency Relationship", "SBOM Creator Contact" ], "passed": 4, "score": 44, "total": 9 }, "cisa": { "failed_checks": [ "Software Producer", "Dependency Relationship", "License Information", "Component Hash", "SBOM Author" ], "passed": 5, "score": 50, "total": 10 }, "ntia": { "failed_checks": [ "Supplier Name", "Dependency Relationship" ], "passed": 5, "score": 71, "total": 7 } } }, "components": [ { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/checkout", "purl": "pkg:github/actions/checkout@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/jekyll-gh-pages.yml", "name": "actions/configure-pages", "purl": "pkg:github/actions/configure-pages@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/jekyll-gh-pages.yml", "name": "actions/deploy-pages", "purl": "pkg:github/actions/deploy-pages@v2", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/jekyll-gh-pages.yml", "name": "actions/jekyll-build-pages", "purl": "pkg:github/actions/jekyll-build-pages@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-test.yml", "name": "actions/setup-node", "purl": "pkg:github/actions/setup-node@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "actions/setup-python", "purl": "pkg:github/actions/setup-python@v4", "version": "v4" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/jekyll-gh-pages.yml", "name": "actions/upload-pages-artifact", "purl": "pkg:github/actions/upload-pages-artifact@v2", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/nightly.yml", "name": "actions/upload-release-asset", "purl": "pkg:github/actions/upload-release-asset@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "azure/setup-helm", "purl": "pkg:github/azure/setup-helm@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/security-shared.yml", "name": "bridgecrewio/checkov-action", "purl": "pkg:github/bridgecrewio/checkov-action@master", "version": "master" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-test.yml", "name": "bridgecrewio/gha-reusable-workflows/.github/workflows/mypy.yaml", "purl": "pkg:github/bridgecrewio/gha-reusable-workflows@main#.github/workflows/mypy.yaml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-test.yml", "name": "bridgecrewio/gha-reusable-workflows/.github/workflows/pre-commit.yaml", "purl": "pkg:github/bridgecrewio/gha-reusable-workflows@main#.github/workflows/pre-commit.yaml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "bridgecrewio/gha-reusable-workflows/.github/workflows/publish-image.yaml", "purl": "pkg:github/bridgecrewio/gha-reusable-workflows@main#.github/workflows/publish-image.yaml", "version": "main" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "crazy-max/ghaction-import-gpg", "purl": "pkg:github/crazy-max/ghaction-import-gpg@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/security-shared.yml", "name": "edplato/trufflehog-actions-scan", "purl": "pkg:github/edplato/trufflehog-actions-scan@v0.9", "version": "v0.9" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/analyze", "purl": "pkg:github/github/codeql-action@v2#analyze", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/autobuild", "purl": "pkg:github/github/codeql-action@v2#autobuild", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "github/codeql-action/init", "purl": "pkg:github/github/codeql-action@v2#init", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "imranismail/setup-kustomize", "purl": "pkg:github/imranismail/setup-kustomize@v2", "version": "v2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/security-shared.yml", "name": "jpetrucciani/bandit-check", "purl": "pkg:github/jpetrucciani/bandit-check@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/nightly.yml", "name": "mikepenz/release-changelog-builder-action", "purl": "pkg:github/mikepenz/release-changelog-builder-action@v3", "version": "v3" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pipenv-update.yml", "name": "peter-evans/create-pull-request", "purl": "pkg:github/peter-evans/create-pull-request@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/build.yml", "name": "pypa/gh-action-pypi-publish", "purl": "pkg:github/pypa/gh-action-pypi-publish@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/nightly.yml", "name": "softprops/action-gh-release", "purl": "pkg:github/softprops/action-gh-release@v2.2.2", "version": "v2.2.2" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/nightly.yml", "name": "stefanzweifel/changelog-updater-action", "purl": "pkg:github/stefanzweifel/changelog-updater-action@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/nightly.yml", "name": "stefanzweifel/git-auto-commit-action", "purl": "pkg:github/stefanzweifel/git-auto-commit-action@v5", "version": "v5" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-title.yml", "name": "thehanimo/pr-title-checker", "purl": "pkg:github/thehanimo/pr-title-checker@v1", "version": "v1" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/pr-test.yml", "name": "tj-actions/changed-files", "purl": "pkg:github/tj-actions/changed-files@v44", "version": "v44" }, { "ecosystem": "github", "licenses": [], "location": ".github/workflows/codeql-analysis.yml", "name": "tj-actions/verify-changed-files", "purl": "pkg:github/tj-actions/verify-changed-files@v13", "version": "v13" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "aiodns", "purl": "pkg:pypi/aiodns@3.6.1", "version": "3.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "aiohappyeyeballs", "purl": "pkg:pypi/aiohappyeyeballs@2.6.1", "version": "2.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "aiohttp", "purl": "pkg:pypi/aiohttp@3.13.5", "version": "3.13.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "aiomultiprocess", "purl": "pkg:pypi/aiomultiprocess@0.9.1", "version": "0.9.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "aiosignal", "purl": "pkg:pypi/aiosignal@1.4.0", "version": "1.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "annotated-types", "purl": "pkg:pypi/annotated-types@0.7.0", "version": "0.7.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "argcomplete", "purl": "pkg:pypi/argcomplete@3.7.0", "version": "3.7.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "asteval", "purl": "pkg:pypi/asteval@1.0.6", "version": "1.0.6" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "async-timeout", "purl": "pkg:pypi/async-timeout@5.0.1", "version": "5.0.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "attrs", "purl": "pkg:pypi/attrs@26.1.0", "version": "26.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "bc-detect-secrets", "purl": "pkg:pypi/bc-detect-secrets@1.5.50", "version": "1.5.50" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "bc-jsonpath-ng", "purl": "pkg:pypi/bc-jsonpath-ng@1.6.1", "version": "1.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "bc-python-hcl2", "purl": "pkg:pypi/bc-python-hcl2@0.4.3", "version": "0.4.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "beartype", "purl": "pkg:pypi/beartype@0.22.2", "version": "0.22.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "beautifulsoup4", "purl": "pkg:pypi/beautifulsoup4@4.15.0", "version": "4.15.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "boolean-py", "purl": "pkg:pypi/boolean-py@5.0", "version": "5.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "boto3", "purl": "pkg:pypi/boto3@1.35.49", "version": "1.35.49" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "botocore", "purl": "pkg:pypi/botocore@1.35.99", "version": "1.35.99" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "cached-property", "purl": "pkg:pypi/cached-property@2.0.1", "version": "2.0.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "cachetools", "purl": "pkg:pypi/cachetools@5.5.2", "version": "5.5.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "certifi", "purl": "pkg:pypi/certifi@2026.7.22", "version": "2026.7.22" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "cffi", "purl": "pkg:pypi/cffi@2.0.0", "version": "2.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "charset-normalizer", "purl": "pkg:pypi/charset-normalizer@3.5.1", "version": "3.5.1" }, { "ecosystem": "pypi", "licenses": [], "location": "kubernetes/requirements.txt", "name": "checkov", "purl": "pkg:pypi/checkov@3.4.0", "version": "3.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "click", "purl": "pkg:pypi/click@8.1.8", "version": "8.1.8" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "click-option-group", "purl": "pkg:pypi/click-option-group@0.5.9", "version": "0.5.9" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "cloudsplaining", "purl": "pkg:pypi/cloudsplaining@0.7.0", "version": "0.7.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "colorama", "purl": "pkg:pypi/colorama@0.4.6", "version": "0.4.6" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "configargparse", "purl": "pkg:pypi/configargparse@1.7.5", "version": "1.7.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "contextlib2", "purl": "pkg:pypi/contextlib2@21.6.0", "version": "21.6.0" }, { "ecosystem": "pypi", "licenses": [], "location": "setup.py", "name": "coverage", "purl": "pkg:pypi/coverage@7.6.1", "version": "7.6.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "cyclonedx-python-lib", "purl": "pkg:pypi/cyclonedx-python-lib@7.6.2", "version": "7.6.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "decorator", "purl": "pkg:pypi/decorator@5.3.1", "version": "5.3.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "defusedxml", "purl": "pkg:pypi/defusedxml@0.7.1", "version": "0.7.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "docker", "purl": "pkg:pypi/docker@7.2.0", "version": "7.2.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "dockerfile-parse", "purl": "pkg:pypi/dockerfile-parse@2.0.1", "version": "2.0.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "dpath", "purl": "pkg:pypi/dpath@2.1.3", "version": "2.1.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "ecdsa", "purl": "pkg:pypi/ecdsa@0.19.2", "version": "0.19.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "frozenlist", "purl": "pkg:pypi/frozenlist@1.8.0", "version": "1.8.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "gitdb", "purl": "pkg:pypi/gitdb@4.0.12", "version": "4.0.12" }, { "ecosystem": "pypi", "licenses": [], "location": "setup.py", "name": "gitpython", "purl": "pkg:pypi/gitpython@3.1.41", "version": "3.1.41" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "gitpython", "purl": "pkg:pypi/gitpython@3.1.59", "version": "3.1.59" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "idna", "purl": "pkg:pypi/idna@3.19", "version": "3.19" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "importlib-metadata", "purl": "pkg:pypi/importlib-metadata@7.2.1", "version": "7.2.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "isodate", "purl": "pkg:pypi/isodate@0.7.2", "version": "0.7.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "jinja2", "purl": "pkg:pypi/jinja2@3.1.6", "version": "3.1.6" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "jmespath", "purl": "pkg:pypi/jmespath@1.1.0", "version": "1.1.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "jsonschema", "purl": "pkg:pypi/jsonschema@4.25.1", "version": "4.25.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "jsonschema-specifications", "purl": "pkg:pypi/jsonschema-specifications@2025.9.1", "version": "2025.9.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "junit-xml", "purl": "pkg:pypi/junit-xml@1.9", "version": "1.9" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "lark", "purl": "pkg:pypi/lark@1.3.1", "version": "1.3.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "license-expression", "purl": "pkg:pypi/license-expression@30.4.4", "version": "30.4.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "markdown", "purl": "pkg:pypi/markdown@3.9", "version": "3.9" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "markupsafe", "purl": "pkg:pypi/markupsafe@3.0.3", "version": "3.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "multidict", "purl": "pkg:pypi/multidict@6.7.1", "version": "6.7.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "networkx", "purl": "pkg:pypi/networkx@2.6.3", "version": "2.6.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "numpy", "purl": "pkg:pypi/numpy@2.0.2", "version": "2.0.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "orjson", "purl": "pkg:pypi/orjson@3.11.5", "version": "3.11.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "packageurl-python", "purl": "pkg:pypi/packageurl-python@0.13.4", "version": "0.13.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "packaging", "purl": "pkg:pypi/packaging@23.2", "version": "23.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "platformdirs", "purl": "pkg:pypi/platformdirs@4.4.0", "version": "4.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "ply", "purl": "pkg:pypi/ply@3.11", "version": "3.11" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "policy-sentry", "purl": "pkg:pypi/policy-sentry@0.13.2", "version": "0.13.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "prettytable", "purl": "pkg:pypi/prettytable@3.16.0", "version": "3.16.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "propcache", "purl": "pkg:pypi/propcache@0.4.1", "version": "0.4.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "py-serializable", "purl": "pkg:pypi/py-serializable@1.1.2", "version": "1.1.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pycares", "purl": "pkg:pypi/pycares@4.11.0", "version": "4.11.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pycep-parser", "purl": "pkg:pypi/pycep-parser@0.5.1", "version": "0.5.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pycparser", "purl": "pkg:pypi/pycparser@2.23", "version": "2.23" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pydantic", "purl": "pkg:pypi/pydantic@2.13.4", "version": "2.13.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pydantic-core", "purl": "pkg:pypi/pydantic-core@2.46.4", "version": "2.46.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pyparsing", "purl": "pkg:pypi/pyparsing@3.3.2", "version": "3.3.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pyston", "purl": "pkg:pypi/pyston@2.3.5", "version": "2.3.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pyston-autoload", "purl": "pkg:pypi/pyston-autoload@2.3.5", "version": "2.3.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "python-dateutil", "purl": "pkg:pypi/python-dateutil@2.9.0.post0", "version": "2.9.0.post0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "pyyaml", "purl": "pkg:pypi/pyyaml@6.0.3", "version": "6.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "rdflib", "purl": "pkg:pypi/rdflib@7.6.0", "version": "7.6.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "referencing", "purl": "pkg:pypi/referencing@0.36.2", "version": "0.36.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "regex", "purl": "pkg:pypi/regex@2026.1.15", "version": "2026.1.15" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "requests", "purl": "pkg:pypi/requests@2.32.5", "version": "2.32.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "rpds-py", "purl": "pkg:pypi/rpds-py@0.27.1", "version": "0.27.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "rustworkx", "purl": "pkg:pypi/rustworkx@0.17.1", "version": "0.17.1" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "s3transfer", "purl": "pkg:pypi/s3transfer@0.10.4", "version": "0.10.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "schema", "purl": "pkg:pypi/schema@0.7.5", "version": "0.7.5" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "semantic-version", "purl": "pkg:pypi/semantic-version@2.10.0", "version": "2.10.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "six", "purl": "pkg:pypi/six@1.17.0", "version": "1.17.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "smmap", "purl": "pkg:pypi/smmap@5.0.3", "version": "5.0.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "sortedcontainers", "purl": "pkg:pypi/sortedcontainers@2.4.0", "version": "2.4.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "soupsieve", "purl": "pkg:pypi/soupsieve@2.8.4", "version": "2.8.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "spdx-tools", "purl": "pkg:pypi/spdx-tools@0.8.3", "version": "0.8.3" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "tabulate", "purl": "pkg:pypi/tabulate@0.9.0", "version": "0.9.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "termcolor", "purl": "pkg:pypi/termcolor@2.3.0", "version": "2.3.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "tqdm", "purl": "pkg:pypi/tqdm@4.70.0", "version": "4.70.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "typing-extensions", "purl": "pkg:pypi/typing-extensions@4.16.0", "version": "4.16.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "typing-inspection", "purl": "pkg:pypi/typing-inspection@0.4.2", "version": "0.4.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "unidiff", "purl": "pkg:pypi/unidiff@1.0.0", "version": "1.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "uritools", "purl": "pkg:pypi/uritools@5.0.0", "version": "5.0.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "urllib3", "purl": "pkg:pypi/urllib3@1.26.20", "version": "1.26.20" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "wcwidth", "purl": "pkg:pypi/wcwidth@0.8.2", "version": "0.8.2" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "xmltodict", "purl": "pkg:pypi/xmltodict@1.0.4", "version": "1.0.4" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "yarl", "purl": "pkg:pypi/yarl@1.22.0", "version": "1.22.0" }, { "ecosystem": "pypi", "licenses": [], "location": "Pipfile.lock", "name": "zipp", "purl": "pkg:pypi/zipp@3.23.1", "version": "3.23.1" }, { "ecosystem": "unknown", "licenses": [], "location": ".github/workflows/build.yml", "name": "./.github/workflows/security-shared.yml", "purl": "", "version": "UNKNOWN" } ], "description": "Scan cloud infrastructure configurations", "errors": [], "excluded_matches": { "action reference to a moving tag or branch": 4 }, "id": "bridgecrewio__checkov", "manifests": [ ".github/workflows/build.yml", ".github/workflows/codeql-analysis.yml", ".github/workflows/coverage.yaml", ".github/workflows/jekyll-gh-pages.yml", ".github/workflows/nightly.yml", ".github/workflows/pipenv-update.yml", ".github/workflows/pr-test.yml", ".github/workflows/pr-title.yml", ".github/workflows/security-shared.yml", ".github/workflows/security.yml", "Pipfile", "Pipfile.lock", "kubernetes/requirements.txt", "pyproject.toml", "setup.py" ], "name": "checkov", "osv": { "advisories": 131, "available": true, "confirmed": 49, "osv_only": [ { "ecosystem": "PyPI", "ids": [ "CVE-2026-22701", "GHSA-qmgc-5h2g-mvrw", "PYSEC-2026-1374" ], "package": "filelock", "score": "5.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-68146", "GHSA-w853-jp5j-5j7f", "PYSEC-2026-1375" ], "package": "filelock", "score": "6.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-112909", "GHSA-69hj-f68j-2879" ], "package": "filelock", "score": "6.1", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-112910", "GHSA-8mx5-7m5m-r77g" ], "package": "filelock", "score": "5.3", "severity": "Medium", "version": "3.19.1" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-71176", "GHSA-6w46-j5rx-g56g", "PYSEC-2026-1845" ], "package": "pytest", "score": "6.8", "severity": "Medium", "version": "7.4.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-setuptools-2026-59890", "CVE-2026-59890", "GHSA-h35f-9h28-mq5c", "PYSEC-2026-3447" ], "package": "setuptools", "score": "6.1", "severity": "Medium", "version": "78.1.1" }, { "ecosystem": "PyPI", "ids": [ "GHSA-xmj3-9gf7-h52w" ], "package": "setuptools", "score": "1.0", "severity": "Low", "version": "78.1.1" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-102930", "CVE-2026-102930", "GHSA-94p9-xgh2-xp45", "PYSEC-2026-4011" ], "package": "virtualenv", "score": "7.7", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-102938", "CVE-2026-102938", "GHSA-9h9j-4vrj-gf7g", "PYSEC-2026-4012" ], "package": "virtualenv", "score": "5.8", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-102925", "CVE-2026-102925", "GHSA-p58f-9548-mpm2", "PYSEC-2026-4013" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-102937", "CVE-2026-102937", "GHSA-x78j-v8h9-3j2q", "PYSEC-2026-4014" ], "package": "virtualenv", "score": "7.3", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113718", "CVE-2026-113718", "GHSA-394h-qwmc-48pf" ], "package": "virtualenv", "score": "7.1", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113724", "CVE-2026-113724", "GHSA-43mp-35q3-x3fq" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113714", "CVE-2026-113714", "GHSA-494p-63j8-28p3" ], "package": "virtualenv", "score": "2.3", "severity": "Low", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113721", "CVE-2026-113721", "GHSA-558c-9hv2-4prj" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113726", "CVE-2026-113726", "GHSA-5vjq-rrrf-7h2q" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113723", "CVE-2026-113723", "GHSA-6w3r-xr62-4xcp" ], "package": "virtualenv", "score": "7.1", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113776", "CVE-2026-113776", "GHSA-8rjx-v5ww-45pp" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113732", "CVE-2026-113732", "GHSA-c947-3pg5-gm8q" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113722", "CVE-2026-113722", "GHSA-c978-59m8-c77v" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113716", "CVE-2026-113716", "GHSA-cw65-gx24-rc82" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113717", "CVE-2026-113717", "GHSA-cx28-75q4-x26q" ], "package": "virtualenv", "score": "2.3", "severity": "Low", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113720", "CVE-2026-113720", "GHSA-fc2g-4w5p-6whm" ], "package": "virtualenv", "score": "4.4", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113719", "CVE-2026-113719", "GHSA-hhxq-47xx-j5xx" ], "package": "virtualenv", "score": "4.5", "severity": "Medium", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113715", "CVE-2026-113715", "GHSA-qmx5-4p3x-wvqf" ], "package": "virtualenv", "score": "2.0", "severity": "Low", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "BIT-virtualenv-2026-113725", "CVE-2026-113725", "GHSA-vxj4-q4g9-crj7" ], "package": "virtualenv", "score": "7.8", "severity": "High", "version": "21.7.4" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69226", "GHSA-54jq-c3m8-4m76", "PYSEC-2026-1097" ], "package": "aiohttp", "score": "2.7", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69224", "GHSA-69f9-5gxw-wvc2", "PYSEC-2026-1099" ], "package": "aiohttp", "score": "2.7", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69228", "GHSA-6jhg-hg63-jvvf", "PYSEC-2026-1100" ], "package": "aiohttp", "score": "6.6", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69223", "GHSA-6mq8-rvhq-8wgg", "PYSEC-2026-1101" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2024-52304", "GHSA-8495-4g3g-x7pr", "PYSEC-2026-1103" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-53643", "GHSA-9548-qrrj-x5pj", "PYSEC-2026-1104" ], "package": "aiohttp", "score": "1.7", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69230", "GHSA-fh55-r93g-j68g", "PYSEC-2026-1105" ], "package": "aiohttp", "score": "2.7", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69229", "GHSA-g84x-mcqj-x9qq", "PYSEC-2026-1106" ], "package": "aiohttp", "score": "6.6", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69227", "GHSA-jj3x-wxrx-4x23", "PYSEC-2026-1107" ], "package": "aiohttp", "score": "6.6", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-69225", "GHSA-mqqc-3gqh-h2x8", "PYSEC-2026-1109" ], "package": "aiohttp", "score": "2.7", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-22815", "GHSA-w2fm-2cpv-w7v5", "PYSEC-2026-2094" ], "package": "aiohttp", "score": "6.9", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34513", "GHSA-hcc4-c3v8-rx92", "PYSEC-2026-2095" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34514", "GHSA-2vrm-gr82-f7m5", "PYSEC-2026-2096" ], "package": "aiohttp", "score": "5.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34515", "GHSA-p998-jp59-783m", "PYSEC-2026-2097" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34516", "GHSA-m5qp-6w8w-w647", "PYSEC-2026-2098" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34517", "GHSA-3wq7-rqq7-wx6j", "PYSEC-2026-2099" ], "package": "aiohttp", "score": "5.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34518", "GHSA-966j-vmvw-g2g9", "PYSEC-2026-2100" ], "package": "aiohttp", "score": "5.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34519", "GHSA-mwh4-6h8g-pg8w", "PYSEC-2026-2101" ], "package": "aiohttp", "score": "5.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34520", "GHSA-63hf-3vf5-4wqf", "PYSEC-2026-2102" ], "package": "aiohttp", "score": "9.1", "severity": "Critical", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34525", "GHSA-c427-h43c-vf67", "PYSEC-2026-2103" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-34993", "GHSA-jg22-mg44-37j8", "PYSEC-2026-2104" ], "package": "aiohttp", "score": "7.3", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-47265", "GHSA-hg6j-4rv6-33pg", "PYSEC-2026-2105" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-50269", "GHSA-m6qw-4cw2-hm4m", "PYSEC-2026-2106" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54273", "GHSA-4fvr-rgm6-gqmc", "PYSEC-2026-2107" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54274", "GHSA-xcgm-r5h9-7989", "PYSEC-2026-2108" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54276", "GHSA-hpj7-wq8m-9hgp", "PYSEC-2026-2109" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54277", "GHSA-63hw-fmq6-xxg2", "PYSEC-2026-2110" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54278", "GHSA-g3cq-j2xw-wf74", "PYSEC-2026-2111" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54279", "GHSA-2fqr-mr3j-6wp8", "PYSEC-2026-2112" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54280", "GHSA-9x8q-7h8h-wcw9", "PYSEC-2026-2113" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-54275", "GHSA-4m7w-qmgq-4wj5", "PYSEC-2026-237" ], "package": "aiohttp", "score": "7.5", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-69244", "GHSA-cq5v-8q36-5273", "PYSEC-2026-3545" ], "package": "aiohttp", "score": "7.1", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-69243", "GHSA-mfx4-hv73-q22v", "PYSEC-2026-3546" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-59881", "GHSA-mq44-7p77-q5h7", "PYSEC-2026-3547" ], "package": "aiohttp", "score": "6.9", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "GHSA-2g87-pp6c-29x5" ], "package": "aiohttp", "score": "8.7", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111063", "GHSA-494j-54xm-rwp3" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111064", "GHSA-5wr8-gcqf-gqf3" ], "package": "aiohttp", "score": "8.2", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111065", "GHSA-6cjc-53gc-5rqm" ], "package": "aiohttp", "score": "6.9", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111066", "GHSA-9xw5-w5jj-pvcg" ], "package": "aiohttp", "score": "8.2", "severity": "High", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111748", "GHSA-f9xw-jh8m-3mwq" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111749", "GHSA-gx76-c99x-2c96" ], "package": "aiohttp", "score": "2.3", "severity": "Low", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-111750", "GHSA-pqxq-w44r-73xw" ], "package": "aiohttp", "score": "6.3", "severity": "Medium", "version": "3.9.5" }, { "ecosystem": "PyPI", "ids": [ "CVE-2026-45409", "GHSA-65pc-fj4g-8rjx", "PYSEC-2026-215" ], "package": "idna", "score": "6.9", "severity": "Medium", "version": "3.9.0" }, { "ecosystem": "PyPI", "ids": [ "CVE-2024-27454", "GHSA-pwr2-4v36-6qpr", "PYSEC-2024-40" ], "package": "orjson", "score": "7.5", "severity": "High", "version": "3.9.9" }, { "ecosystem": "PyPI", "ids": [ "CVE-2025-67221", "GHSA-hx9q-6w63-j58v", "PYSEC-2026-107" ], "package": "orjson", "score": "7.7", "severity": "High", "version": "3.9.9" } ], "warning": null }, "ref": "3.4.0", "ref_kind": "release", "release_integrity": { "asset": "checkov_linux_X86_64.zip", "assets": 3, "build_provenance": null, "checksums_published": false, "digest_matches_github": true, "immutable_release": null, "methods": [], "provenance_published": false, "sbom_published": false, "signature": null, "signatures_published": false, "signer": null, "verdict": "none" }, "released_at": "2026-10-28T23:02:47Z", "repository": "bridgecrewio/checkov", "sbomlyze_diff": { "added": 0, "changed": 0, "drift": {}, "findings": [ "0 version changes among 169 shared packages \u2014 no actual upgrades", "Core system packages stable: pypi (106), github (48), file (13) unchanged" ], "removed": 0 }, "scanned_at": "2026-11-02T03:06:37+00:00", "scorecard": null, "scorecard_note": "the OpenSSF public dataset entry is 1435 days old (limit 30); the Scorecard CLI fallback was skipped because this shard's weekly budget was used", "vulnerabilities": [ { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "2026.10.18" ], "id": "GHSA-6q48-6c7w-9gw2", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "certifi", "severity": "Critical", "summary": "certifi bundles emSign root CAs with compromised intermediate CA keys", "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2", "version": "2026.7.22" }, { "aliases": [ "CVE-2026-78676" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-78676", "percentile": 0.46378, "score": 0.00556 }, "fix_state": "fixed", "fixed_in": [ "3.1.59" ], "id": "GHSA-284h-m62q-gf8w", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Critical", "summary": "GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE", "url": "https://github.com/advisories/GHSA-284h-m62q-gf8w", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-2g87-pp6c-29x5", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "High", "summary": "aiohttp: Multiple instances of excessive or unbounded memory/CPU use", "url": "https://github.com/advisories/GHSA-2g87-pp6c-29x5", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111064" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111064", "percentile": 0.34179, "score": 0.00399 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-5wr8-gcqf-gqf3", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "High", "summary": "aiohttp server lacks an initial request/header timeout", "url": "https://github.com/advisories/GHSA-5wr8-gcqf-gqf3", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111066" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111066", "percentile": 0.3543, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-9xw5-w5jj-pvcg", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "High", "summary": "AIOHTTP: File descriptor exhaustion in multipart requests", "url": "https://github.com/advisories/GHSA-9xw5-w5jj-pvcg", "version": "3.13.5" }, { "aliases": [ "CVE-2026-69244" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69244", "percentile": 0.44706, "score": 0.00528 }, "fix_state": "fixed", "fixed_in": [ "3.14.3" ], "id": "GHSA-cq5v-8q36-5273", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "High", "summary": "AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)", "url": "https://github.com/advisories/GHSA-cq5v-8q36-5273", "version": "3.13.5" }, { "aliases": [ "CVE-2024-23342" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2024-23342", "percentile": 0.62155, "score": 0.00977 }, "fix_state": "not-fixed", "fixed_in": [], "id": "GHSA-wj6h-64fc-37mp", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "ecdsa", "severity": "High", "summary": "Minerva timing attack on P-256 in python-ecdsa", "url": "https://github.com/advisories/GHSA-wj6h-64fc-37mp", "version": "0.19.2" }, { "aliases": [ "CVE-2026-87817" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-87817", "percentile": 0.3625, "score": 0.00419 }, "fix_state": "fixed", "fixed_in": [ "3.1.60" ], "id": "GHSA-239g-whfq-7xj9", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution", "url": "https://github.com/advisories/GHSA-239g-whfq-7xj9", "version": "3.1.41" }, { "aliases": [ "CVE-2026-87817" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-87817", "percentile": 0.3625, "score": 0.00419 }, "fix_state": "fixed", "fixed_in": [ "3.1.60" ], "id": "GHSA-239g-whfq-7xj9", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution", "url": "https://github.com/advisories/GHSA-239g-whfq-7xj9", "version": "3.1.59" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-23mf-xhv8-69c2", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)", "url": "https://github.com/advisories/GHSA-23mf-xhv8-69c2", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-23mf-xhv8-69c2", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)", "url": "https://github.com/advisories/GHSA-23mf-xhv8-69c2", "version": "3.1.59" }, { "aliases": [ "CVE-2026-67325" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-67325", "percentile": 0.82595, "score": 0.02209 }, "fix_state": "fixed", "fixed_in": [ "3.1.51" ], "id": "GHSA-2f96-g7mh-g2hx", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist", "url": "https://github.com/advisories/GHSA-2f96-g7mh-g2hx", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.57" ], "id": "GHSA-3f7w-8rr8-f37f", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read", "url": "https://github.com/advisories/GHSA-3f7w-8rr8-f37f", "version": "3.1.41" }, { "aliases": [ "CVE-2026-69097" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69097", "percentile": 0.18964, "score": 0.00268 }, "fix_state": "fixed", "fixed_in": [ "3.1.53" ], "id": "GHSA-3rp5-jjmw-4wv2", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)", "url": "https://github.com/advisories/GHSA-3rp5-jjmw-4wv2", "version": "3.1.41" }, { "aliases": [ "CVE-2026-76219" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-76219", "percentile": 0.45636, "score": 0.00543 }, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-4gmw-gg2m-w46p", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite", "url": "https://github.com/advisories/GHSA-4gmw-gg2m-w46p", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.54" ], "id": "GHSA-6p8h-3wgx-97gf", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks", "url": "https://github.com/advisories/GHSA-6p8h-3wgx-97gf", "version": "3.1.41" }, { "aliases": [ "CVE-2026-44243" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-44243", "percentile": 0.36263, "score": 0.00419 }, "fix_state": "fixed", "fixed_in": [ "3.1.48" ], "id": "GHSA-7545-fcxq-7j24", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython reference APIs has a path traversal vulnerability that allows arbitrary file write and delete outside the repository", "url": "https://github.com/advisories/GHSA-7545-fcxq-7j24", "version": "3.1.41" }, { "aliases": [ "CVE-2026-78675" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-78675", "percentile": 0.07351, "score": 0.00178 }, "fix_state": "fixed", "fixed_in": [ "3.1.59" ], "id": "GHSA-7833-fr7j-v32q", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)", "url": "https://github.com/advisories/GHSA-7833-fr7j-v32q", "version": "3.1.41" }, { "aliases": [ "CVE-2026-114145" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-114145", "percentile": 0.3667, "score": 0.00423 }, "fix_state": "fixed", "fixed_in": [ "3.2.1" ], "id": "GHSA-83vg-56qc-22m7", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython validates a submodule's \".git\" path only after cloning into it (RCE)", "url": "https://github.com/advisories/GHSA-83vg-56qc-22m7", "version": "3.1.41" }, { "aliases": [ "CVE-2026-114145" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-114145", "percentile": 0.3667, "score": 0.00423 }, "fix_state": "fixed", "fixed_in": [ "3.2.1" ], "id": "GHSA-83vg-56qc-22m7", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython validates a submodule's \".git\" path only after cloning into it (RCE)", "url": "https://github.com/advisories/GHSA-83vg-56qc-22m7", "version": "3.1.59" }, { "aliases": [ "CVE-2026-78677" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-78677", "percentile": 0.5122, "score": 0.00651 }, "fix_state": "fixed", "fixed_in": [ "3.1.59" ], "id": "GHSA-8mcc-hrx5-hvxc", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination", "url": "https://github.com/advisories/GHSA-8mcc-hrx5-hvxc", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.55" ], "id": "GHSA-94p4-4cq8-9g67", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)", "url": "https://github.com/advisories/GHSA-94p4-4cq8-9g67", "version": "3.1.41" }, { "aliases": [ "CVE-2026-67323" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-67323", "percentile": 0.69421, "score": 0.01251 }, "fix_state": "fixed", "fixed_in": [ "3.1.51" ], "id": "GHSA-956x-8gvw-wg5v", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`", "url": "https://github.com/advisories/GHSA-956x-8gvw-wg5v", "version": "3.1.41" }, { "aliases": [ "CVE-2026-76218" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-76218", "percentile": 0.53932, "score": 0.0072 }, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-9rj7-rf2p-w77r", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks", "url": "https://github.com/advisories/GHSA-9rj7-rf2p-w77r", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-f9j4-qggq-h239", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution", "url": "https://github.com/advisories/GHSA-f9j4-qggq-h239", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-f9j4-qggq-h239", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution", "url": "https://github.com/advisories/GHSA-f9j4-qggq-h239", "version": "3.1.59" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.54" ], "id": "GHSA-fjr4-x663-mwxc", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)", "url": "https://github.com/advisories/GHSA-fjr4-x663-mwxc", "version": "3.1.41" }, { "aliases": [ "CVE-2026-87819" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-87819", "percentile": 0.4426, "score": 0.00521 }, "fix_state": "fixed", "fixed_in": [ "3.1.60" ], "id": "GHSA-g5vv-9gxw-82hx", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex \u2014 commit author/committer field parsing", "url": "https://github.com/advisories/GHSA-g5vv-9gxw-82hx", "version": "3.1.41" }, { "aliases": [ "CVE-2026-87819" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-87819", "percentile": 0.4426, "score": 0.00521 }, "fix_state": "fixed", "fixed_in": [ "3.1.60" ], "id": "GHSA-g5vv-9gxw-82hx", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex \u2014 commit author/committer field parsing", "url": "https://github.com/advisories/GHSA-g5vv-9gxw-82hx", "version": "3.1.59" }, { "aliases": [ "CVE-2026-76222" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-76222", "percentile": 0.36542, "score": 0.00422 }, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-hmq2-w58f-27jc", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython", "url": "https://github.com/advisories/GHSA-hmq2-w58f-27jc", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-jm78-9fvv-mhgr", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)", "url": "https://github.com/advisories/GHSA-jm78-9fvv-mhgr", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-m64x-33q8-m5h7", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines", "url": "https://github.com/advisories/GHSA-m64x-33q8-m5h7", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-m64x-33q8-m5h7", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines", "url": "https://github.com/advisories/GHSA-m64x-33q8-m5h7", "version": "3.1.59" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.50" ], "id": "GHSA-mv93-w799-cj2w", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath", "url": "https://github.com/advisories/GHSA-mv93-w799-cj2w", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.54" ], "id": "GHSA-r9mr-m37c-5fr3", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution", "url": "https://github.com/advisories/GHSA-r9mr-m37c-5fr3", "version": "3.1.41" }, { "aliases": [ "CVE-2026-42215" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-42215", "percentile": 0.54924, "score": 0.00749 }, "fix_state": "fixed", "fixed_in": [ "3.1.47" ], "id": "GHSA-rpm5-65cw-6hj4", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython has Command Injection via Git options bypass", "url": "https://github.com/advisories/GHSA-rpm5-65cw-6hj4", "version": "3.1.41" }, { "aliases": [ "CVE-2026-67322" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-67322", "percentile": 0.25919, "score": 0.00328 }, "fix_state": "fixed", "fixed_in": [ "3.1.52" ], "id": "GHSA-rwj8-pgh3-r573", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL", "url": "https://github.com/advisories/GHSA-rwj8-pgh3-r573", "version": "3.1.41" }, { "aliases": [ "CVE-2026-44244" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-44244", "percentile": 0.14758, "score": 0.00237 }, "fix_state": "fixed", "fixed_in": [ "3.1.49" ], "id": "GHSA-v87r-6q3f-2j67", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Newline injection in config_writer().set_value() enables RCE via core.hooksPath", "url": "https://github.com/advisories/GHSA-v87r-6q3f-2j67", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-w8jc-g24h-crhw", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython command wrappers omit unsafe protocol and option checks", "url": "https://github.com/advisories/GHSA-w8jc-g24h-crhw", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-w8jc-g24h-crhw", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "High", "summary": "GitPython command wrappers omit unsafe protocol and option checks", "url": "https://github.com/advisories/GHSA-w8jc-g24h-crhw", "version": "3.1.59" }, { "aliases": [ "CVE-2026-76220" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-76220", "percentile": 0.48242, "score": 0.0059 }, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-wvpp-8hx9-p66j", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution", "url": "https://github.com/advisories/GHSA-wvpp-8hx9-p66j", "version": "3.1.41" }, { "aliases": [ "CVE-2026-42284" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-42284", "percentile": 0.47265, "score": 0.00571 }, "fix_state": "fixed", "fixed_in": [ "3.1.47" ], "id": "GHSA-x2qx-6953-8485", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "High", "summary": "GitPython: Unsafe option check validates multi_options before shlex.split transformation", "url": "https://github.com/advisories/GHSA-x2qx-6953-8485", "version": "3.1.41" }, { "aliases": [ "CVE-2025-67221" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2025-67221", "percentile": 0.50356, "score": 0.00633 }, "fix_state": "fixed", "fixed_in": [ "3.11.6" ], "id": "GHSA-hx9q-6w63-j58v", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "orjson", "severity": "High", "summary": "orjson does not limit recursion for deeply nested JSON documents", "url": "https://github.com/advisories/GHSA-hx9q-6w63-j58v", "version": "3.11.5" }, { "aliases": [ "CVE-2025-66471" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2025-66471", "percentile": 0.52471, "score": 0.00682 }, "fix_state": "fixed", "fixed_in": [ "2.6.0" ], "id": "GHSA-2xpw-w6gg-jr37", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3 streaming API improperly handles highly compressed data", "url": "https://github.com/advisories/GHSA-2xpw-w6gg-jr37", "version": "1.26.20" }, { "aliases": [ "CVE-2026-21441" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-21441", "percentile": 0.87044, "score": 0.02922 }, "fix_state": "fixed", "fixed_in": [ "2.6.3" ], "id": "GHSA-38jv-5279-wg99", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)", "url": "https://github.com/advisories/GHSA-38jv-5279-wg99", "version": "1.26.20" }, { "aliases": [ "CVE-2026-97687" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97687", "percentile": 0.10658, "score": 0.00206 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-8988-9cw3-xx77", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3: HTTPS proxy TLS configuration may be ignored or overridden", "url": "https://github.com/advisories/GHSA-8988-9cw3-xx77", "version": "1.26.20" }, { "aliases": [ "CVE-2025-66418" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2025-66418", "percentile": 0.52471, "score": 0.00682 }, "fix_state": "fixed", "fixed_in": [ "2.6.0" ], "id": "GHSA-gm62-xv2j-4w53", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3 allows an unbounded number of links in the decompression chain", "url": "https://github.com/advisories/GHSA-gm62-xv2j-4w53", "version": "1.26.20" }, { "aliases": [ "CVE-2026-44431" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-44431", "percentile": 0.26325, "score": 0.00331 }, "fix_state": "fixed", "fixed_in": [ "2.7.0" ], "id": "GHSA-qccp-gfcp-xxvc", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects", "url": "https://github.com/advisories/GHSA-qccp-gfcp-xxvc", "version": "1.26.20" }, { "aliases": [ "CVE-2026-97689" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-97689", "percentile": 0.26853, "score": 0.00335 }, "fix_state": "fixed", "fixed_in": [ "2.8.0" ], "id": "GHSA-vxq7-64xx-v4gw", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "High", "summary": "urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory", "url": "https://github.com/advisories/GHSA-vxq7-64xx-v4gw", "version": "1.26.20" }, { "aliases": [ "CVE-2026-111063" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111063", "percentile": 0.14212, "score": 0.00233 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-494j-54xm-rwp3", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: Secure attribute not enforced for shared cookie", "url": "https://github.com/advisories/GHSA-494j-54xm-rwp3", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54273" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54273", "percentile": 0.42374, "score": 0.00493 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-4fvr-rgm6-gqmc", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "aiohttp: HTTP/1 Pipelined Requests Queue Without Limit", "url": "https://github.com/advisories/GHSA-4fvr-rgm6-gqmc", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54277" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54277", "percentile": 0.46826, "score": 0.00563 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-63hw-fmq6-xxg2", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines", "url": "https://github.com/advisories/GHSA-63hw-fmq6-xxg2", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111065" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111065", "percentile": 0.33774, "score": 0.00395 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-6cjc-53gc-5rqm", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: Connector pool exhaustion via Max-Age overflow", "url": "https://github.com/advisories/GHSA-6cjc-53gc-5rqm", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111748" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111748", "percentile": 0.32732, "score": 0.00386 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-f9xw-jh8m-3mwq", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: Absolute-form request targets can spoof Request.scheme", "url": "https://github.com/advisories/GHSA-f9xw-jh8m-3mwq", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54278" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54278", "percentile": 0.42372, "score": 0.00493 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-g3cq-j2xw-wf74", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup", "url": "https://github.com/advisories/GHSA-g3cq-j2xw-wf74", "version": "3.13.5" }, { "aliases": [ "CVE-2026-47265" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-47265", "percentile": 0.04162, "score": 0.0015 }, "fix_state": "fixed", "fixed_in": [ "3.14.0" ], "id": "GHSA-hg6j-4rv6-33pg", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP is vulnerable to cross-origin redirect with per-request cookies", "url": "https://github.com/advisories/GHSA-hg6j-4rv6-33pg", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54276" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54276", "percentile": 0.23492, "score": 0.00307 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-hpj7-wq8m-9hgp", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges", "url": "https://github.com/advisories/GHSA-hpj7-wq8m-9hgp", "version": "3.13.5" }, { "aliases": [ "CVE-2026-34993" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-34993", "percentile": 0.07462, "score": 0.00179 }, "fix_state": "fixed", "fixed_in": [ "3.14.0" ], "id": "GHSA-jg22-mg44-37j8", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP is Vulnerable to Deserialization of Untrusted Data", "url": "https://github.com/advisories/GHSA-jg22-mg44-37j8", "version": "3.13.5" }, { "aliases": [ "CVE-2026-69243" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-69243", "percentile": 0.38526, "score": 0.00443 }, "fix_state": "fixed", "fixed_in": [ "3.14.2" ], "id": "GHSA-mfx4-hv73-q22v", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: HTTP request smuggling via WebSocket upgrade", "url": "https://github.com/advisories/GHSA-mfx4-hv73-q22v", "version": "3.13.5" }, { "aliases": [ "CVE-2026-59881" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-59881", "percentile": 0.44435, "score": 0.00524 }, "fix_state": "fixed", "fixed_in": [ "3.14.2" ], "id": "GHSA-mq44-7p77-q5h7", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate", "url": "https://github.com/advisories/GHSA-mq44-7p77-q5h7", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111750" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111750", "percentile": 0.32191, "score": 0.00382 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-pqxq-w44r-73xw", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "AIOHTTP: Pure-Python parser request smuggling", "url": "https://github.com/advisories/GHSA-pqxq-w44r-73xw", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54274" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54274", "percentile": 0.45391, "score": 0.00539 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-xcgm-r5h9-7989", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Medium", "summary": "aiohttp: Incomplete websocket frame payloads bypass memory limits", "url": "https://github.com/advisories/GHSA-xcgm-r5h9-7989", "version": "3.13.5" }, { "aliases": [ "CVE-2026-55244" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-55244", "percentile": 0.07293, "score": 0.00177 }, "fix_state": "fixed", "fixed_in": [ "1.0.9" ], "id": "GHSA-89v8-rhwq-hf77", "kev": null, "location": "setup.py", "osv_confirmed": true, "package": "asteval", "severity": "Medium", "summary": "asteval has a Sandbox Escape via BaseException Subclasses", "url": "https://github.com/advisories/GHSA-89v8-rhwq-hf77", "version": "1.0.6" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "1.0.9" ], "id": "GHSA-9w56-46f6-3qhx", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "asteval", "severity": "Medium", "summary": "asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter", "url": "https://github.com/advisories/GHSA-9w56-46f6-3qhx", "version": "1.0.6" }, { "aliases": [ "CVE-2026-78679" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-78679", "percentile": 0.24565, "score": 0.00316 }, "fix_state": "fixed", "fixed_in": [ "3.1.59" ], "id": "GHSA-3wxw-xv34-2frg", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)", "url": "https://github.com/advisories/GHSA-3wxw-xv34-2frg", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.57" ], "id": "GHSA-539m-9xh6-q6rr", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()", "url": "https://github.com/advisories/GHSA-539m-9xh6-q6rr", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.62" ], "id": "GHSA-59cr-6r3x-644w", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython submodule update path traversal can write outside the repository", "url": "https://github.com/advisories/GHSA-59cr-6r3x-644w", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.62" ], "id": "GHSA-59cr-6r3x-644w", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "Medium", "summary": "GitPython submodule update path traversal can write outside the repository", "url": "https://github.com/advisories/GHSA-59cr-6r3x-644w", "version": "3.1.59" }, { "aliases": [ "CVE-2026-78678" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-78678", "percentile": 0.35459, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "3.1.59" ], "id": "GHSA-5xxx-qhh7-9287", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()", "url": "https://github.com/advisories/GHSA-5xxx-qhh7-9287", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-fx3j-rwgx-fr94", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name", "url": "https://github.com/advisories/GHSA-fx3j-rwgx-fr94", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-fx3j-rwgx-fr94", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "Medium", "summary": "GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name", "url": "https://github.com/advisories/GHSA-fx3j-rwgx-fr94", "version": "3.1.59" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-gq48-pqfc-9p58", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree", "url": "https://github.com/advisories/GHSA-gq48-pqfc-9p58", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.2.0" ], "id": "GHSA-gq48-pqfc-9p58", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree", "url": "https://github.com/advisories/GHSA-gq48-pqfc-9p58", "version": "3.1.59" }, { "aliases": [ "CVE-2026-76217" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-76217", "percentile": 0.35458, "score": 0.00412 }, "fix_state": "fixed", "fixed_in": [ "3.1.58" ], "id": "GHSA-hh9p-6wh2-4mfc", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()", "url": "https://github.com/advisories/GHSA-hh9p-6wh2-4mfc", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.56" ], "id": "GHSA-p538-c434-8v24", "kev": null, "location": "setup.py", "osv_confirmed": false, "package": "gitpython", "severity": "Medium", "summary": "GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count", "url": "https://github.com/advisories/GHSA-p538-c434-8v24", "version": "3.1.41" }, { "aliases": [], "ecosystem": "pypi", "epss": null, "fix_state": "fixed", "fixed_in": [ "3.1.60" ], "id": "GHSA-whh4-5q6c-9v3x", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "gitpython", "severity": "Medium", "summary": "GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle", "url": "https://github.com/advisories/GHSA-whh4-5q6c-9v3x", "version": "3.1.59" }, { "aliases": [ "CVE-2026-104874" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-104874", "percentile": 0.38968, "score": 0.00448 }, "fix_state": "fixed", "fixed_in": [ "6.9.1" ], "id": "GHSA-54p9-h82j-f925", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "multidict", "severity": "Medium", "summary": "Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction", "url": "https://github.com/advisories/GHSA-54p9-h82j-f925", "version": "6.7.1" }, { "aliases": [ "CVE-2026-25645" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-25645", "percentile": 0.08606, "score": 0.00189 }, "fix_state": "fixed", "fixed_in": [ "2.33.0" ], "id": "GHSA-gc5v-m9x4-r6x2", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "requests", "severity": "Medium", "summary": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function", "url": "https://github.com/advisories/GHSA-gc5v-m9x4-r6x2", "version": "2.32.5" }, { "aliases": [ "CVE-2026-86000" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-86000", "percentile": 0.49167, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-gjv8-xp57-g29c", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "soupsieve", "severity": "Medium", "summary": "Soup Sieve: Polynomial-time ReDoS (O(n\u00b2)) in the `IDENTIFIER` / `VALUE` selector sub-patterns", "url": "https://github.com/advisories/GHSA-gjv8-xp57-g29c", "version": "2.8.4" }, { "aliases": [ "CVE-2026-85999" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-85999", "percentile": 0.49167, "score": 0.00609 }, "fix_state": "fixed", "fixed_in": [ "2.9.0" ], "id": "GHSA-j934-xhv5-fg8f", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "soupsieve", "severity": "Medium", "summary": "Soup Sieve: Polynomial-time ReDoS (O(n\u00b2)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)", "url": "https://github.com/advisories/GHSA-j934-xhv5-fg8f", "version": "2.8.4" }, { "aliases": [ "CVE-2025-50181" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2025-50181", "percentile": 0.40987, "score": 0.00474 }, "fix_state": "fixed", "fixed_in": [ "2.5.0" ], "id": "GHSA-pq67-6m6q-mj2v", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "urllib3", "severity": "Medium", "summary": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation", "url": "https://github.com/advisories/GHSA-pq67-6m6q-mj2v", "version": "1.26.20" }, { "aliases": [ "CVE-2026-54279" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54279", "percentile": 0.42375, "score": 0.00493 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-2fqr-mr3j-6wp8", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Low", "summary": "aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence", "url": "https://github.com/advisories/GHSA-2fqr-mr3j-6wp8", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54275" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54275", "percentile": 0.40701, "score": 0.0047 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-4m7w-qmgq-4wj5", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Low", "summary": "aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections", "url": "https://github.com/advisories/GHSA-4m7w-qmgq-4wj5", "version": "3.13.5" }, { "aliases": [ "CVE-2026-54280" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-54280", "percentile": 0.39926, "score": 0.0046 }, "fix_state": "fixed", "fixed_in": [ "3.14.1" ], "id": "GHSA-9x8q-7h8h-wcw9", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Low", "summary": "aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect", "url": "https://github.com/advisories/GHSA-9x8q-7h8h-wcw9", "version": "3.13.5" }, { "aliases": [ "CVE-2026-111749" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-111749", "percentile": 0.3246, "score": 0.00384 }, "fix_state": "fixed", "fixed_in": [ "3.14.4" ], "id": "GHSA-gx76-c99x-2c96", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Low", "summary": "AIOHTTP: Cookie from subdomain can remove Host-Only Scope from existing cookies", "url": "https://github.com/advisories/GHSA-gx76-c99x-2c96", "version": "3.13.5" }, { "aliases": [ "CVE-2026-50269" ], "ecosystem": "pypi", "epss": { "cve": "CVE-2026-50269", "percentile": 0.45049, "score": 0.00533 }, "fix_state": "fixed", "fixed_in": [ "3.14.0" ], "id": "GHSA-m6qw-4cw2-hm4m", "kev": null, "location": "Pipfile.lock", "osv_confirmed": true, "package": "aiohttp", "severity": "Low", "summary": "aiohttp: CRLF injection in multipart headers", "url": "https://github.com/advisories/GHSA-m6qw-4cw2-hm4m", "version": "3.13.5" } ], "workflow_audit": { "files": 10, "findings": [ { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build.yml", "line": 410, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/build.yml", "line": 428, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/jekyll-gh-pages.yml", "line": 15, "note": "pages: write is overly broad at the workflow level", "rule": "excessive-permissions", "severity": "High", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "overly broad permissions", "file": ".github/workflows/jekyll-gh-pages.yml", "line": 16, "note": "id-token: write is overly broad at the workflow level", "rule": "excessive-permissions", "severity": "High", "url": "https://docs.zizmor.sh/audits/#excessive-permissions" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/nightly.yml", "line": 124, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/nightly.yml", "line": 160, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/pr-test.yml", "line": 9, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/pr-test.yml", "line": 66, "note": "this job", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "High", "description": "unpinned action reference", "file": ".github/workflows/security-shared.yml", "line": 40, "note": "this step", "rule": "unpinned-uses", "severity": "High", "url": "https://docs.zizmor.sh/audits/#unpinned-uses" }, { "confidence": "Medium", "description": "use of fundamentally insecure workflow trigger", "file": ".github/workflows/security.yml", "line": 7, "note": "this workflow", "rule": "dangerous-triggers", "severity": "High", "url": "https://docs.zizmor.sh/audits/#dangerous-triggers" }, { "confidence": "High", "description": "secrets unconditionally inherited by called workflow", "file": ".github/workflows/build.yml", "line": 40, "note": "this reusable workflow", "rule": "secrets-inherit", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#secrets-inherit" }, { "confidence": "High", "description": "action or reusable workflow from archived repository", "file": ".github/workflows/nightly.yml", "line": 124, "note": "this step", "rule": "archived-uses", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#archived-uses" }, { "confidence": "High", "description": "action or reusable workflow from archived repository", "file": ".github/workflows/nightly.yml", "line": 160, "note": "this step", "rule": "archived-uses", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#archived-uses" }, { "confidence": "High", "description": "secrets unconditionally inherited by called workflow", "file": ".github/workflows/security.yml", "line": 23, "note": "this reusable workflow", "rule": "secrets-inherit", "severity": "Medium", "url": "https://docs.zizmor.sh/audits/#secrets-inherit" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/build.yml", "line": 39, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "ad-hoc installation of packages", "file": ".github/workflows/pr-test.yml", "line": 26, "note": "this step", "rule": "adhoc-packages", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#adhoc-packages" }, { "confidence": "High", "description": "use GitHub's dedicated self-repository syntax", "file": ".github/workflows/security.yml", "line": 21, "note": "this job", "rule": "self-repository", "severity": "Low", "url": "https://docs.zizmor.sh/audits/#self-repository" }, { "confidence": "High", "description": "action functionality is already included by the runner", "file": ".github/workflows/nightly.yml", "line": 49, "note": "this step", "rule": "superfluous-actions", "severity": "Informational", "url": "https://docs.zizmor.sh/audits/#superfluous-actions" } ] } }, "updated": "2026-11-02" }