{"matches":[{"vulnerability":{"id":"GHSA-9m75-vc3g-4x39","dataSource":"https://github.com/advisories/GHSA-9m75-vc3g-4x39","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39","https://nvd.nist.gov/vuln/detail/CVE-2026-119195","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.39525000000000005},"relatedVulnerabilities":[{"id":"CVE-2026-119195","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119195","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/4ce00797c594b59c1fd6b86d9ebc3ba87b7ec9f9","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-9m75-vc3g-4x39"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed string and indefinite-length ANY decoding repeatedly concatenates each fragment onto a growing bytes value. Attacker-controlled BER or CER data can use many constructed OCTET STRING or character-string fragments. DER rejects constructed OCTET STRING without a schema, but accepts its definite-length form when asn1Spec selects univ.OctetString; it also accepts constructed character strings such as UTF8String without a schema, even though those encodings are not valid DER. The separate indefinite-length ANY path is reachable in BER and CER when asn1Spec selects univ.Any; DER rejects indefinite lengths. OctetStringPayloadDecoder uses growing header concatenation and AnyPayloadDecoder.indefLenValueDecoder uses growing chunk concatenation, repeatedly copying an increasing prefix and causing quadratic work. A sufficiently fragmented value can occupy decoding workers and cause CPU exhaustion without confidentiality or integrity impact. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119195","epss":0.00527,"percentile":0.44645,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119195","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-9m75-vc3g-4x39","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-fm9c-5rcf-2q5p","dataSource":"https://github.com/advisories/GHSA-fm9c-5rcf-2q5p","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p","https://nvd.nist.gov/vuln/detail/CVE-2026-119194","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119194","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119194","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p"],"description":"pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119194","epss":0.00425,"percentile":0.36826,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119194","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-fm9c-5rcf-2q5p","versionConstraint":">=0.3.3,<0.6.5 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-2qm8-x737-gmw5","dataSource":"https://github.com/advisories/GHSA-2qm8-x737-gmw5","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5","https://nvd.nist.gov/vuln/detail/CVE-2026-119196","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119196","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119196","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/73ba7b043cc7e92cb37f16f2c955bff93b0e6f6c","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-2qm8-x737-gmw5"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, constructed BIT STRING decoding repeatedly shifts and copies the complete bit value accumulated from earlier fragments. Attacker-controlled BER or CER input contains many constructed BIT STRING fragments; schema-driven DER also accepts a definite-length constructed BIT STRING. BitStringPayloadDecoder repeatedly calls BitString.fromOctetString with the prior bitString as prepend, shifting an ever-growing SizedInteger for each fragment and causing quadratic work. Large fragmented values can exhaust CPU during decode() without requiring later conversion or formatting. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119196","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119196","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-2qm8-x737-gmw5","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-mm57-4v3p-rchx","dataSource":"https://github.com/advisories/GHSA-mm57-4v3p-rchx","namespace":"github:language:python","severity":"High","urls":["https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx","https://nvd.nist.gov/vuln/detail/CVE-2026-119197","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5"],"description":"pyasn1 has quadratic-complexity denial of service in binary REAL decoding","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.6.5"],"state":"fixed","available":[{"version":"0.6.5","date":"2026-10-31","kind":"first-observed"}]},"advisories":[],"risk":0.31875000000000003},"relatedVulnerabilities":[{"id":"CVE-2026-119197","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119197","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pyasn1/pyasn1/commit/ce3ec3390784780a530047e0e77be5ff457636a4","https://github.com/pyasn1/pyasn1/pull/132","https://github.com/pyasn1/pyasn1/releases/tag/v0.6.5","https://github.com/pyasn1/pyasn1/security/advisories/GHSA-mm57-4v3p-rchx"],"description":"pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.5, binary REAL decoding builds a large mantissa one octet at a time by shifting a growing integer and slicing the remaining byte string. Attacker-controlled ASN.1 includes a binary-encoded REAL with a large mantissa and reaches BER, CER, or DER decode(), with or without a schema containing REAL. RealPayloadDecoder.valueDecoder repeatedly performs a left shift, OR, and suffix copy for every mantissa octet, making decode time quadratic in mantissa length. A comparatively small REAL value can hold a decoding worker on one CPU core for seconds or longer and cause availability loss. This issue is fixed in version 0.6.5.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-119197","epss":0.00425,"percentile":0.36825,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-119197","cwe":"CWE-407","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pyasn1","version":"0.6.4"}},"found":{"vulnerabilityID":"GHSA-mm57-4v3p-rchx","versionConstraint":"<=0.6.4 (python)"},"fix":{"suggestedVersion":"0.6.5"}}],"artifact":{"id":"pkg:pypi/pyasn1@0.6.4?package-id=6d8f5cf4ff280993","name":"pyasn1","version":"0.6.4","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:pyasn1:pyasn1:0.6.4:*:*:*:*:python:*:*"],"purl":"pkg:pypi/pyasn1@0.6.4","upstreams":[]}},{"vulnerability":{"id":"GHSA-h35f-9h28-mq5c","dataSource":"https://github.com/advisories/GHSA-h35f-9h28-mq5c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c","https://nvd.nist.gov/vuln/detail/CVE-2026-59890","https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/advisory-database/tree/main/vulns/setuptools/PYSEC-2026-3447.yaml","https://github.com/pypa/setuptools/releases/tag/v83.0.0"],"description":"setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["83.0.0"],"state":"fixed","available":[{"version":"83.0.0","date":"2026-07-22","kind":"first-observed"}]},"advisories":[],"risk":0.22477499999999997},"relatedVulnerabilities":[{"id":"CVE-2026-59890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-59890","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f","https://github.com/pypa/setuptools/releases/tag/v83.0.0","https://github.com/pypa/setuptools/security/advisories/GHSA-h35f-9h28-mq5c"],"description":"setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unicode normalization, so on macOS APFS or HFS+ an NFD file name could bypass an NFC exclusion rule and be packed into a source distribution. This issue is fixed in version 83.0.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-59890","epss":0.00405,"percentile":0.34805,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-59890","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-59890","cwe":"CWE-697","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"80.10.2"}},"found":{"vulnerabilityID":"GHSA-h35f-9h28-mq5c","versionConstraint":"<83.0.0 (python)"},"fix":{"suggestedVersion":"83.0.0"}}],"artifact":{"id":"pkg:pypi/setuptools@80.10.2?package-id=ded3045fe47dce3d","name":"setuptools","version":"80.10.2","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:80.10.2:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@80.10.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cx6f-vjhg-g3cc","dataSource":"https://github.com/advisories/GHSA-cx6f-vjhg-g3cc","namespace":"github:language:python","severity":"High","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc","https://github.com/pypa/virtualenv/pull/3466","https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4","https://github.com/pypa/virtualenv/releases/tag/21.14.13"],"description":"virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9)","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115586","epss":0.00271,"percentile":0.19367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115586","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.13"],"state":"fixed","available":[{"version":"21.14.13","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.19783},"relatedVulnerabilities":[{"id":"CVE-2026-115586","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115586","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4","https://github.com/pypa/virtualenv/pull/3466","https://github.com/pypa/virtualenv/releases/tag/21.14.13","https://github.com/pypa/virtualenv/security/advisories/GHSA-cx6f-vjhg-g3cc"],"description":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-115586","epss":0.00271,"percentile":0.19367,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-115586","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"21.14.9"}},"found":{"vulnerabilityID":"GHSA-cx6f-vjhg-g3cc","versionConstraint":">=21.14.9,<21.14.13 (python)"},"fix":{"suggestedVersion":"21.14.13"}}],"artifact":{"id":"pkg:pypi/virtualenv@21.14.9?package-id=1f649b8accb99907","name":"virtualenv","version":"21.14.9","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:21.14.9:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@21.14.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-v4x8-3wr5-3wq8","dataSource":"https://github.com/advisories/GHSA-v4x8-3wr5-3wq8","namespace":"github:language:python","severity":"High","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8","https://nvd.nist.gov/vuln/detail/CVE-2026-112940","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112940","epss":0.0019,"percentile":0.08751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112940","cwe":"CWE-363","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112940","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.1387},"relatedVulnerabilities":[{"id":"CVE-2026-112940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112940","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-v4x8-3wr5-3wq8"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwrite or unlink operations, while a writable adjacent hot journal is additionally required for attacker-chosen content overwrites. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112940","epss":0.0019,"percentile":0.08751,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112940","cwe":"CWE-363","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112940","cwe":"CWE-59","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-v4x8-3wr5-3wq8","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-j8f7-rjxc-mr56","dataSource":"https://github.com/advisories/GHSA-j8f7-rjxc-mr56","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56","https://nvd.nist.gov/vuln/detail/CVE-2026-112936","https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04","https://github.com/tox-dev/filelock/releases/tag/4.0.9"],"description":"filelock: ReadWriteLock follows a symlink at the lock path into SQLite","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112936","epss":0.00232,"percentile":0.1414,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112936","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112936","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.9"],"state":"fixed","available":[{"version":"4.0.9","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12875999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112936","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112936","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/4d45e83caf7e31f9a12fb44526bdc07f70114f04","https://github.com/tox-dev/filelock/releases/tag/4.0.9","https://github.com/tox-dev/filelock/security/advisories/GHSA-j8f7-rjxc-mr56"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112936","epss":0.00232,"percentile":0.1414,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112936","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-112936","cwe":"CWE-668","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-j8f7-rjxc-mr56","versionConstraint":">=3.20.4,<=4.0.8 (python)"},"fix":{"suggestedVersion":"4.0.9"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-69hj-f68j-2879","dataSource":"https://github.com/advisories/GHSA-69hj-f68j-2879","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879","https://nvd.nist.gov/vuln/detail/CVE-2026-112909","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.12209999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-112909","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112909","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-69hj-f68j-2879"],"description":"filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file renamed onto the lock path when another local user has actual rename permission, or hard-linked there under a permissive hard-link policy; when an explicit mode is requested, affected versions from 3.10.2 can also change that file's mode. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112909","epss":0.0022,"percentile":0.1264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112909","cwe":"CWE-706","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-69hj-f68j-2879","versionConstraint":"<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-cwqr-hh33-gh44","dataSource":"https://github.com/advisories/GHSA-cwqr-hh33-gh44","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44","https://nvd.nist.gov/vuln/detail/CVE-2026-112915","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112915","epss":0.00218,"percentile":0.12264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112915","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.11445000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-112915","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112915","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-cwqr-hh33-gh44"],"description":"filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose this on initial per-instance opening, and versions from 3.30.0 repeat the exposure on every acquisition. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112915","epss":0.00218,"percentile":0.12264,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112915","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-cwqr-hh33-gh44","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-4f8h-vr72-p32c","dataSource":"https://github.com/advisories/GHSA-4f8h-vr72-p32c","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c","https://nvd.nist.gov/vuln/detail/CVE-2026-113713","https://github.com/pypa/virtualenv/pull/3437","https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e","https://github.com/pypa/virtualenv/releases/tag/21.14.10"],"description":"virtualenv: Temporary app-data can leave dangling seed package links","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113713","epss":0.00204,"percentile":0.10368,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113713","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["21.14.10"],"state":"fixed","available":[{"version":"21.14.10","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0.09588},"relatedVulnerabilities":[{"id":"CVE-2026-113713","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113713","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e","https://github.com/pypa/virtualenv/pull/3437","https://github.com/pypa/virtualenv/releases/tag/21.14.10","https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c"],"description":"virtualenv is a tool for creating isolated virtual python environments. From 21.14.8 until 21.14.10, the app-data seeder can leave an environment linked to temporary package files that virtualenv deletes when creation finishes. The environment-variable and configuration-file forms of symlink_app_data can enable this state even though the command-line flag is disabled for temporary app-data. The resulting environment depends on a cache pathname that its owner no longer controls. This issue is fixed in version 21.14.10.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-113713","epss":0.00204,"percentile":0.10368,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-113713","cwe":"CWE-377","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"virtualenv","version":"21.14.9"}},"found":{"vulnerabilityID":"GHSA-4f8h-vr72-p32c","versionConstraint":">=21.14.8,<21.14.10 (python)"},"fix":{"suggestedVersion":"21.14.10"}}],"artifact":{"id":"pkg:pypi/virtualenv@21.14.9?package-id=1f649b8accb99907","name":"virtualenv","version":"21.14.9","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python-virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python_virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:python-virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:python_virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:virtualenv:virtualenv:21.14.9:*:*:*:*:*:*:*","cpe:2.3:a:python:virtualenv:21.14.9:*:*:*:*:*:*:*"],"purl":"pkg:pypi/virtualenv@21.14.9","upstreams":[]}},{"vulnerability":{"id":"GHSA-9c4x-gm8v-wgc4","dataSource":"https://github.com/advisories/GHSA-9c4x-gm8v-wgc4","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-9c4x-gm8v-wgc4","https://nvd.nist.gov/vuln/detail/CVE-2026-112911","https://github.com/tox-dev/filelock/pull/839","https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112911","epss":0.00148,"percentile":0.03961,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112911","cwe":"CWE-283","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.08362},"relatedVulnerabilities":[{"id":"CVE-2026-112911","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112911","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03","https://github.com/tox-dev/filelock/pull/839","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-9c4x-gm8v-wgc4"],"description":"filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.0 and SoftReadWriteLock versions from 4.0.0 can adopt a protocol directory created first by another local user in a shared parent directory, allowing that user to alter protocol state and admit concurrent holders. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.3,"exploitabilityScore":1.1,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112911","epss":0.00148,"percentile":0.03961,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112911","cwe":"CWE-283","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-9c4x-gm8v-wgc4","versionConstraint":">=3.30.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-rfpc-qcw5-3pc4","dataSource":"https://github.com/advisories/GHSA-rfpc-qcw5-3pc4","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4","https://nvd.nist.gov/vuln/detail/CVE-2026-112939","https://github.com/tox-dev/filelock/pull/836","https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112939","epss":0.0014,"percentile":0.03299,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112939","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.0679},"relatedVulnerabilities":[{"id":"CVE-2026-112939","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112939","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/eeceaa846cbe4df72718d94c8371ca1ab8f5b3cc","https://github.com/tox-dev/filelock/pull/836","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-rfpc-qcw5-3pc4"],"description":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112939","epss":0.0014,"percentile":0.03299,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112939","cwe":"CWE-345","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-rfpc-qcw5-3pc4","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-fq56-3cx3-fjxp","dataSource":"https://github.com/advisories/GHSA-fq56-3cx3-fjxp","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp","https://nvd.nist.gov/vuln/detail/CVE-2026-112935","https://github.com/tox-dev/filelock/pull/843","https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112935","epss":0.00132,"percentile":0.02756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112935","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.06402},"relatedVulnerabilities":[{"id":"CVE-2026-112935","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112935","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/tox-dev/filelock/commit/740ff666b62a88496c8d7394e4e6230605e4d62b","https://github.com/tox-dev/filelock/pull/843","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-fq56-3cx3-fjxp"],"description":"filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker after an attacker frees its own marker following the stale read, an honest contender creates a live successor on the reused inode, and the successor's modification time is not newer than the saved observation, causing the live marker to be removed and two holders to be admitted. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112935","epss":0.00132,"percentile":0.02756,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112935","cwe":"CWE-367","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-fq56-3cx3-fjxp","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-9j6q-wvj5-jgjg","dataSource":"https://github.com/advisories/GHSA-9j6q-wvj5-jgjg","namespace":"github:language:python","severity":"Low","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-9j6q-wvj5-jgjg","https://nvd.nist.gov/vuln/detail/CVE-2026-112912","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112912","epss":0.00213,"percentile":0.11678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112912","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0.058575},"relatedVulnerabilities":[{"id":"CVE-2026-112912","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112912","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/releases/tag/4.2.1","https://github.com/tox-dev/filelock/security/advisories/GHSA-9j6q-wvj5-jgjg"],"description":"filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-112912","epss":0.00213,"percentile":0.11678,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-112912","cwe":"CWE-59","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-9j6q-wvj5-jgjg","versionConstraint":">=3.32.6,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-5239-wwwm-4pmq","dataSource":"https://github.com/advisories/GHSA-5239-wwwm-4pmq","namespace":"github:language:python","severity":"Low","urls":["https://nvd.nist.gov/vuln/detail/CVE-2026-4539","https://github.com/pygments/pygments/issues/3058","https://github.com/pygments/pygments","https://vuldb.com/?ctiid.352327","https://vuldb.com/?id.352327","https://vuldb.com/?submit.774685","https://github.com/pygments/pygments/pull/3064","https://github.com/pygments/pygments/commit/24b8aa76c6cd6d70f39c6dd605cce319c98e2ccc","https://github.com/pygments/pygments/releases/tag/2.20.0"],"description":"Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","metrics":{"baseScore":1.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4539","epss":0.00159,"percentile":0.05019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4539","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-4539","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}],"fix":{"versions":["2.20.0"],"state":"fixed","available":[{"version":"2.20.0","date":"2026-03-30","kind":"first-observed"}]},"advisories":[],"risk":0.04452},"relatedVulnerabilities":[{"id":"CVE-2026-4539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4539","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/pygments/pygments/","https://github.com/pygments/pygments/issues/3058","https://vuldb.com/?ctiid.352327","https://vuldb.com/?id.352327","https://vuldb.com/?submit.774685"],"description":"A security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","cvss":[{"source":"cna@vuldb.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.9},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"cna@vuldb.com","type":"Secondary","version":"2.0","vector":"AV:L/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1.7,"exploitabilityScore":3.2,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4539","epss":0.00159,"percentile":0.05019,"date":"2026-10-31"}],"cwes":[{"cve":"CVE-2026-4539","cwe":"CWE-400","source":"cna@vuldb.com","type":"Secondary"},{"cve":"CVE-2026-4539","cwe":"CWE-1333","source":"cna@vuldb.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"pygments","version":"2.19.2"}},"found":{"vulnerabilityID":"GHSA-5239-wwwm-4pmq","versionConstraint":"<2.20.0 (python)"},"fix":{"suggestedVersion":"2.20.0"}}],"artifact":{"id":"pkg:pypi/pygments@2.19.2?package-id=83572b4c71b89656","name":"pygments","version":"2.19.2","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-pygments:python-pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python-pygments:python_pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python_pygments:python-pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python_pygments:python_pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:pygments:python-pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:pygments:python_pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python-pygments:pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python_pygments:pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python:python-pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python:python_pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:pygments:pygments:2.19.2:*:*:*:*:*:*:*","cpe:2.3:a:python:pygments:2.19.2:*:*:*:*:*:*:*"],"purl":"pkg:pypi/pygments@2.19.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6627-m3xw-93mp","dataSource":"https://github.com/advisories/GHSA-6627-m3xw-93mp","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-6627-m3xw-93mp","https://github.com/tox-dev/filelock/pull/839","https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.1,"impactScore":4.3},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112908","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-6627-m3xw-93mp","versionConstraint":">=3.30.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-8mx5-7m5m-r77g","dataSource":"https://github.com/advisories/GHSA-8mx5-7m5m-r77g","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-8mx5-7m5m-r77g","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":1.9,"impactScore":3.4},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112910","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-8mx5-7m5m-r77g","versionConstraint":">=3.10.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-m462-7rxw-wvpg","dataSource":"https://github.com/advisories/GHSA-m462-7rxw-wvpg","namespace":"github:language:python","severity":"Medium","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-m462-7rxw-wvpg","https://github.com/tox-dev/filelock/pull/839","https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":5.8,"exploitabilityScore":1.1,"impactScore":4.8},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-29","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112938","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-m462-7rxw-wvpg","versionConstraint":">=3.30.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-567q-5qvw-pf92","dataSource":"https://github.com/advisories/GHSA-567q-5qvw-pf92","namespace":"github:language:python","severity":"Low","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-567q-5qvw-pf92","https://github.com/tox-dev/filelock/pull/835","https://github.com/tox-dev/filelock/commit/e1e825b1992f69fb6b346dc395d5ae4893536c0a","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"exploitabilityScore":1.1,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112907","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-567q-5qvw-pf92","versionConstraint":">=3.22.0,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-9vhv-jxww-xfm5","dataSource":"https://github.com/advisories/GHSA-9vhv-jxww-xfm5","namespace":"github:language:python","severity":"Low","urls":["https://github.com/tox-dev/filelock/security/advisories/GHSA-9vhv-jxww-xfm5","https://github.com/tox-dev/filelock/pull/834","https://github.com/tox-dev/filelock/commit/5e3f2ec0c5fb17cb2635b60b2b68bc63ab81ca2d","https://github.com/tox-dev/filelock/releases/tag/4.2.1"],"description":"filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"exploitabilityScore":1.9,"impactScore":1.5},"vendorMetadata":{}}],"fix":{"versions":["4.2.1"],"state":"fixed","available":[{"version":"4.2.1","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2026-112913","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"filelock","version":"3.32.7"}},"found":{"vulnerabilityID":"GHSA-9vhv-jxww-xfm5","versionConstraint":">=3.20.4,<=4.2.0 (python)"},"fix":{"suggestedVersion":"4.2.1"}}],"artifact":{"id":"pkg:pypi/filelock@3.32.7?package-id=6730748e2420218d","name":"filelock","version":"3.32.7","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python-filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python-filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python_filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python-filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:python_filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:filelock:filelock:3.32.7:*:*:*:*:*:*:*","cpe:2.3:a:python:filelock:3.32.7:*:*:*:*:*:*:*"],"purl":"pkg:pypi/filelock@3.32.7","upstreams":[]}},{"vulnerability":{"id":"GHSA-xmj3-9gf7-h52w","dataSource":"https://github.com/advisories/GHSA-xmj3-9gf7-h52w","namespace":"github:language:python","severity":"Low","urls":["https://github.com/pypa/setuptools/security/advisories/GHSA-xmj3-9gf7-h52w","https://github.com/pypa/setuptools/pull/5329","https://github.com/pypa/setuptools/commit/6d07b8d17890dda58d944ac51e58f54af92d52af","https://github.com/pypa/setuptools/releases/tag/v84.1.0"],"description":"setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation  Description","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":1},"vendorMetadata":{}}],"fix":{"versions":["84.1.0"],"state":"fixed","available":[{"version":"84.1.0","date":"2026-10-24","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"python-matcher","searchedBy":{"language":"python","namespace":"github:language:python","package":{"name":"setuptools","version":"80.10.2"}},"found":{"vulnerabilityID":"GHSA-xmj3-9gf7-h52w","versionConstraint":">=38.2.2,<84.1.0 (python)"},"fix":{"suggestedVersion":"84.1.0"}}],"artifact":{"id":"pkg:pypi/setuptools@80.10.2?package-id=ded3045fe47dce3d","name":"setuptools","version":"80.10.2","type":"python","locations":[{"path":"/uv.lock","accessPath":""}],"language":"python","licenses":[],"cpes":["cpe:2.3:a:python:setuptools:80.10.2:*:*:*:*:*:*:*"],"purl":"pkg:pypi/setuptools@80.10.2","upstreams":[]}}],"source":{"type":"file","target":"lyft/cartography"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.121.0","configuration":{"output":["json"],"file":"./grype.json","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"$HOME/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-11-01T00:24:34Z_1793514012.tar.zst?checksum=sha256%3Ad0e1af9e6491440e1a671d0a0aafc32c5c7cb5cda787dcec3482799ef298f31c","built":"2026-11-01T06:20:12Z","path":"$HOME/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-11-01T00:24:39Z","input":"xxh64:d398731e6455b022"},"alpine":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:c40c8985935df81b"},"amazon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:ee129200b14d5c8a"},"arch":{"captured":"2026-11-01T00:24:47Z","input":"xxh64:14f6c24dd6cd12c8"},"bitnami":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:971619846357ae10"},"chainguard":{"captured":"2026-11-01T00:24:48Z","input":"xxh64:dfbf78c7fc58a603"},"chainguard-libraries":{"captured":"2026-11-01T00:24:50Z","input":"xxh64:db9c34dd1b7bc8d0"},"debian":{"captured":"2026-11-01T00:24:52Z","input":"xxh64:078c82a49c8cb529"},"echo":{"captured":"2026-11-01T00:24:41Z","input":"xxh64:1d0df98736854a48"},"eol":{"captured":"2026-11-01T00:24:59Z","input":"xxh64:0f2164b3e62ba44b"},"epss":{"captured":"2026-11-01T00:25:00Z","input":"xxh64:0d4c3b8d2c2e5188"},"fedora":{"captured":"2026-11-01T00:24:40Z","input":"xxh64:28fe3d1d8ae41f9b"},"github":{"captured":"2026-11-01T00:24:57Z","input":"xxh64:076a86d2dc5c9e83"},"govulndb":{"captured":"2026-11-01T00:24:45Z","input":"xxh64:56e169604e12196e"},"hummingbird":{"captured":"2026-11-01T00:27:26Z","input":"xxh64:e86abd0466410fb6"},"kev":{"captured":"2026-11-01T00:25:06Z","input":"xxh64:cb0f4041bd51c379"},"mariner":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:003337efdc7e1888"},"minimos":{"captured":"2026-11-01T00:24:56Z","input":"xxh64:219c30ffded7a12c"},"nvd":{"captured":"2026-11-01T00:25:41Z","input":"xxh64:75e41eec415fdb0a"},"oracle":{"captured":"2026-11-01T00:24:42Z","input":"xxh64:0546c2dd11a85c07"},"photon":{"captured":"2026-11-01T00:24:37Z","input":"xxh64:8dbfd0c521fd470a"},"rhel":{"captured":"2026-11-01T01:08:40Z","input":"xxh64:57c5e6a7f9f134ff"},"secureos":{"captured":"2026-11-01T00:24:34Z","input":"xxh64:ac7fa7f44e8ed7dd"},"sles":{"captured":"2026-11-01T00:26:56Z","input":"xxh64:025a1565b2cc7cdf"},"ubuntu":{"captured":"2026-11-01T00:25:58Z","input":"xxh64:9ab4d29f0ea6275d"},"wolfi":{"captured":"2026-11-01T00:25:02Z","input":"xxh64:d27b08e998baab8e"}}},"timestamp":"2026-11-02T03:07:43.871409961Z"}}