{
  "product": "LakeXpress",
  "generatedAt": "2026-11-02T15:13:41.034Z",
  "releases": [
    {
      "tag": "v0.2.0",
      "date": "2026-01-08T20:28:11+01:00",
      "commit": "b06420263e8398d894b7d58fa2cb6b35bade7cec",
      "scannedAt": "2026-11-02T15:12:55.023912241Z",
      "trivyVersion": "0.76.1",
      "packages": 62,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 29,
        "MEDIUM": 21,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.2",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-21226",
          "aliases": [
            "GHSA-jm66-cg57-jjv5"
          ],
          "pkg": "azure-core",
          "installed": "1.37.0",
          "fixed": "1.38.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Azure Core is vulnerable to deserialization of untrusted data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-21226",
          "published": "2026-01-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-23490",
          "aliases": [
            "GHSA-63vm-454h-vhhq"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.2",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID",
          "url": "https://avd.aquasec.com/nvd/cve-2026-23490",
          "published": "2026-01-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-22701",
          "aliases": [
            "GHSA-qmgc-5h2g-mvrw"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "3.20.3",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-22701",
          "published": "2026-01-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.1",
      "date": "2026-01-13T18:12:02+01:00",
      "commit": "895d425111fb29dfd544ea504ec89ab0843b2ca2",
      "scannedAt": "2026-11-02T15:12:55.242136972Z",
      "trivyVersion": "0.76.1",
      "packages": 62,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 29,
        "MEDIUM": 21,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.2",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-21226",
          "aliases": [
            "GHSA-jm66-cg57-jjv5"
          ],
          "pkg": "azure-core",
          "installed": "1.37.0",
          "fixed": "1.38.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Azure Core is vulnerable to deserialization of untrusted data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-21226",
          "published": "2026-01-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-23490",
          "aliases": [
            "GHSA-63vm-454h-vhhq"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.2",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID",
          "url": "https://avd.aquasec.com/nvd/cve-2026-23490",
          "published": "2026-01-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-22701",
          "aliases": [
            "GHSA-qmgc-5h2g-mvrw"
          ],
          "pkg": "filelock",
          "installed": "3.20.2",
          "fixed": "3.20.3",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-22701",
          "published": "2026-01-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.2",
      "date": "2026-01-15T14:56:18+01:00",
      "commit": "dd55b82d5e91e2ca7df2ac7ab2270dfb2219ba11",
      "scannedAt": "2026-11-02T15:12:55.462585799Z",
      "trivyVersion": "0.76.1",
      "packages": 63,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 28,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-23490",
          "aliases": [
            "GHSA-63vm-454h-vhhq"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.2",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID",
          "url": "https://avd.aquasec.com/nvd/cve-2026-23490",
          "published": "2026-01-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.1",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.3",
      "date": "2026-01-19T22:12:10+01:00",
      "commit": "fe1a95e6439414e27dceee5d651f7e8486a5e348",
      "scannedAt": "2026-11-02T15:12:55.681953166Z",
      "trivyVersion": "0.76.1",
      "packages": 63,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.4",
      "date": "2026-01-22T16:18:51+01:00",
      "commit": "af6e9ac9346ed415557580869cde4a96fcf0e29c",
      "scannedAt": "2026-11-02T15:12:55.900524312Z",
      "trivyVersion": "0.76.1",
      "packages": 64,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.5",
      "date": "2026-01-26T18:03:44+01:00",
      "commit": "4768198ffc4851abb7556b84c9dc2c3506c049ad",
      "scannedAt": "2026-11-02T15:12:56.114876381Z",
      "trivyVersion": "0.76.1",
      "packages": 64,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.3",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.6",
      "date": "2026-01-29T12:15:04+01:00",
      "commit": "dd68869aed82d933a4a7e731188b338cad604041",
      "scannedAt": "2026-11-02T15:12:56.330479425Z",
      "trivyVersion": "0.76.1",
      "packages": 67,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.7",
      "date": "2026-02-13T11:34:15+01:00",
      "commit": "e61fc4580fe2e8bb684d4fdb1bbe6fcdf8f53d78",
      "scannedAt": "2026-11-02T15:12:56.552017126Z",
      "trivyVersion": "0.76.1",
      "packages": 67,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.8",
      "date": "2026-02-19T17:58:23+01:00",
      "commit": "1646f1dd3a0c7aba5e359681e35bdf9dad488856",
      "scannedAt": "2026-11-02T15:12:56.767656489Z",
      "trivyVersion": "0.76.1",
      "packages": 67,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.9",
      "date": "2026-02-24T17:11:46+01:00",
      "commit": "677edf29409e5866eec6635383157d8cf320e629",
      "scannedAt": "2026-11-02T15:12:56.992691116Z",
      "trivyVersion": "0.76.1",
      "packages": 67,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 27,
        "MEDIUM": 20,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.1.4",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-26007",
          "aliases": [
            "GHSA-r6ph-v2qm-q3c2"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.5",
          "severity": "HIGH",
          "score": 8.2,
          "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "url": "https://avd.aquasec.com/nvd/cve-2026-26007",
          "published": "2026-02-10",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-0994",
          "aliases": [
            "GHSA-7gcm-g887-7qv7"
          ],
          "pkg": "protobuf",
          "installed": "6.33.4",
          "fixed": "6.33.5, 5.29.6",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
          "url": "https://avd.aquasec.com/nvd/cve-2026-0994",
          "published": "2026-01-23",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.2.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.20.3",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.10.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.4",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.10",
      "date": "2026-03-03T10:53:15+01:00",
      "commit": "031e07f8cae7927c0d8114bd30d98fbf0a637fa4",
      "scannedAt": "2026-11-02T15:12:57.222281118Z",
      "trivyVersion": "0.76.1",
      "packages": 68,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.2.11",
      "date": "2026-03-12T12:07:27+01:00",
      "commit": "bf3b298d6408c9e37ea063da181493a44c915215",
      "scannedAt": "2026-11-02T15:12:57.462431826Z",
      "trivyVersion": "0.76.1",
      "packages": 68,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.0",
      "date": "2026-03-12T14:59:56+01:00",
      "commit": "589440703ccecf18a3d7d43000443e23aa740dbf",
      "scannedAt": "2026-11-02T15:12:57.703922286Z",
      "trivyVersion": "0.76.1",
      "packages": 68,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.1",
      "date": "2026-03-13T17:20:39+01:00",
      "commit": "93e97d3a7a80a31dc1b5ca8dc65de44edd2a1019",
      "scannedAt": "2026-11-02T15:12:57.928148943Z",
      "trivyVersion": "0.76.1",
      "packages": 68,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 3,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-30922",
          "aliases": [
            "GHSA-jr27-m4p2-rc6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.3",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
          "url": "https://avd.aquasec.com/nvd/cve-2026-30922",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.2",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-32597",
          "aliases": [
            "GHSA-752w-5fwx-jx9f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.12.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)",
          "url": "https://avd.aquasec.com/nvd/cve-2026-32597",
          "published": "2026-03-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.11.0",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.0",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.2",
      "date": "2026-03-23T15:30:06+01:00",
      "commit": "230762bc19edadeddaea9de73ca506dde0e7272b",
      "scannedAt": "2026-11-02T15:12:58.157562193Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.3",
      "date": "2026-03-23T20:22:50+01:00",
      "commit": "ef53ef53b7e45cd466dc2a4f0b89a71f8a262699",
      "scannedAt": "2026-11-02T15:12:58.394136419Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.4",
      "date": "2026-03-25T18:35:44+01:00",
      "commit": "b54bc023b18b974572ff76a0689263009c8380b8",
      "scannedAt": "2026-11-02T15:12:58.636582976Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.5",
      "date": "2026-03-25T22:56:48+01:00",
      "commit": "24dd03755117e977f571464f316e96f81885047d",
      "scannedAt": "2026-11-02T15:12:58.8727565Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.6",
      "date": "2026-03-27T15:38:05+01:00",
      "commit": "1fd333fbf451f1d2e50ef63cb73606562a8fe766",
      "scannedAt": "2026-11-02T15:12:59.106718604Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.3.7",
      "date": "2026-03-30T21:28:26+02:00",
      "commit": "9ec91d8935951189f0097403fd235c31e7eacfcd",
      "scannedAt": "2026-11-02T15:12:59.341954673Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.0",
      "date": "2026-04-03T12:17:39+02:00",
      "commit": "abca387000c3bd52f6b086b0fbb83cf7276709d1",
      "scannedAt": "2026-11-02T15:12:59.569310895Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.1",
      "date": "2026-04-08T18:59:37+02:00",
      "commit": "0ff6e6e253cd5ae249e9c5c1df197b698d6b4f69",
      "scannedAt": "2026-11-02T15:12:59.804316802Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 27,
        "MEDIUM": 27,
        "LOW": 5,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.12",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27459",
          "aliases": [
            "GHSA-5pwr-322w-8jr4"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "HIGH",
          "score": 9.8,
          "title": "pyOpenSSL: DTLS cookie callback buffer overflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27459",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "5.4.0",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-39892",
          "aliases": [
            "GHSA-p423-j2cm-9vmq"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.7",
          "severity": "MEDIUM",
          "score": 9.8,
          "title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "url": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "published": "2026-04-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.3.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-25645",
          "aliases": [
            "GHSA-gc5v-m9x4-r6x2"
          ],
          "pkg": "requests",
          "installed": "2.32.5",
          "fixed": "2.33.0",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "requests: Requests: Security bypass due to predictable temporary file creation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-25645",
          "published": "2026-03-25",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-27448",
          "aliases": [
            "GHSA-vp96-hxj8-p424"
          ],
          "pkg": "pyopenssl",
          "installed": "25.3.0",
          "fixed": "26.0.0",
          "severity": "LOW",
          "score": 5.4,
          "title": "pyOpenSSL: TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback",
          "url": "https://avd.aquasec.com/nvd/cve-2026-27448",
          "published": "2026-03-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-34073",
          "aliases": [
            "GHSA-m959-cc7f-wv43"
          ],
          "pkg": "cryptography",
          "installed": "46.0.5",
          "fixed": "46.0.6",
          "severity": "LOW",
          "score": 5.3,
          "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-34073",
          "published": "2026-03-31",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.2",
      "date": "2026-04-21T17:12:32+02:00",
      "commit": "6021b1eada87acbdac3709c35efaa2c299c85f69",
      "scannedAt": "2026-11-02T15:13:00.028055552Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.3",
      "date": "2026-04-28T15:25:38+02:00",
      "commit": "8de1aa871f4f4c907fa1d5f696606716bffbf649",
      "scannedAt": "2026-11-02T15:13:00.253230843Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.4",
      "date": "2026-05-26T18:30:12+02:00",
      "commit": "9bce4d705e36188b773f50d19b8e2947831f8418",
      "scannedAt": "2026-11-02T15:13:00.4894194Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.5",
      "date": "2026-08-04T20:36:44+02:00",
      "commit": "d7e37e36fa5c9a5e7fa59d1487eb2ebe6621a9d9",
      "scannedAt": "2026-11-02T15:13:00.720247975Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.7",
      "date": "2026-08-05T17:54:03+02:00",
      "commit": "08597652b86b53ac050fcb32d09663041c93b61c",
      "scannedAt": "2026-11-02T15:13:00.946029846Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.8",
      "date": "2026-08-05T21:14:20+02:00",
      "commit": "41753f3ac953939216f7e4c32a23c7a3e6badb56",
      "scannedAt": "2026-11-02T15:13:01.179549185Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.9",
      "date": "2026-09-24T11:59:15+02:00",
      "commit": "96328beaecfab3d7ed2fdcae423e46f81b9a009e",
      "scannedAt": "2026-11-02T15:13:01.410839925Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.4.10",
      "date": "2026-09-24T14:01:41+02:00",
      "commit": "eb5cd3abca90fb5b2bbc6d619c312ae2d748895d",
      "scannedAt": "2026-11-02T15:13:01.62911431Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.5.0",
      "date": "2026-10-26T16:53:42+01:00",
      "commit": "6e3fb9e933e1af6d97840a57427d376d080e5352",
      "scannedAt": "2026-11-02T15:13:01.873001459Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [
        {
          "product": "fastbcp",
          "version": "1.4.0"
        }
      ],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.6.0",
      "date": "2026-10-26T21:25:49+01:00",
      "commit": "73fbbea9db833ca663b88d1eaad6580a9cca91c0",
      "scannedAt": "2026-11-02T15:13:02.195372291Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 4,
        "HIGH": 26,
        "MEDIUM": 25,
        "LOW": 3,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [
        {
          "product": "fastbcp",
          "version": "1.4.0"
        }
      ],
      "licenses": {},
      "vulnerabilities": [
        {
          "id": "CVE-2026-8838",
          "aliases": [
            "GHSA-29h4-r29x-hchv"
          ],
          "pkg": "redshift-connector",
          "installed": "2.1.13",
          "fixed": "2.1.14",
          "severity": "CRITICAL",
          "score": 9.8,
          "title": "amazon-redshift-python-driver vulnerable to Remote Code Execution via eval() Injection",
          "url": "https://avd.aquasec.com/nvd/cve-2026-8838",
          "published": "2026-05-18",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-15925",
          "aliases": [
            "GHSA-5cc2-282f-jjq2"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "3.18.1, 4.7.1",
          "severity": "CRITICAL",
          "score": 9.2,
          "title": "snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-15925",
          "published": "2026-07-16",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-6q48-6c7w-9gw2",
          "aliases": [],
          "pkg": "certifi",
          "installed": "2026.2.25",
          "fixed": "2026.10.18",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "certifi bundles emSign root CAs with compromised intermediate CA keys",
          "url": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102268",
          "aliases": [
            "GHSA-ffc3-869f-jxw9"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "CRITICAL",
          "score": 9.1,
          "title": "pyjwt: PyJWT: Authentication bypass via improper public key validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102268",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102267",
          "aliases": [
            "GHSA-9v7f-9g4p-ffgj"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 9.1,
          "title": "pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102267",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97689",
          "aliases": [
            "GHSA-vxq7-64xx-v4gw"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.9,
          "title": "urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97689",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69249",
          "aliases": [
            "GHSA-jwv3-5hgf-82ww"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69249",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-43871",
          "aliases": [
            "GHSA-8wv5-x4w7-5gww"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 8.7,
          "title": "thrift: Apache Thrift: Denial of Service via infinite loop",
          "url": "https://avd.aquasec.com/nvd/cve-2026-43871",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49272",
          "aliases": [
            "GHSA-3jp2-3mrg-2vxc"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.5,
          "title": "OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49272",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-118669",
          "aliases": [
            "GHSA-7984-qgvg-3j9c"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "HIGH",
          "score": 8.4,
          "title": "oauthlib: oauthlib: privilege escalation via client identity confusion in token grant handlers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-118669",
          "published": "2026-10-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69247",
          "aliases": [
            "GHSA-g6cj-pr64-35w5"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "50.0.0",
          "severity": "HIGH",
          "score": 8.2,
          "title": "python-cryptography: python-cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69247",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97687",
          "aliases": [
            "GHSA-8988-9cw3-xx77"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "HIGH",
          "score": 8.1,
          "title": "urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97687",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-537c-gmf6-5ccf",
          "aliases": [],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "48.0.1",
          "severity": "HIGH",
          "score": 7.5,
          "title": "Vulnerable OpenSSL included in cryptography wheels",
          "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf",
          "published": "2026-06-15",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41066",
          "aliases": [
            "GHSA-vfmq-68hx-4jfw"
          ],
          "pkg": "lxml",
          "installed": "6.0.2",
          "fixed": "6.1.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "lxml: python: lxml: Information disclosure via untrusted XML input leading to local file read",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41066",
          "published": "2026-04-24",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119194",
          "aliases": [
            "GHSA-fm9c-5rcf-2q5p"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via hash collisions in schemaless decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119194",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119195",
          "aliases": [
            "GHSA-9m75-vc3g-4x39"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic processing of fragmented ASN.1 data",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119195",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119196",
          "aliases": [
            "GHSA-2qm8-x737-gmw5"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via constructed bit string decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119196",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-119197",
          "aliases": [
            "GHSA-mm57-4v3p-rchx"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.5",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via quadratic complexity in binary REAL decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-119197",
          "published": "2026-10-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59884",
          "aliases": [
            "GHSA-m4p7-r5rc-7g4j"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-pyasn1: pyasn1: Denial of Service via crafted BER input",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59884",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59885",
          "aliases": [
            "GHSA-8ppf-4f7h-5ppj"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59885",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-59886",
          "aliases": [
            "GHSA-hm4w-wwcw-mr6r"
          ],
          "pkg": "pyasn1",
          "installed": "0.6.3",
          "fixed": "0.6.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values",
          "url": "https://avd.aquasec.com/nvd/cve-2026-59886",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49476",
          "aliases": [
            "GHSA-2wc2-fm75-p42x"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49476",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49477",
          "aliases": [
            "GHSA-836r-79rf-4m37"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.8.4",
          "severity": "HIGH",
          "score": 7.5,
          "title": "soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49477",
          "published": "2026-07-14",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-41608",
          "aliases": [
            "GHSA-6pjx-3pjc-mrj8"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "thrift: Apache Thrift Python bindings: Denial of Service via data amplification",
          "url": "https://avd.aquasec.com/nvd/cve-2026-41608",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44432",
          "aliases": [
            "GHSA-mf9v-mfxr-j63j"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 7.5,
          "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44432",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102271",
          "aliases": [
            "GHSA-p4g4-x82p-q773"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102271",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48526",
          "aliases": [
            "GHSA-xgmm-8j9v-c9wx"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48526",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "GHSA-pxh4-856f-4h89",
          "aliases": [],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "HIGH",
          "score": 7.4,
          "title": "PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery",
          "url": "https://github.com/advisories/GHSA-pxh4-856f-4h89",
          "published": "2026-10-22",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112940",
          "aliases": [
            "GHSA-v4x8-3wr5-3wq8"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "HIGH",
          "score": 7.1,
          "title": "filelock: filelock: Arbitrary file overwrite via insecure database file reopening",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112940",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-44431",
          "aliases": [
            "GHSA-qccp-gfcp-xxvc"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.7.0",
          "severity": "HIGH",
          "score": 5.9,
          "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-44431",
          "published": "2026-05-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102275",
          "aliases": [
            "GHSA-x33g-cr3x-6449"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 8.2,
          "title": "pyjwt: PyJWT: Token verification bypass via mismatched OKP key components",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102275",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101917",
          "aliases": [
            "GHSA-2gx3-rcp4-g85q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101917",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-101918",
          "aliases": [
            "GHSA-42vr-xj54-vc7v"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.15.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload",
          "url": "https://avd.aquasec.com/nvd/cve-2026-101918",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102274",
          "aliases": [
            "GHSA-w6j9-cwv2-h6wq"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 7.5,
          "title": "pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102274",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-69248",
          "aliases": [
            "GHSA-m2h6-j472-rp4c"
          ],
          "pkg": "cryptography",
          "installed": "46.0.7",
          "fixed": "49.0.0",
          "severity": "MEDIUM",
          "score": 7.4,
          "title": "python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees",
          "url": "https://avd.aquasec.com/nvd/cve-2026-69248",
          "published": "2026-08-03",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-97688",
          "aliases": [
            "GHSA-gh4c-6fx4-qh6g"
          ],
          "pkg": "urllib3",
          "installed": "2.6.3",
          "fixed": "2.8.0",
          "severity": "MEDIUM",
          "score": 6.9,
          "title": "urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-97688",
          "published": "2026-09-29",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49265",
          "aliases": [
            "GHSA-xpv3-w29h-x7cv"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.8,
          "title": "oauthlib: oauthlib: Timing attack vulnerability in PKCE code_verifier/code_challenge comparison allows authorization code recovery",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49265",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-103001",
          "aliases": [
            "GHSA-gvp8-978c-rx2q"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "pyjwt: pyjwt: Token validation bypass via options dictionary mutation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-103001",
          "published": "2026-09-30",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86597",
          "aliases": [
            "GHSA-qqj6-54q6-cxv6"
          ],
          "pkg": "snowflake-connector-python",
          "installed": "4.4.0",
          "fixed": "4.7.3",
          "severity": "MEDIUM",
          "score": 6.5,
          "title": "Snowflake drivers writes sensitive information to logs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86597",
          "published": "2026-09-08",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112909",
          "aliases": [
            "GHSA-69hj-f68j-2879"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: arbitrary file truncation via lock path replacement",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112909",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112936",
          "aliases": [
            "GHSA-j8f7-rjxc-mr56"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.0.9",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "filelock: filelock: Lock redirection and mutual exclusion bypass via symbolic links",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112936",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-49264",
          "aliases": [
            "GHSA-hj66-6f7g-4r5v"
          ],
          "pkg": "oauthlib",
          "installed": "3.3.1",
          "fixed": "4.0.0",
          "severity": "MEDIUM",
          "score": 6.1,
          "title": "oauthlib: oauthlib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-49264",
          "published": "2026-10-13",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-85999",
          "aliases": [
            "GHSA-j934-xhv5-fg8f"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-85999",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-86000",
          "aliases": [
            "GHSA-gjv8-xp57-g29c"
          ],
          "pkg": "soupsieve",
          "installed": "2.8.3",
          "fixed": "2.9.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "soupsieve: Soup Sieve: Denial of Service via crafted CSS selectors",
          "url": "https://avd.aquasec.com/nvd/cve-2026-86000",
          "published": "2026-09-17",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-66053",
          "aliases": [
            "GHSA-hwrj-9rr4-24xh"
          ],
          "pkg": "thrift",
          "installed": "0.20.0",
          "fixed": "0.24.0",
          "severity": "MEDIUM",
          "score": 5.9,
          "title": "thrift: Apache Thrift Python bindings: Information disclosure due to improper certificate validation",
          "url": "https://avd.aquasec.com/nvd/cve-2026-66053",
          "published": "2026-07-27",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112915",
          "aliases": [
            "GHSA-cwqr-hh33-gh44"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.5,
          "title": "filelock: filelock: Denial of Service via crafted SQLite lock database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112915",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102269",
          "aliases": [
            "GHSA-hxm8-2xgr-2p9m"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "pyjwt: PyJWT: Token revocation bypass via non-canonical signature decoding",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102269",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48523",
          "aliases": [
            "GHSA-jq35-7prp-9v3f"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.4,
          "title": "python-pyjwt: PyJWT: Verifier-side algorithm bypass leads to unauthorized information access",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48523",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112910",
          "aliases": [
            "GHSA-8mx5-7m5m-r77g"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112910",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-45409",
          "aliases": [
            "GHSA-65pc-fj4g-8rjx"
          ],
          "pkg": "idna",
          "installed": "3.11",
          "fixed": "3.15",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-idna: idna: Denial of Service via specially crafted long inputs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-45409",
          "published": "2026-06-05",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48525",
          "aliases": [
            "GHSA-w7vc-732c-9m39"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 5.3,
          "title": "python-pyjwt: PyJWT: Denial of Service via processing of crafted detached JWS tokens",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48525",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-102270",
          "aliases": [
            "GHSA-jwrc-g2q2-pq5p"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.14.0",
          "severity": "MEDIUM",
          "score": 4.9,
          "title": "pyjwt: pyjwt: Denial of Service via regular expression backtracking in is_pem_format",
          "url": "https://avd.aquasec.com/nvd/cve-2026-102270",
          "published": "2026-09-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112935",
          "aliases": [
            "GHSA-fq56-3cx3-fjxp"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized concurrent access via stale lock cleanup race condition",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112935",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112939",
          "aliases": [
            "GHSA-rfpc-qcw5-3pc4"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "MEDIUM",
          "score": 4.7,
          "title": "filelock: filelock: Unauthorized lock acquisition via forged process identifier in SoftFileLock",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112939",
          "published": "2026-10-20",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48522",
          "aliases": [
            "GHSA-993g-76c3-p5m4"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "MEDIUM",
          "score": 4.2,
          "title": "python-pyjwt: PyJWT: Server-Side Request Forgery (SSRF) via uncontrolled URL fetching in PyJWKClient",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48522",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-48524",
          "aliases": [
            "GHSA-fhv5-28vv-h8m8"
          ],
          "pkg": "pyjwt",
          "installed": "2.12.1",
          "fixed": "2.13.0",
          "severity": "LOW",
          "score": 5.9,
          "title": "python-pyjwt: PyJWT: Denial of Service via unverified JSON Web Token key IDs",
          "url": "https://avd.aquasec.com/nvd/cve-2026-48524",
          "published": "2026-05-28",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112913",
          "aliases": [
            "GHSA-9vhv-jxww-xfm5"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 3.3,
          "title": "filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112913",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        },
        {
          "id": "CVE-2026-112907",
          "aliases": [
            "GHSA-567q-5qvw-pf92"
          ],
          "pkg": "filelock",
          "installed": "3.25.2",
          "fixed": "4.2.1",
          "severity": "LOW",
          "score": 2.5,
          "title": "filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break",
          "url": "https://avd.aquasec.com/nvd/cve-2026-112907",
          "published": "",
          "direct": false,
          "via": [],
          "vex": null
        }
      ]
    },
    {
      "tag": "v0.6.1",
      "date": "2026-10-28T18:07:17+01:00",
      "commit": "d2471c5db75121f322295d00a474227ab166a06a",
      "scannedAt": "2026-11-02T15:13:02.503624266Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 0,
        "HIGH": 0,
        "MEDIUM": 0,
        "LOW": 0,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [
        {
          "product": "fastbcp",
          "version": "1.4.0"
        }
      ],
      "licenses": {},
      "vulnerabilities": []
    },
    {
      "tag": "v0.6.2",
      "date": "2026-10-29T22:06:53+01:00",
      "commit": "1c4cb01719088c26a86886f6587d11d4903fcbc3",
      "scannedAt": "2026-11-02T15:13:02.829449879Z",
      "trivyVersion": "0.76.1",
      "packages": 74,
      "directPackages": 0,
      "openCounts": {
        "CRITICAL": 0,
        "HIGH": 0,
        "MEDIUM": 0,
        "LOW": 0,
        "UNKNOWN": 0
      },
      "notAffected": 0,
      "ignoredPackages": [],
      "missingPackages": [],
      "unpinnedPackages": [],
      "bundles": [
        {
          "product": "fastbcp",
          "version": "1.4.0"
        }
      ],
      "licenses": {},
      "vulnerabilities": []
    }
  ]
}