{ "product": "MigratorXpress", "generatedAt": "2026-11-02T15:13:41.022Z", "releases": [ { "tag": "v0.6.18", "date": "2026-01-09T10:22:49+01:00", "commit": "126399e21b5b4e555f442f19be73152a25788ad2", "scannedAt": "2026-11-02T15:12:50.595925637Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.19", "date": "2026-01-19T16:15:26+01:00", "commit": "21fc9d8f2dadb2f4143b5493f643bd3afa508c20", "scannedAt": "2026-11-02T15:12:50.799857711Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.20", "date": "2026-01-29T17:07:53+01:00", "commit": "99c2d4642405de79f97f7ed317b565747bc3d709", "scannedAt": "2026-11-02T15:12:51.004662683Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.21", "date": "2026-02-02T15:36:03+01:00", "commit": "f60fb96225e9ebd9d246255f308dbeee420ce37f", "scannedAt": "2026-11-02T15:12:51.210052842Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.22", "date": "2026-02-03T13:28:05+01:00", "commit": "61248abbcb935733e6e31085061851379c8b9c06", "scannedAt": "2026-11-02T15:12:51.406427834Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.23", "date": "2026-02-06T08:49:18+01:00", "commit": "ab85c197973bba45ef22a6d27143b2a54c0dd503", "scannedAt": "2026-11-02T15:12:51.608749516Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.24", "date": "2026-02-06T17:10:15+01:00", "commit": "bd55970995f4e562e0b2ec11eaf1ad394a74a396", "scannedAt": "2026-11-02T15:12:51.811382446Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.25", "date": "2026-03-02T15:45:48+01:00", "commit": "2cc7ba9a60bf65952c97f3c18a2413e920dcafea", "scannedAt": "2026-11-02T15:12:52.011684528Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.26", "date": "2026-03-13T17:41:40+01:00", "commit": "ae94d3bcb19bd71730ae9664aa94476a3c130356", "scannedAt": "2026-11-02T15:12:52.214151787Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.27", "date": "2026-03-18T17:01:44+01:00", "commit": "55cc4479f888972c040effc37e95127b0941a7e8", "scannedAt": "2026-11-02T15:12:52.414466898Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.28", "date": "2026-04-09T16:35:36+02:00", "commit": "59d21965c67fdd13f120f7cec75b3c228b0cf017", "scannedAt": "2026-11-02T15:12:52.61274841Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.29", "date": "2026-04-09T17:14:13+02:00", "commit": "105e613b703b52c21b304857d32f274c9ffe9723", "scannedAt": "2026-11-02T15:12:52.812337493Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.30", "date": "2026-04-17T19:28:57+02:00", "commit": "a5cc333ee1370193db49e9ecf8a6f731fdc572b3", "scannedAt": "2026-11-02T15:12:53.015012361Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.31", "date": "2026-04-27T15:36:25+02:00", "commit": "189ea744f7dfc0a5658a5a16e93ed35d3899cbb6", "scannedAt": "2026-11-02T15:12:53.216061171Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.32", "date": "2026-05-11T18:29:53+02:00", "commit": "b8275e621f20ac66a0177e08e66f69205b114b18", "scannedAt": "2026-11-02T15:12:53.413199247Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.33", "date": "2026-05-26T18:38:15+02:00", "commit": "5c472282eb3b5e97a5be7f9a17876ac8819365ab", "scannedAt": "2026-11-02T15:12:53.611363116Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.6.34", "date": "2026-05-29T15:10:50+02:00", "commit": "68d7ce422186ddad0f8c83358cd776853897c4fa", "scannedAt": "2026-11-02T15:12:53.807713491Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.7.0", "date": "2026-06-12T12:35:37+02:00", "commit": "9a0cf43c133f981e732a9e766267cd327b216db0", "scannedAt": "2026-11-02T15:12:54.006953194Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.7.1", "date": "2026-06-26T12:16:19+02:00", "commit": "ec035e5efe46de0d122f5c327d662d82fdf7ff91", "scannedAt": "2026-11-02T15:12:54.200611342Z", "trivyVersion": "0.76.1", "packages": 21, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.7.2", "date": "2026-10-12T16:56:22+02:00", "commit": "d47b811cba38789ed6154735ae3074287e8d34f2", "scannedAt": "2026-11-02T15:12:54.398106471Z", "trivyVersion": "0.76.1", "packages": 22, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.7.3", "date": "2026-10-13T11:34:52+02:00", "commit": "a2697a4f3302bff2ed5a7d780b95dfa6f85c4847", "scannedAt": "2026-11-02T15:12:54.59564322Z", "trivyVersion": "0.76.1", "packages": 22, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] }, { "tag": "v0.8.0", "date": "2026-10-26T21:26:12+01:00", "commit": "85c1f7d2b59ccbdec25deb8c641d95bc178e34da", "scannedAt": "2026-11-02T15:12:54.78963809Z", "trivyVersion": "0.76.1", "packages": 22, "directPackages": 0, "openCounts": { "CRITICAL": 0, "HIGH": 4, "MEDIUM": 2, "LOW": 1, "UNKNOWN": 0 }, "notAffected": 0, "ignoredPackages": [], "missingPackages": [], "unpinnedPackages": [ "setuptools", "psycopg2-binary", "nzpy" ], "bundles": [ { "product": "fasttransfer", "version": "0.18.1" } ], "licenses": {}, "vulnerabilities": [ { "id": "CVE-2026-26007", "aliases": [ "GHSA-r6ph-v2qm-q3c2" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.5", "severity": "HIGH", "score": 8.2, "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves", "url": "https://avd.aquasec.com/nvd/cve-2026-26007", "published": "2026-02-10", "direct": false, "via": [], "vex": null }, { "id": "CVE-2023-50782", "aliases": [ "GHSA-3ww4-gg4f-jr7f" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.0", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659", "url": "https://avd.aquasec.com/nvd/cve-2023-50782", "published": "2024-02-05", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-26130", "aliases": [ "GHSA-6vqw-3v5j-54x4" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.4", "severity": "HIGH", "score": 7.5, "title": "python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override", "url": "https://avd.aquasec.com/nvd/cve-2024-26130", "published": "2024-02-21", "direct": false, "via": [], "vex": null }, { "id": "GHSA-537c-gmf6-5ccf", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "48.0.1", "severity": "HIGH", "score": 7.5, "title": "Vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-537c-gmf6-5ccf", "published": "2026-06-15", "direct": false, "via": [], "vex": null }, { "id": "CVE-2024-0727", "aliases": [ "GHSA-9v9h-cgj8-h64p" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "42.0.2", "severity": "MEDIUM", "score": 5.5, "title": "openssl: denial of service via null dereference", "url": "https://avd.aquasec.com/nvd/cve-2024-0727", "published": "2024-01-26", "direct": false, "via": [], "vex": null }, { "id": "GHSA-h4gh-qq45-vh27", "aliases": [], "pkg": "cryptography", "installed": "41.0.7", "fixed": "43.0.1", "severity": "MEDIUM", "score": null, "title": "pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels", "url": "https://github.com/advisories/GHSA-h4gh-qq45-vh27", "published": "2024-09-03", "direct": false, "via": [], "vex": null }, { "id": "CVE-2026-34073", "aliases": [ "GHSA-m959-cc7f-wv43" ], "pkg": "cryptography", "installed": "41.0.7", "fixed": "46.0.6", "severity": "LOW", "score": 5.3, "title": "python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation", "url": "https://avd.aquasec.com/nvd/cve-2026-34073", "published": "2026-03-31", "direct": false, "via": [], "vex": null } ] } ] }