Critical
0
High
4
Medium
2
Low
1
Unknown
0
Not affected
0
Trivy 0.76.1 scan of the Python dependencies pinned in the release requirements file, with the vulnerability database as of 2026-11-02. The Python runtime embedded by the build is not covered.
Requirements without a pinned version, not scanned: setuptools, psycopg2-binary, nzpy.
This release ships FastTransfer v0.18.1, reported separately.
Vulnerabilities (7)
| Severity | Identifier | CVSS | Package | Version | Fixed in | Description | Assessment |
|---|---|---|---|---|---|---|---|
| High | CVE-2026-26007 GHSA-r6ph-v2qm-q3c2 | 8.2 | cryptography transitive | 41.0.7 | 46.0.5 | cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves | Not assessed |
| High | CVE-2023-50782 GHSA-3ww4-gg4f-jr7f | 7.5 | cryptography transitive | 41.0.7 | 42.0.0 | python-cryptography: Bleichenbacher timing oracle attack against RSA decryption - incomplete fix for CVE-2020-25659 | Not assessed |
| High | CVE-2024-26130 GHSA-6vqw-3v5j-54x4 | 7.5 | cryptography transitive | 41.0.7 | 42.0.4 | python-cryptography: NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override | Not assessed |
| High | GHSA-537c-gmf6-5ccf | 7.5 | cryptography transitive | 41.0.7 | 48.0.1 | Vulnerable OpenSSL included in cryptography wheels | Not assessed |
| Medium | CVE-2024-0727 GHSA-9v9h-cgj8-h64p | 5.5 | cryptography transitive | 41.0.7 | 42.0.2 | openssl: denial of service via null dereference | Not assessed |
| Medium | GHSA-h4gh-qq45-vh27 | cryptography transitive | 41.0.7 | 43.0.1 | pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels | Not assessed | |
| Low | CVE-2026-34073 GHSA-m959-cc7f-wv43 | 5.3 | cryptography transitive | 41.0.7 | 46.0.6 | python-cryptography: Cryptography: Security bypass due to improper DNS name constraint validation | Not assessed |
Dependency licenses
undetermined