{ "schemaVersion": 1, "gate": "OPEN", "coverage": "INCOMPLETE", "startedUtc": "2026-10-24T07:27:05.547836+00:00", "finishedUtc": "2026-10-24T07:27:13.317497+00:00", "lockPath": "tools/summarizer/requirements-linux.lock", "lockSha256": "36f2912965d183e59f2d8320f3817ca8dd0fee6d76e05cfd63ac92defe6c6031", "rawDirectory": ".artifacts/p9-requal-01/security/python-locked", "rawManifestSha256": "3dac31a50d803e4c4a27c43e683dcf7ee7f2587a122cfb8c38fc5276fb7233ec", "rawSummarySha256": "31fe495d72a9b11564c8e78943be7901610e023a8606b5aeb53710871092ca20", "exactPins": [ { "name": "annotated-doc", "version": "0.0.5" }, { "name": "annotated-types", "version": "0.8.0" }, { "name": "anyio", "version": "4.14.2" }, { "name": "cachetools", "version": "5.5.2" }, { "name": "certifi", "version": "2026.7.22" }, { "name": "charset-normalizer", "version": "3.5.1" }, { "name": "click", "version": "8.5.0" }, { "name": "fastapi", "version": "0.141.1" }, { "name": "filelock", "version": "3.32.4" }, { "name": "fsspec", "version": "2026.7.0" }, { "name": "h11", "version": "0.16.0" }, { "name": "hf-xet", "version": "1.6.0" }, { "name": "httptools", "version": "0.8.0" }, { "name": "huggingface-hub", "version": "0.36.2" }, { "name": "idna", "version": "3.19" }, { "name": "jinja2", "version": "3.1.6" }, { "name": "lxml", "version": "6.1.2" }, { "name": "markupsafe", "version": "3.0.3" }, { "name": "mpmath", "version": "1.3.0" }, { "name": "networkx", "version": "3.6.1" }, { "name": "numpy", "version": "2.4.6" }, { "name": "packaging", "version": "26.3" }, { "name": "pillow", "version": "12.3.0" }, { "name": "pydantic", "version": "2.10.6" }, { "name": "pydantic-core", "version": "2.27.2" }, { "name": "pymupdf", "version": "1.25.5" }, { "name": "pypdf", "version": "6.16.2" }, { "name": "pytesseract", "version": "0.3.13" }, { "name": "python-docx", "version": "1.1.2" }, { "name": "python-dotenv", "version": "1.2.3" }, { "name": "python-multipart", "version": "0.0.32" }, { "name": "pyyaml", "version": "6.0.3" }, { "name": "regex", "version": "2026.7.19" }, { "name": "requests", "version": "2.34.2" }, { "name": "safetensors", "version": "0.8.0" }, { "name": "setuptools", "version": "84.0.0" }, { "name": "starlette", "version": "1.6.0" }, { "name": "sympy", "version": "1.13.1" }, { "name": "tokenizers", "version": "0.21.4" }, { "name": "torch", "version": "2.6.0+cpu" }, { "name": "tqdm", "version": "4.70.0" }, { "name": "transformers", "version": "4.48.3" }, { "name": "typing-extensions", "version": "4.16.0" }, { "name": "typing-inspection", "version": "0.4.4" }, { "name": "urllib3", "version": "2.7.0" }, { "name": "uvicorn", "version": "0.34.0" }, { "name": "uvloop", "version": "0.22.1" }, { "name": "watchfiles", "version": "1.2.0" }, { "name": "websockets", "version": "17.1" } ], "counts": { "exactPins": 49, "queries": 98, "successfulQueries": 97, "queryErrors": 1, "providerRecords": 249, "osvRecords": 137, "pypiRecords": 112, "aliasGroups": 109, "packagesWithAdvisories": 8 }, "errors": [ { "package": "torch", "version": "2.6.0+cpu", "provider": "pypi", "httpStatus": 404, "error": "HTTPError" } ], "groupsPerPackage": { "certifi": 1, "filelock": 3, "pillow": 41, "pypdf": 19, "setuptools": 1, "torch": 19, "transformers": 22, "urllib3": 3 }, "limits": [ "Public exact locked-version advisory metadata only; no installation, resolution or package changes.", "OSV performs upstream version matching; query results are not independently reproduced vulnerabilities.", "PyPI exact torch 2.6.0+cpu release returns 404; no substitute version queried; OSV exact query succeeds.", "249 provider records overlap; 109 groups use published alias equivalence only and are not 109 independent CVEs.", "All returned groups retained; none had withdrawn metadata in this snapshot.", "Severity labels reproduce provider database_specific.severity only; no score inferred or normalized.", "Fixed-version events reproduce upstream data and can differ by branch; they are not compatible upgrade recommendations.", "No exploitability, production package identity, deployed state or provider security acceptance established.", "Static sidecar call sites are documented separately; individual advisory reachability is not adjudicated.", "Audit covers 49 Python lock pins only, excluding OS/native/image packages and unpinned Docker bootstrap upgrades.", "No model load/inference, malicious documents, deployment inspection or runtime dependency changes performed.", "NuGet/npm remediation is separate; Python advisories remain OPEN and coverage incomplete." ], "advisoryGroups": [ {"package":"certifi","lockedVersion":"2026.7.22","identifiers":["GHSA-6q48-6c7w-9gw2","PYSEC-2026-4320"],"primaryLinks":["https://github.com/advisories/GHSA-6q48-6c7w-9gw2"],"publishedFixedVersionEvents":["2026.10.19"],"providerRecordCount":4,"publishedSeverityLabels":["CRITICAL"]}, {"package":"filelock","lockedVersion":"3.32.4","identifiers":["CVE-2026-112940","GHSA-v4x8-3wr5-3wq8"],"primaryLinks":["https://github.com/advisories/GHSA-v4x8-3wr5-3wq8"],"publishedFixedVersionEvents":["4.2.1"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"filelock","lockedVersion":"3.32.4","identifiers":["CVE-2026-112913","GHSA-9vhv-jxww-xfm5"],"primaryLinks":["https://github.com/advisories/GHSA-9vhv-jxww-xfm5"],"publishedFixedVersionEvents":["4.2.1"],"providerRecordCount":2,"publishedSeverityLabels":["LOW"]}, {"package":"filelock","lockedVersion":"3.32.4","identifiers":["CVE-2026-112907","GHSA-567q-5qvw-pf92"],"primaryLinks":["https://github.com/advisories/GHSA-567q-5qvw-pf92"],"publishedFixedVersionEvents":["4.2.1"],"providerRecordCount":2,"publishedSeverityLabels":["LOW"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112394","GHSA-4558-3h8r-v8xp"],"primaryLinks":["https://github.com/advisories/GHSA-4558-3h8r-v8xp"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":1,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112403","GHSA-8g5g-8vmr-9782"],"primaryLinks":["https://github.com/advisories/GHSA-8g5g-8vmr-9782"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":1,"publishedSeverityLabels":["CRITICAL"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112898","GHSA-rfgq-q3w2-pmv2"],"primaryLinks":["https://github.com/advisories/GHSA-rfgq-q3w2-pmv2"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":1,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112902","GHSA-xvh5-g6gv-559v"],"primaryLinks":["https://github.com/advisories/GHSA-xvh5-g6gv-559v"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":1,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112895","GHSA-p4wg-p73j-c528"],"primaryLinks":["https://github.com/advisories/GHSA-p4wg-p73j-c528"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112400","GHSA-65qm-jvmh-6pqg"],"primaryLinks":["https://github.com/advisories/GHSA-65qm-jvmh-6pqg"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112397","GHSA-58r4-6rv3-gfh8"],"primaryLinks":["https://github.com/advisories/GHSA-58r4-6rv3-gfh8"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112896","GHSA-pchr-8j38-3x4p"],"primaryLinks":["https://github.com/advisories/GHSA-pchr-8j38-3x4p"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112897","GHSA-q45j-58j2-45rg"],"primaryLinks":["https://github.com/advisories/GHSA-q45j-58j2-45rg"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112395","GHSA-462x-pgg6-55fp"],"primaryLinks":["https://github.com/advisories/GHSA-462x-pgg6-55fp"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112404","GHSA-c6hw-5grf-ff96"],"primaryLinks":["https://github.com/advisories/GHSA-c6hw-5grf-ff96"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112899","GHSA-vx6w-vv9f-6gvg"],"primaryLinks":["https://github.com/advisories/GHSA-vx6w-vv9f-6gvg"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112402","GHSA-7mwm-ghpf-9vrm"],"primaryLinks":["https://github.com/advisories/GHSA-7mwm-ghpf-9vrm"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112900","GHSA-w889-685w-c8fh"],"primaryLinks":["https://github.com/advisories/GHSA-w889-685w-c8fh"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["CRITICAL"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112893","GHSA-j4m9-6w36-pw47"],"primaryLinks":["https://github.com/advisories/GHSA-j4m9-6w36-pw47"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112392","GHSA-27h8-gf7j-v5hc"],"primaryLinks":["https://github.com/advisories/GHSA-27h8-gf7j-v5hc"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112891","GHSA-fc9g-5qg7-mf45"],"primaryLinks":["https://github.com/advisories/GHSA-fc9g-5qg7-mf45"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112405","GHSA-cp9v-662q-vvx9"],"primaryLinks":["https://github.com/advisories/GHSA-cp9v-662q-vvx9"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112390","GHSA-22hg-r758-rrw9"],"primaryLinks":["https://github.com/advisories/GHSA-22hg-r758-rrw9"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112401","GHSA-74r2-7ff9-mjj2"],"primaryLinks":["https://github.com/advisories/GHSA-74r2-7ff9-mjj2"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112901","GHSA-xgh8-jp6q-p5x8"],"primaryLinks":["https://github.com/advisories/GHSA-xgh8-jp6q-p5x8"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112391","GHSA-254f-3936-288h"],"primaryLinks":["https://github.com/advisories/GHSA-254f-3936-288h"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112894","GHSA-jg86-v3jv-hrpm"],"primaryLinks":["https://github.com/advisories/GHSA-jg86-v3jv-hrpm"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112406","GHSA-f2g6-542v-9j58"],"primaryLinks":["https://github.com/advisories/GHSA-f2g6-542v-9j58"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112399","GHSA-5xm2-6676-qcp9"],"primaryLinks":["https://github.com/advisories/GHSA-5xm2-6676-qcp9"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112892","GHSA-gg2r-wvfm-q9rx"],"primaryLinks":["https://github.com/advisories/GHSA-gg2r-wvfm-q9rx"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112393","GHSA-332p-7hrc-92wf"],"primaryLinks":["https://github.com/advisories/GHSA-332p-7hrc-92wf"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["CRITICAL"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112396","GHSA-4rr5-89j8-mwwm"],"primaryLinks":["https://github.com/advisories/GHSA-4rr5-89j8-mwwm"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96638","GHSA-24rc-8hj2-v98c"],"primaryLinks":["https://github.com/advisories/GHSA-24rc-8hj2-v98c"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96641","GHSA-4rm8-3hmm-39fg"],"primaryLinks":["https://github.com/advisories/GHSA-4rm8-3hmm-39fg"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96640","GHSA-mrfp-p49p-3hf2"],"primaryLinks":["https://github.com/advisories/GHSA-mrfp-p49p-3hf2"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96642","GHSA-3j72-p6qg-6xp7"],"primaryLinks":["https://github.com/advisories/GHSA-3j72-p6qg-6xp7"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96639","GHSA-v9pv-5gc8-w2m6"],"primaryLinks":["https://github.com/advisories/GHSA-v9pv-5gc8-w2m6"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["CRITICAL"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96643","GHSA-g4qv-2jxx-769h"],"primaryLinks":["https://github.com/advisories/GHSA-g4qv-2jxx-769h"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96637","GHSA-g842-9rc4-69pw"],"primaryLinks":["https://github.com/advisories/GHSA-g842-9rc4-69pw"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96644","GHSA-9v9v-9qvf-h2hj"],"primaryLinks":["https://github.com/advisories/GHSA-9v9v-9qvf-h2hj"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96778","GHSA-g7cr-3p24-7wf7"],"primaryLinks":["https://github.com/advisories/GHSA-g7cr-3p24-7wf7"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-96636","GHSA-p8hx-v2p6-rp84"],"primaryLinks":["https://github.com/advisories/GHSA-p8hx-v2p6-rp84"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["GHSA-78g4-xqwv-q3g8"],"primaryLinks":["https://github.com/advisories/GHSA-78g4-xqwv-q3g8"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-114501","GHSA-654x-cwwv-5j9c"],"primaryLinks":["https://github.com/advisories/GHSA-654x-cwwv-5j9c"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pillow","lockedVersion":"12.3.0","identifiers":["CVE-2026-112398","GHSA-5x8w-8jj5-q52h"],"primaryLinks":["https://github.com/advisories/GHSA-5x8w-8jj5-q52h"],"publishedFixedVersionEvents":["13.0.0"],"providerRecordCount":2,"publishedSeverityLabels":["CRITICAL"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102994","GHSA-5jq2-8x83-x246","PYSEC-2026-4153"],"primaryLinks":["https://github.com/advisories/GHSA-5jq2-8x83-x246"],"publishedFixedVersionEvents":["6.18.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102995","GHSA-fp3h-c4fm-7vvf","PYSEC-2026-4154"],"primaryLinks":["https://github.com/advisories/GHSA-fp3h-c4fm-7vvf"],"publishedFixedVersionEvents":["6.18.1"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-103000","GHSA-w23x-9jrw-r45c","PYSEC-2026-4160"],"primaryLinks":["https://github.com/advisories/GHSA-w23x-9jrw-r45c"],"publishedFixedVersionEvents":["6.19.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102999","GHSA-v247-6f48-mgcj","PYSEC-2026-4159"],"primaryLinks":["https://github.com/advisories/GHSA-v247-6f48-mgcj"],"publishedFixedVersionEvents":["6.19.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102997","GHSA-jw7q-gvrg-4vj3","PYSEC-2026-4156"],"primaryLinks":["https://github.com/advisories/GHSA-jw7q-gvrg-4vj3"],"publishedFixedVersionEvents":["6.18.1"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102996","GHSA-g9cg-prrw-2r8q","PYSEC-2026-4155"],"primaryLinks":["https://github.com/advisories/GHSA-g9cg-prrw-2r8q"],"publishedFixedVersionEvents":["6.18.1"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102993","GHSA-qv6h-rv94-w285","PYSEC-2026-4158"],"primaryLinks":["https://github.com/advisories/GHSA-qv6h-rv94-w285"],"publishedFixedVersionEvents":["6.17.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-102998","GHSA-php9-fj8v-98fj","PYSEC-2026-4157"],"primaryLinks":["https://github.com/advisories/GHSA-php9-fj8v-98fj"],"publishedFixedVersionEvents":["6.19.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113792","GHSA-qfv9-64jg-mh7p"],"primaryLinks":["https://github.com/advisories/GHSA-qfv9-64jg-mh7p"],"publishedFixedVersionEvents":["6.20.1"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113795","GHSA-7mh2-4gg2-979f"],"primaryLinks":["https://github.com/advisories/GHSA-7mh2-4gg2-979f"],"publishedFixedVersionEvents":["6.20.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113793","GHSA-9mx8-4j7g-633p"],"primaryLinks":["https://github.com/advisories/GHSA-9mx8-4j7g-633p"],"publishedFixedVersionEvents":["6.20.1"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113794","GHSA-39mj-jf6j-2qj3"],"primaryLinks":["https://github.com/advisories/GHSA-39mj-jf6j-2qj3"],"publishedFixedVersionEvents":["6.20.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113786","GHSA-5hx5-vpf9-5wcv"],"primaryLinks":["https://github.com/advisories/GHSA-5hx5-vpf9-5wcv"],"publishedFixedVersionEvents":["6.21.1"],"providerRecordCount":2,"publishedSeverityLabels":["LOW"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113791","GHSA-cgf9-327m-v77c"],"primaryLinks":["https://github.com/advisories/GHSA-cgf9-327m-v77c"],"publishedFixedVersionEvents":["6.21.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113790","GHSA-f54x-cmq8-qg57"],"primaryLinks":["https://github.com/advisories/GHSA-f54x-cmq8-qg57"],"publishedFixedVersionEvents":["6.21.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-113789","GHSA-6vvc-x485-93v7"],"primaryLinks":["https://github.com/advisories/GHSA-6vvc-x485-93v7"],"publishedFixedVersionEvents":["6.21.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-115572","GHSA-6c7f-9265-g8fw"],"primaryLinks":["https://github.com/advisories/GHSA-6c7f-9265-g8fw"],"publishedFixedVersionEvents":["6.21.2"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-115585","GHSA-jr96-gvgh-j3r4"],"primaryLinks":["https://github.com/advisories/GHSA-jr96-gvgh-j3r4"],"publishedFixedVersionEvents":["6.21.2"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"pypdf","lockedVersion":"6.16.2","identifiers":["CVE-2026-115580","GHSA-gmh7-3g9r-mjh5"],"primaryLinks":["https://github.com/advisories/GHSA-gmh7-3g9r-mjh5"],"publishedFixedVersionEvents":["6.21.2"],"providerRecordCount":2,"publishedSeverityLabels":["HIGH"]}, {"package":"setuptools","lockedVersion":"84.0.0","identifiers":["GHSA-xmj3-9gf7-h52w"],"primaryLinks":["https://github.com/advisories/GHSA-xmj3-9gf7-h52w"],"publishedFixedVersionEvents":["84.1.0"],"providerRecordCount":2,"publishedSeverityLabels":["LOW"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-3001","CVE-2025-3001","GHSA-qfhq-4f3w-5fph","PYSEC-2025-195"],"primaryLinks":["https://github.com/advisories/GHSA-qfhq-4f3w-5fph"],"publishedFixedVersionEvents":["2.10.0"],"providerRecordCount":1,"publishedSeverityLabels":["LOW"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-3000","CVE-2025-3000","GHSA-rrmf-rvhw-rf47","PYSEC-2025-194"],"primaryLinks":["https://github.com/advisories/GHSA-rrmf-rvhw-rf47"],"publishedFixedVersionEvents":["2.13.0"],"providerRecordCount":1,"publishedSeverityLabels":["LOW"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-2999","CVE-2025-2999","GHSA-vgrw-7cvw-pwgx","PYSEC-2025-193"],"primaryLinks":["https://github.com/advisories/GHSA-vgrw-7cvw-pwgx"],"publishedFixedVersionEvents":["2.9.1"],"providerRecordCount":1,"publishedSeverityLabels":["MODERATE"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-2953","CVE-2025-2953","GHSA-3749-ghw9-m3mg","PYSEC-2025-191"],"primaryLinks":["https://github.com/advisories/GHSA-3749-ghw9-m3mg"],"publishedFixedVersionEvents":["2.7.1-rc1"],"providerRecordCount":2,"publishedSeverityLabels":["LOW"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-46148","CVE-2025-46148","PYSEC-2025-198"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151198"],"publishedFixedVersionEvents":["2.7.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-46149","CVE-2025-46149","PYSEC-2025-199"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/147848"],"publishedFixedVersionEvents":["2.7.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-46150","CVE-2025-46150","PYSEC-2025-200"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/141538"],"publishedFixedVersionEvents":["2.7.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-46152","CVE-2025-46152","PYSEC-2025-201"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/143555"],"publishedFixedVersionEvents":["2.7.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-46153","CVE-2025-46153","PYSEC-2025-202"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/142853"],"publishedFixedVersionEvents":["2.7.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55551","CVE-2025-55551","PYSEC-2025-203"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151401"],"publishedFixedVersionEvents":["2.9.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55552","CVE-2025-55552","PYSEC-2025-204"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/147847"],"publishedFixedVersionEvents":["2.9.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55553","CVE-2025-55553","PYSEC-2025-205"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151432"],"publishedFixedVersionEvents":["2.7.1"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55554","CVE-2025-55554","PYSEC-2025-206"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151510"],"publishedFixedVersionEvents":["2.9.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55557","CVE-2025-55557","PYSEC-2025-207"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151738"],"publishedFixedVersionEvents":["2.7.1"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55558","CVE-2025-55558","PYSEC-2025-208"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151523"],"publishedFixedVersionEvents":["2.7.1"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-55560","CVE-2025-55560","PYSEC-2025-209"],"primaryLinks":["https://github.com/pytorch/pytorch/issues/151522"],"publishedFixedVersionEvents":["2.7.1"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2026-4538","CVE-2026-4538","PYSEC-2026-139"],"primaryLinks":["https://github.com/pytorch/pytorch/pull/176791"],"publishedFixedVersionEvents":[],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2025-3730","CVE-2025-3730","GHSA-887c-mr87-cxwp","PYSEC-2026-1970"],"primaryLinks":["https://github.com/advisories/GHSA-887c-mr87-cxwp"],"publishedFixedVersionEvents":["2.8.0"],"providerRecordCount":2,"publishedSeverityLabels":["MODERATE"]}, {"package":"torch","lockedVersion":"2.6.0+cpu","identifiers":["BIT-pytorch-2026-24747","CVE-2026-24747","GHSA-63cw-57p8-fm3p","PYSEC-2026-1856","PYSEC-2026-2286"],"primaryLinks":["https://github.com/advisories/GHSA-63cw-57p8-fm3p"],"publishedFixedVersionEvents":["2.10.0"],"providerRecordCount":1,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14929","PYSEC-2025-217"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-217"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-2099","GHSA-qq3j-4f4f-9583","PYSEC-2025-40"],"primaryLinks":["https://github.com/advisories/GHSA-qq3j-4f4f-9583"],"publishedFixedVersionEvents":["4.49.0","4.50.0","8cb522b4190bd556ce51be04942720650b1a3e57"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14926","PYSEC-2025-214"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-214"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14930","PYSEC-2025-218"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-218"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14920","PYSEC-2025-211"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-211"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14921","PYSEC-2025-212"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-212"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14924","PYSEC-2025-213"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-213"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14927","PYSEC-2025-215"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-215"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-14928","PYSEC-2025-216"],"primaryLinks":["https://osv.dev/vulnerability/PYSEC-2025-216"],"publishedFixedVersionEvents":[],"providerRecordCount":2,"publishedSeverityLabels":[]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-3933","GHSA-37mw-44qp-f5jm","PYSEC-2026-1977"],"primaryLinks":["https://github.com/advisories/GHSA-37mw-44qp-f5jm"],"publishedFixedVersionEvents":["4.52.1"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-6638","GHSA-59p9-h35m-wg4g","PYSEC-2026-1981"],"primaryLinks":["https://github.com/advisories/GHSA-59p9-h35m-wg4g"],"publishedFixedVersionEvents":["4.53.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-3264","GHSA-jjph-296x-mrcr","PYSEC-2026-1985"],"primaryLinks":["https://github.com/advisories/GHSA-jjph-296x-mrcr"],"publishedFixedVersionEvents":["4.51.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-1194","GHSA-fpwr-67px-3qhx","PYSEC-2026-1984"],"primaryLinks":["https://github.com/advisories/GHSA-fpwr-67px-3qhx"],"publishedFixedVersionEvents":["4.50.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-3777","GHSA-phhr-52qp-3mj4","PYSEC-2026-1986"],"primaryLinks":["https://github.com/advisories/GHSA-phhr-52qp-3mj4"],"publishedFixedVersionEvents":["4.52.1"],"providerRecordCount":4,"publishedSeverityLabels":["LOW"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-6051","GHSA-rcv9-qm8p-9p6j","PYSEC-2026-1988"],"primaryLinks":["https://github.com/advisories/GHSA-rcv9-qm8p-9p6j"],"publishedFixedVersionEvents":["4.53.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-6921","GHSA-4w7r-h757-3r74","PYSEC-2026-1980"],"primaryLinks":["https://github.com/advisories/GHSA-4w7r-h757-3r74"],"publishedFixedVersionEvents":["4.53.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-3263","GHSA-q2wp-rjmx-x6x9","PYSEC-2026-1987"],"primaryLinks":["https://github.com/advisories/GHSA-q2wp-rjmx-x6x9"],"publishedFixedVersionEvents":["4.51.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2025-5197","GHSA-9356-575x-2w9m","PYSEC-2026-1983"],"primaryLinks":["https://github.com/advisories/GHSA-9356-575x-2w9m"],"publishedFixedVersionEvents":["4.53.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2026-1839","GHSA-69w3-r845-3855","PYSEC-2026-2288"],"primaryLinks":["https://github.com/advisories/GHSA-69w3-r845-3855"],"publishedFixedVersionEvents":["5.0.0","5.0.0rc3"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2026-4372","GHSA-29pf-2h5f-8g72","PYSEC-2026-2289"],"primaryLinks":["https://github.com/advisories/GHSA-29pf-2h5f-8g72"],"publishedFixedVersionEvents":["5.3.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2026-5241","GHSA-fgcw-684q-jj6r","PYSEC-2026-2290"],"primaryLinks":["https://github.com/advisories/GHSA-fgcw-684q-jj6r"],"publishedFixedVersionEvents":["5.5.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"transformers","lockedVersion":"4.48.3","identifiers":["CVE-2026-9856","GHSA-xrqw-3rrv-vx5w","PYSEC-2026-3929"],"primaryLinks":["https://github.com/advisories/GHSA-xrqw-3rrv-vx5w"],"publishedFixedVersionEvents":["5.10.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"urllib3","lockedVersion":"2.7.0","identifiers":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw","PYSEC-2026-4177"],"primaryLinks":["https://github.com/advisories/GHSA-vxq7-64xx-v4gw"],"publishedFixedVersionEvents":["2.8.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]}, {"package":"urllib3","lockedVersion":"2.7.0","identifiers":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g","PYSEC-2026-4176"],"primaryLinks":["https://github.com/advisories/GHSA-gh4c-6fx4-qh6g"],"publishedFixedVersionEvents":["2.8.0"],"providerRecordCount":4,"publishedSeverityLabels":["MODERATE"]}, {"package":"urllib3","lockedVersion":"2.7.0","identifiers":["CVE-2026-97687","GHSA-8988-9cw3-xx77","PYSEC-2026-4175"],"primaryLinks":["https://github.com/advisories/GHSA-8988-9cw3-xx77"],"publishedFixedVersionEvents":["2.8.0"],"providerRecordCount":4,"publishedSeverityLabels":["HIGH"]} ] }