cesnimda
17 KiB
17 KiB
Python advisory inventory — P9-REMED-02
BLOCKED pending selected-model runtime qualification and remaining cache-lock assessment. No owner risk acceptance is asserted. The complete per-advisory ranges, severity/vector, direct/transitive role, actual installed/locked versions, functionality, exposure, fix compatibility, primary sources and required disposition are in advisory-inventory.json.
109 baseline alias groups are not109 independent CVEs. Fresh49-pin before/after queries retain249→99 provider records and109→44 alias groups;65 groups no longer match the updated lock. Some model records describe version/function mismatches; these are preserved with source-limited call-site assessment rather than silently suppressed.
| Package | Advisory IDs / primary identifier | Current disposition |
|---|---|---|
| certifi | GHSA-6q48-6c7w-9gw2 (PYSEC-2026-4320) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| filelock | GHSA-v4x8-3wr5-3wq8 (CVE-2026-112940) | OPEN_LOCAL_CACHE_COMPATIBILITY |
| filelock | GHSA-9vhv-jxww-xfm5 (CVE-2026-112913) | OPEN_LOCAL_CACHE_COMPATIBILITY |
| filelock | GHSA-567q-5qvw-pf92 (CVE-2026-112907) | OPEN_LOCAL_CACHE_COMPATIBILITY |
| pillow | GHSA-4558-3h8r-v8xp (CVE-2026-112394) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-8g5g-8vmr-9782 (CVE-2026-112403) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-rfgq-q3w2-pmv2 (CVE-2026-112898) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-xvh5-g6gv-559v (CVE-2026-112902) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-p4wg-p73j-c528 (CVE-2026-112895) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-65qm-jvmh-6pqg (CVE-2026-112400) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-58r4-6rv3-gfh8 (CVE-2026-112397) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-pchr-8j38-3x4p (CVE-2026-112896) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-q45j-58j2-45rg (CVE-2026-112897) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-462x-pgg6-55fp (CVE-2026-112395) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-c6hw-5grf-ff96 (CVE-2026-112404) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-vx6w-vv9f-6gvg (CVE-2026-112899) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-7mwm-ghpf-9vrm (CVE-2026-112402) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-w889-685w-c8fh (CVE-2026-112900) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-j4m9-6w36-pw47 (CVE-2026-112893) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-27h8-gf7j-v5hc (CVE-2026-112392) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-fc9g-5qg7-mf45 (CVE-2026-112891) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-cp9v-662q-vvx9 (CVE-2026-112405) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-22hg-r758-rrw9 (CVE-2026-112390) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-74r2-7ff9-mjj2 (CVE-2026-112401) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-xgh8-jp6q-p5x8 (CVE-2026-112901) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-254f-3936-288h (CVE-2026-112391) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-jg86-v3jv-hrpm (CVE-2026-112894) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-f2g6-542v-9j58 (CVE-2026-112406) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-5xm2-6676-qcp9 (CVE-2026-112399) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-gg2r-wvfm-q9rx (CVE-2026-112892) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-332p-7hrc-92wf (CVE-2026-112393) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-4rr5-89j8-mwwm (CVE-2026-112396) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-24rc-8hj2-v98c (CVE-2026-96638) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-4rm8-3hmm-39fg (CVE-2026-96641) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-mrfp-p49p-3hf2 (CVE-2026-96640) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-3j72-p6qg-6xp7 (CVE-2026-96642) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-v9pv-5gc8-w2m6 (CVE-2026-96639) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-g4qv-2jxx-769h (CVE-2026-96643) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-g842-9rc4-69pw (CVE-2026-96637) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-9v9v-9qvf-h2hj (CVE-2026-96644) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-g7cr-3p24-7wf7 (CVE-2026-96778) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-p8hx-v2p6-rp84 (CVE-2026-96636) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-78g4-xqwv-q3g8 (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-654x-cwwv-5j9c (CVE-2026-114501) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pillow | GHSA-5x8w-8jj5-q52h (CVE-2026-112398) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-5jq2-8x83-x246 (CVE-2026-102994, PYSEC-2026-4153) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-fp3h-c4fm-7vvf (CVE-2026-102995, PYSEC-2026-4154) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-w23x-9jrw-r45c (CVE-2026-103000, PYSEC-2026-4160) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-v247-6f48-mgcj (CVE-2026-102999, PYSEC-2026-4159) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-jw7q-gvrg-4vj3 (CVE-2026-102997, PYSEC-2026-4156) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-g9cg-prrw-2r8q (CVE-2026-102996, PYSEC-2026-4155) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-qv6h-rv94-w285 (CVE-2026-102993, PYSEC-2026-4158) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-php9-fj8v-98fj (CVE-2026-102998, PYSEC-2026-4157) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-qfv9-64jg-mh7p (CVE-2026-113792) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-7mh2-4gg2-979f (CVE-2026-113795) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-9mx8-4j7g-633p (CVE-2026-113793) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-39mj-jf6j-2qj3 (CVE-2026-113794) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-5hx5-vpf9-5wcv (CVE-2026-113786) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-cgf9-327m-v77c (CVE-2026-113791) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-f54x-cmq8-qg57 (CVE-2026-113790) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-6vvc-x485-93v7 (CVE-2026-113789) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-6c7f-9265-g8fw (CVE-2026-115572) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-jr96-gvgh-j3r4 (CVE-2026-115585) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| pypdf | GHSA-gmh7-3g9r-mjh5 (CVE-2026-115580) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| setuptools | GHSA-xmj3-9gf7-h52w (no aliases) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| torch | GHSA-qfhq-4f3w-5fph (BIT-pytorch-2025-3001, CVE-2025-3001, PYSEC-2025-195) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | GHSA-rrmf-rvhw-rf47 (BIT-pytorch-2025-3000, CVE-2025-3000, PYSEC-2025-194) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | GHSA-vgrw-7cvw-pwgx (BIT-pytorch-2025-2999, CVE-2025-2999, PYSEC-2025-193) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | GHSA-3749-ghw9-m3mg (BIT-pytorch-2025-2953, CVE-2025-2953, PYSEC-2025-191) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-46148 (CVE-2025-46148, PYSEC-2025-198) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-46149 (CVE-2025-46149, PYSEC-2025-199) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-46150 (CVE-2025-46150, PYSEC-2025-200) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-46152 (CVE-2025-46152, PYSEC-2025-201) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-46153 (CVE-2025-46153, PYSEC-2025-202) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55551 (CVE-2025-55551, PYSEC-2025-203) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55552 (CVE-2025-55552, PYSEC-2025-204) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55553 (CVE-2025-55553, PYSEC-2025-205) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55554 (CVE-2025-55554, PYSEC-2025-206) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55557 (CVE-2025-55557, PYSEC-2025-207) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55558 (CVE-2025-55558, PYSEC-2025-208) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2025-55560 (CVE-2025-55560, PYSEC-2025-209) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | BIT-pytorch-2026-4538 (CVE-2026-4538, PYSEC-2026-139) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | GHSA-887c-mr87-cxwp (BIT-pytorch-2025-3730, CVE-2025-3730, PYSEC-2026-1970) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| torch | GHSA-63cw-57p8-fm3p (BIT-pytorch-2026-24747, CVE-2026-24747, PYSEC-2026-1856, PYSEC-2026-2286) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14929 (PYSEC-2025-217) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-qq3j-4f4f-9583 (CVE-2025-2099, PYSEC-2025-40) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14926 (PYSEC-2025-214) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14930 (PYSEC-2025-218) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14920 (PYSEC-2025-211) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14921 (PYSEC-2025-212) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14924 (PYSEC-2025-213) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14927 (PYSEC-2025-215) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | CVE-2025-14928 (PYSEC-2025-216) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-37mw-44qp-f5jm (CVE-2025-3933, PYSEC-2026-1977) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-59p9-h35m-wg4g (CVE-2025-6638, PYSEC-2026-1981) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-jjph-296x-mrcr (CVE-2025-3264, PYSEC-2026-1985) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-fpwr-67px-3qhx (CVE-2025-1194, PYSEC-2026-1984) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-phhr-52qp-3mj4 (CVE-2025-3777, PYSEC-2026-1986) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-rcv9-qm8p-9p6j (CVE-2025-6051, PYSEC-2026-1988) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-4w7r-h757-3r74 (CVE-2025-6921, PYSEC-2026-1980) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-q2wp-rjmx-x6x9 (CVE-2025-3263, PYSEC-2026-1987) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-9356-575x-2w9m (CVE-2025-5197, PYSEC-2026-1983) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-69w3-r845-3855 (CVE-2026-1839, PYSEC-2026-2288) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-29pf-2h5f-8g72 (CVE-2026-4372, PYSEC-2026-2289) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-fgcw-684q-jj6r (CVE-2026-5241, PYSEC-2026-2290) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| transformers | GHSA-xrqw-3rrv-vx5w (CVE-2026-9856, PYSEC-2026-3929) | BLOCKED_MODEL_RUNTIME_QUALIFICATION |
| urllib3 | GHSA-vxq7-64xx-v4gw (CVE-2026-97689, PYSEC-2026-4177) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| urllib3 | GHSA-gh4c-6fx4-qh6g (CVE-2026-97688, PYSEC-2026-4176) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |
| urllib3 | GHSA-8988-9cw3-xx77 (CVE-2026-97687, PYSEC-2026-4175) | REMEDIATED_VERSION_LOCAL_REGRESSION_PASS |