{"grype_matches":[{"artifact":{"id":"eb222fe89d397776","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r0:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.3.2-r0","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.3.2-r1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"< 1.3.2-r1 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.2"},"package":{"name":"zlib","version":"1.3.2-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"fixed","versions":["1.3.2-r1"],"available":[{"date":"2026-10-07","kind":"first-observed","version":"1.3.2-r1"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"risk":0.28124,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"206b2f5eb82ce0f1","cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@2.7.0","type":"python","version":"2.7.0","language":"python","licenses":["MIT"],"locations":[{"path":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-vxq7-64xx-v4gw","versionConstraint":">=1.10.3,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-vxq7-64xx-v4gw","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-10-08","epss":0.00292,"percentile":0.19921}],"risk":0.23944000000000001,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-vxq7-64xx-v4gw","description":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory"},"relatedVulnerabilities":[{"id":"CVE-2026-97689","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97689","cwe":"CWE-770","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97689","date":"2026-10-08","epss":0.00292,"percentile":0.19921}],"urls":["https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97689","description":"urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a length bound. The trigger is that a malicious server returns Transfer-Encoding: chunked followed by a very long run of bytes without a newline. The attack mechanism is that a malicious HTTP server sends a very long unterminated chunk-size line. The impact is that unbounded memory allocation can exhaust the client process. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.9.0,<=2.13.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-w6j9-cwv2-h6wq","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102274","cwe":"CWE-755","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102274","date":"2026-10-08","epss":0.00389,"percentile":0.30913}],"risk":0.212005,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq","https://nvd.nist.gov/vuln/detail/CVE-2026-102274","https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-w6j9-cwv2-h6wq","description":"PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set"},"relatedVulnerabilities":[{"id":"CVE-2026-102274","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102274","cwe":"CWE-755","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102274","date":"2026-10-08","epss":0.00389,"percentile":0.30913}],"urls":["https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102274","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. This occurs when a JWK Set contains a malformed RSA key alongside otherwise usable keys. As a result, one malformed member aborts construction of the entire PyJWKSet. Consequently, applications can experience authentication failures or request-level denial of service. This issue is fixed in version 2.14.0."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"fefa9ba692fd097c","cpes":["cpe:2.3:a:python-software-foundation:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python_software_foundation:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python-software-foundation:python:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python_software_foundation:python:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python-software:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python_software:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python-software:python:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python_software:python:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python3:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python3:python:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python:python3:3.14.8-r0:*:*:*:*:*:*:*","cpe:2.3:a:python:python:3.14.8-r0:*:*:*:*:*:*:*"],"name":"python3","purl":"pkg:apk/alpine/python3@3.14.8-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"3.14.8-r0","language":"","licenses":["PSF-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/pydoc3"},{"path":"/usr/bin/pydoc3.14"},{"path":"/usr/bin/python"},{"path":"/usr/bin/python3"},{"path":"/usr/bin/python3.14"},{"path":"/usr/include"},{"path":"/usr/include/python3.14"},{"path":"/usr/include/python3.14/pyconfig.h"},{"path":"/usr/lib"},{"path":"/usr/lib/libpython3.14.so.1.0"},{"path":"/usr/lib/libpython3.so"},{"path":"/usr/lib/python3.14"},{"path":"/usr/lib/python3.14/EXTERNALLY-MANAGED"},{"path":"/usr/lib/python3.14/LICENSE.txt"},{"path":"/usr/lib/python3.14/__future__.py"},{"path":"/usr/lib/python3.14/__hello__.py"},{"path":"/usr/lib/python3.14/_aix_support.py"},{"path":"/usr/lib/python3.14/_android_support.py"},{"path":"/usr/lib/python3.14/_apple_support.py"},{"path":"/usr/lib/python3.14/_ast_unparse.py"},{"path":"/usr/lib/python3.14/_collections_abc.py"},{"path":"/usr/lib/python3.14/_colorize.py"},{"path":"/usr/lib/python3.14/_compat_pickle.py"},{"path":"/usr/lib/python3.14/_ios_support.py"},{"path":"/usr/lib/python3.14/_markupbase.py"},{"path":"/usr/lib/python3.14/_opcode_metadata.py"},{"path":"/usr/lib/python3.14/_osx_support.py"},{"path":"/usr/lib/python3.14/_py_abc.py"},{"path":"/usr/lib/python3.14/_py_warnings.py"},{"path":"/usr/lib/python3.14/_pydatetime.py"},{"path":"/usr/lib/python3.14/_pydecimal.py"},{"path":"/usr/lib/python3.14/_pyio.py"},{"path":"/usr/lib/python3.14/_pylong.py"},{"path":"/usr/lib/python3.14/_sitebuiltins.py"},{"path":"/usr/lib/python3.14/_strptime.py"},{"path":"/usr/lib/python3.14/_sysconfig_vars__linux_x86_64-linux-musl.json"},{"path":"/usr/lib/python3.14/_sysconfigdata__linux_x86_64-linux-musl.py"},{"path":"/usr/lib/python3.14/_threading_local.py"},{"path":"/usr/lib/python3.14/_weakrefset.py"},{"path":"/usr/lib/python3.14/abc.py"},{"path":"/usr/lib/python3.14/annotationlib.py"},{"path":"/usr/lib/python3.14/antigravity.py"},{"path":"/usr/lib/python3.14/argparse.py"},{"path":"/usr/lib/python3.14/ast.py"},{"path":"/usr/lib/python3.14/base64.py"},{"path":"/usr/lib/python3.14/bdb.py"},{"path":"/usr/lib/python3.14/bisect.py"},{"path":"/usr/lib/python3.14/build-details.json"},{"path":"/usr/lib/python3.14/bz2.py"},{"path":"/usr/lib/python3.14/cProfile.py"},{"path":"/usr/lib/python3.14/calendar.py"},{"path":"/usr/lib/python3.14/cmd.py"},{"path":"/usr/lib/python3.14/code.py"},{"path":"/usr/lib/python3.14/codecs.py"},{"path":"/usr/lib/python3.14/codeop.py"},{"path":"/usr/lib/python3.14/colorsys.py"},{"path":"/usr/lib/python3.14/compileall.py"},{"path":"/usr/lib/python3.14/configparser.py"},{"path":"/usr/lib/python3.14/contextlib.py"},{"path":"/usr/lib/python3.14/contextvars.py"},{"path":"/usr/lib/python3.14/copy.py"},{"path":"/usr/lib/python3.14/copyreg.py"},{"path":"/usr/lib/python3.14/csv.py"},{"path":"/usr/lib/python3.14/dataclasses.py"},{"path":"/usr/lib/python3.14/datetime.py"},{"path":"/usr/lib/python3.14/decimal.py"},{"path":"/usr/lib/python3.14/difflib.py"},{"path":"/usr/lib/python3.14/dis.py"},{"path":"/usr/lib/python3.14/doctest.py"},{"path":"/usr/lib/python3.14/enum.py"},{"path":"/usr/lib/python3.14/filecmp.py"},{"path":"/usr/lib/python3.14/fileinput.py"},{"path":"/usr/lib/python3.14/fnmatch.py"},{"path":"/usr/lib/python3.14/fractions.py"},{"path":"/usr/lib/python3.14/ftplib.py"},{"path":"/usr/lib/python3.14/functools.py"},{"path":"/usr/lib/python3.14/genericpath.py"},{"path":"/usr/lib/python3.14/getopt.py"},{"path":"/usr/lib/python3.14/getpass.py"},{"path":"/usr/lib/python3.14/gettext.py"},{"path":"/usr/lib/python3.14/glob.py"},{"path":"/usr/lib/python3.14/graphlib.py"},{"path":"/usr/lib/python3.14/gzip.py"},{"path":"/usr/lib/python3.14/hashlib.py"},{"path":"/usr/lib/python3.14/heapq.py"},{"path":"/usr/lib/python3.14/hmac.py"},{"path":"/usr/lib/python3.14/imaplib.py"},{"path":"/usr/lib/python3.14/inspect.py"},{"path":"/usr/lib/python3.14/io.py"},{"path":"/usr/lib/python3.14/ipaddress.py"},{"path":"/usr/lib/python3.14/keyword.py"},{"path":"/usr/lib/python3.14/linecache.py"},{"path":"/usr/lib/python3.14/locale.py"},{"path":"/usr/lib/python3.14/lzma.py"},{"path":"/usr/lib/python3.14/mailbox.py"},{"path":"/usr/lib/python3.14/mimetypes.py"},{"path":"/usr/lib/python3.14/modulefinder.py"},{"path":"/usr/lib/python3.14/netrc.py"},{"path":"/usr/lib/python3.14/ntpath.py"},{"path":"/usr/lib/python3.14/nturl2path.py"},{"path":"/usr/lib/python3.14/numbers.py"},{"path":"/usr/lib/python3.14/opcode.py"},{"path":"/usr/lib/python3.14/operator.py"},{"path":"/usr/lib/python3.14/optparse.py"},{"path":"/usr/lib/python3.14/os.py"},{"path":"/usr/lib/python3.14/pdb.py"},{"path":"/usr/lib/python3.14/pickle.py"},{"path":"/usr/lib/python3.14/pickletools.py"},{"path":"/usr/lib/python3.14/pkgutil.py"},{"path":"/usr/lib/python3.14/platform.py"},{"path":"/usr/lib/python3.14/plistlib.py"},{"path":"/usr/lib/python3.14/poplib.py"},{"path":"/usr/lib/python3.14/posixpath.py"},{"path":"/usr/lib/python3.14/pprint.py"},{"path":"/usr/lib/python3.14/profile.py"},{"path":"/usr/lib/python3.14/pstats.py"},{"path":"/usr/lib/python3.14/pty.py"},{"path":"/usr/lib/python3.14/py_compile.py"},{"path":"/usr/lib/python3.14/pyclbr.py"},{"path":"/usr/lib/python3.14/pydoc.py"},{"path":"/usr/lib/python3.14/queue.py"},{"path":"/usr/lib/python3.14/quopri.py"},{"path":"/usr/lib/python3.14/random.py"},{"path":"/usr/lib/python3.14/reprlib.py"},{"path":"/usr/lib/python3.14/rlcompleter.py"},{"path":"/usr/lib/python3.14/runpy.py"},{"path":"/usr/lib/python3.14/sched.py"},{"path":"/usr/lib/python3.14/secrets.py"},{"path":"/usr/lib/python3.14/selectors.py"},{"path":"/usr/lib/python3.14/shelve.py"},{"path":"/usr/lib/python3.14/shlex.py"},{"path":"/usr/lib/python3.14/shutil.py"},{"path":"/usr/lib/python3.14/signal.py"},{"path":"/usr/lib/python3.14/site.py"},{"path":"/usr/lib/python3.14/smtplib.py"},{"path":"/usr/lib/python3.14/socket.py"},{"path":"/usr/lib/python3.14/socketserver.py"},{"path":"/usr/lib/python3.14/sre_compile.py"},{"path":"/usr/lib/python3.14/sre_constants.py"},{"path":"/usr/lib/python3.14/sre_parse.py"},{"path":"/usr/lib/python3.14/ssl.py"},{"path":"/usr/lib/python3.14/stat.py"},{"path":"/usr/lib/python3.14/statistics.py"},{"path":"/usr/lib/python3.14/stringprep.py"},{"path":"/usr/lib/python3.14/struct.py"},{"path":"/usr/lib/python3.14/subprocess.py"},{"path":"/usr/lib/python3.14/symtable.py"},{"path":"/usr/lib/python3.14/tabnanny.py"},{"path":"/usr/lib/python3.14/tarfile.py"},{"path":"/usr/lib/python3.14/tempfile.py"},{"path":"/usr/lib/python3.14/textwrap.py"},{"path":"/usr/lib/python3.14/this.py"},{"path":"/usr/lib/python3.14/threading.py"},{"path":"/usr/lib/python3.14/timeit.py"},{"path":"/usr/lib/python3.14/token.py"},{"path":"/usr/lib/python3.14/tokenize.py"},{"path":"/usr/lib/python3.14/trace.py"},{"path":"/usr/lib/python3.14/traceback.py"},{"path":"/usr/lib/python3.14/tracemalloc.py"},{"path":"/usr/lib/python3.14/tty.py"},{"path":"/usr/lib/python3.14/turtle.py"},{"path":"/usr/lib/python3.14/types.py"},{"path":"/usr/lib/python3.14/typing.py"},{"path":"/usr/lib/python3.14/uuid.py"},{"path":"/usr/lib/python3.14/warnings.py"},{"path":"/usr/lib/python3.14/wave.py"},{"path":"/usr/lib/python3.14/weakref.py"},{"path":"/usr/lib/python3.14/webbrowser.py"},{"path":"/usr/lib/python3.14/zipapp.py"},{"path":"/usr/lib/python3.14/zipimport.py"},{"path":"/usr/lib/python3.14/__phello__"},{"path":"/usr/lib/python3.14/__phello__/__init__.py"},{"path":"/usr/lib/python3.14/__phello__/spam.py"},{"path":"/usr/lib/python3.14/_pyrepl"},{"path":"/usr/lib/python3.14/_pyrepl/__init__.py"},{"path":"/usr/lib/python3.14/_pyrepl/__main__.py"},{"path":"/usr/lib/python3.14/_pyrepl/_module_completer.py"},{"path":"/usr/lib/python3.14/_pyrepl/_threading_handler.py"},{"path":"/usr/lib/python3.14/_pyrepl/base_eventqueue.py"},{"path":"/usr/lib/python3.14/_pyrepl/commands.py"},{"path":"/usr/lib/python3.14/_pyrepl/completing_reader.py"},{"path":"/usr/lib/python3.14/_pyrepl/console.py"},{"path":"/usr/lib/python3.14/_pyrepl/fancy_termios.py"},{"path":"/usr/lib/python3.14/_pyrepl/historical_reader.py"},{"path":"/usr/lib/python3.14/_pyrepl/input.py"},{"path":"/usr/lib/python3.14/_pyrepl/keymap.py"},{"path":"/usr/lib/python3.14/_pyrepl/main.py"},{"path":"/usr/lib/python3.14/_pyrepl/mypy.ini"},{"path":"/usr/lib/python3.14/_pyrepl/pager.py"},{"path":"/usr/lib/python3.14/_pyrepl/reader.py"},{"path":"/usr/lib/python3.14/_pyrepl/readline.py"},{"path":"/usr/lib/python3.14/_pyrepl/simple_interact.py"},{"path":"/usr/lib/python3.14/_pyrepl/terminfo.py"},{"path":"/usr/lib/python3.14/_pyrepl/trace.py"},{"path":"/usr/lib/python3.14/_pyrepl/types.py"},{"path":"/usr/lib/python3.14/_pyrepl/unix_console.py"},{"path":"/usr/lib/python3.14/_pyrepl/unix_eventqueue.py"},{"path":"/usr/lib/python3.14/_pyrepl/utils.py"},{"path":"/usr/lib/python3.14/_pyrepl/windows_console.py"},{"path":"/usr/lib/python3.14/_pyrepl/windows_eventqueue.py"},{"path":"/usr/lib/python3.14/asyncio"},{"path":"/usr/lib/python3.14/asyncio/__init__.py"},{"path":"/usr/lib/python3.14/asyncio/__main__.py"},{"path":"/usr/lib/python3.14/asyncio/base_events.py"},{"path":"/usr/lib/python3.14/asyncio/base_futures.py"},{"path":"/usr/lib/python3.14/asyncio/base_subprocess.py"},{"path":"/usr/lib/python3.14/asyncio/base_tasks.py"},{"path":"/usr/lib/python3.14/asyncio/constants.py"},{"path":"/usr/lib/python3.14/asyncio/coroutines.py"},{"path":"/usr/lib/python3.14/asyncio/events.py"},{"path":"/usr/lib/python3.14/asyncio/exceptions.py"},{"path":"/usr/lib/python3.14/asyncio/format_helpers.py"},{"path":"/usr/lib/python3.14/asyncio/futures.py"},{"path":"/usr/lib/python3.14/asyncio/graph.py"},{"path":"/usr/lib/python3.14/asyncio/locks.py"},{"path":"/usr/lib/python3.14/asyncio/log.py"},{"path":"/usr/lib/python3.14/asyncio/mixins.py"},{"path":"/usr/lib/python3.14/asyncio/proactor_events.py"},{"path":"/usr/lib/python3.14/asyncio/protocols.py"},{"path":"/usr/lib/python3.14/asyncio/queues.py"},{"path":"/usr/lib/python3.14/asyncio/runners.py"},{"path":"/usr/lib/python3.14/asyncio/selector_events.py"},{"path":"/usr/lib/python3.14/asyncio/sslproto.py"},{"path":"/usr/lib/python3.14/asyncio/staggered.py"},{"path":"/usr/lib/python3.14/asyncio/streams.py"},{"path":"/usr/lib/python3.14/asyncio/subprocess.py"},{"path":"/usr/lib/python3.14/asyncio/taskgroups.py"},{"path":"/usr/lib/python3.14/asyncio/tasks.py"},{"path":"/usr/lib/python3.14/asyncio/threads.py"},{"path":"/usr/lib/python3.14/asyncio/timeouts.py"},{"path":"/usr/lib/python3.14/asyncio/tools.py"},{"path":"/usr/lib/python3.14/asyncio/transports.py"},{"path":"/usr/lib/python3.14/asyncio/trsock.py"},{"path":"/usr/lib/python3.14/asyncio/unix_events.py"},{"path":"/usr/lib/python3.14/asyncio/windows_events.py"},{"path":"/usr/lib/python3.14/asyncio/windows_utils.py"},{"path":"/usr/lib/python3.14/collections"},{"path":"/usr/lib/python3.14/collections/__init__.py"},{"path":"/usr/lib/python3.14/compression"},{"path":"/usr/lib/python3.14/compression/__init__.py"},{"path":"/usr/lib/python3.14/compression/bz2.py"},{"path":"/usr/lib/python3.14/compression/gzip.py"},{"path":"/usr/lib/python3.14/compression/lzma.py"},{"path":"/usr/lib/python3.14/compression/zlib.py"},{"path":"/usr/lib/python3.14/compression/_common"},{"path":"/usr/lib/python3.14/compression/_common/__init__.py"},{"path":"/usr/lib/python3.14/compression/_common/_streams.py"},{"path":"/usr/lib/python3.14/compression/zstd"},{"path":"/usr/lib/python3.14/compression/zstd/__init__.py"},{"path":"/usr/lib/python3.14/compression/zstd/_zstdfile.py"},{"path":"/usr/lib/python3.14/concurrent"},{"path":"/usr/lib/python3.14/concurrent/__init__.py"},{"path":"/usr/lib/python3.14/concurrent/futures"},{"path":"/usr/lib/python3.14/concurrent/futures/__init__.py"},{"path":"/usr/lib/python3.14/concurrent/futures/_base.py"},{"path":"/usr/lib/python3.14/concurrent/futures/interpreter.py"},{"path":"/usr/lib/python3.14/concurrent/futures/process.py"},{"path":"/usr/lib/python3.14/concurrent/futures/thread.py"},{"path":"/usr/lib/python3.14/concurrent/interpreters"},{"path":"/usr/lib/python3.14/concurrent/interpreters/__init__.py"},{"path":"/usr/lib/python3.14/concurrent/interpreters/_crossinterp.py"},{"path":"/usr/lib/python3.14/concurrent/interpreters/_queues.py"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/Makefile"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/Setup"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/Setup.bootstrap"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/Setup.local"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/Setup.stdlib"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/config.c.in"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/install-sh"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/makesetup"},{"path":"/usr/lib/python3.14/config-3.14-x86_64-linux-musl/python-config.py"},{"path":"/usr/lib/python3.14/ctypes"},{"path":"/usr/lib/python3.14/ctypes/__init__.py"},{"path":"/usr/lib/python3.14/ctypes/_aix.py"},{"path":"/usr/lib/python3.14/ctypes/_endian.py"},{"path":"/usr/lib/python3.14/ctypes/_layout.py"},{"path":"/usr/lib/python3.14/ctypes/util.py"},{"path":"/usr/lib/python3.14/ctypes/wintypes.py"},{"path":"/usr/lib/python3.14/ctypes/macholib"},{"path":"/usr/lib/python3.14/ctypes/macholib/README.ctypes"},{"path":"/usr/lib/python3.14/ctypes/macholib/__init__.py"},{"path":"/usr/lib/python3.14/ctypes/macholib/dyld.py"},{"path":"/usr/lib/python3.14/ctypes/macholib/dylib.py"},{"path":"/usr/lib/python3.14/ctypes/macholib/fetch_macholib"},{"path":"/usr/lib/python3.14/ctypes/macholib/fetch_macholib.bat"},{"path":"/usr/lib/python3.14/ctypes/macholib/framework.py"},{"path":"/usr/lib/python3.14/curses"},{"path":"/usr/lib/python3.14/curses/__init__.py"},{"path":"/usr/lib/python3.14/curses/ascii.py"},{"path":"/usr/lib/python3.14/curses/has_key.py"},{"path":"/usr/lib/python3.14/curses/panel.py"},{"path":"/usr/lib/python3.14/curses/textpad.py"},{"path":"/usr/lib/python3.14/dbm"},{"path":"/usr/lib/python3.14/dbm/__init__.py"},{"path":"/usr/lib/python3.14/dbm/dumb.py"},{"path":"/usr/lib/python3.14/dbm/gnu.py"},{"path":"/usr/lib/python3.14/dbm/ndbm.py"},{"path":"/usr/lib/python3.14/dbm/sqlite3.py"},{"path":"/usr/lib/python3.14/email"},{"path":"/usr/lib/python3.14/email/__init__.py"},{"path":"/usr/lib/python3.14/email/_encoded_words.py"},{"path":"/usr/lib/python3.14/email/_header_value_parser.py"},{"path":"/usr/lib/python3.14/email/_parseaddr.py"},{"path":"/usr/lib/python3.14/email/_policybase.py"},{"path":"/usr/lib/python3.14/email/architecture.rst"},{"path":"/usr/lib/python3.14/email/base64mime.py"},{"path":"/usr/lib/python3.14/email/charset.py"},{"path":"/usr/lib/python3.14/email/contentmanager.py"},{"path":"/usr/lib/python3.14/email/encoders.py"},{"path":"/usr/lib/python3.14/email/errors.py"},{"path":"/usr/lib/python3.14/email/feedparser.py"},{"path":"/usr/lib/python3.14/email/generator.py"},{"path":"/usr/lib/python3.14/email/header.py"},{"path":"/usr/lib/python3.14/email/headerregistry.py"},{"path":"/usr/lib/python3.14/email/iterators.py"},{"path":"/usr/lib/python3.14/email/message.py"},{"path":"/usr/lib/python3.14/email/parser.py"},{"path":"/usr/lib/python3.14/email/policy.py"},{"path":"/usr/lib/python3.14/email/quoprimime.py"},{"path":"/usr/lib/python3.14/email/utils.py"},{"path":"/usr/lib/python3.14/email/mime"},{"path":"/usr/lib/python3.14/email/mime/__init__.py"},{"path":"/usr/lib/python3.14/email/mime/application.py"},{"path":"/usr/lib/python3.14/email/mime/audio.py"},{"path":"/usr/lib/python3.14/email/mime/base.py"},{"path":"/usr/lib/python3.14/email/mime/image.py"},{"path":"/usr/lib/python3.14/email/mime/message.py"},{"path":"/usr/lib/python3.14/email/mime/multipart.py"},{"path":"/usr/lib/python3.14/email/mime/nonmultipart.py"},{"path":"/usr/lib/python3.14/email/mime/text.py"},{"path":"/usr/lib/python3.14/encodings"},{"path":"/usr/lib/python3.14/encodings/__init__.py"},{"path":"/usr/lib/python3.14/encodings/_win_cp_codecs.py"},{"path":"/usr/lib/python3.14/encodings/aliases.py"},{"path":"/usr/lib/python3.14/encodings/ascii.py"},{"path":"/usr/lib/python3.14/encodings/base64_codec.py"},{"path":"/usr/lib/python3.14/encodings/big5.py"},{"path":"/usr/lib/python3.14/encodings/big5hkscs.py"},{"path":"/usr/lib/python3.14/encodings/bz2_codec.py"},{"path":"/usr/lib/python3.14/encodings/charmap.py"},{"path":"/usr/lib/python3.14/encodings/cp037.py"},{"path":"/usr/lib/python3.14/encodings/cp1006.py"},{"path":"/usr/lib/python3.14/encodings/cp1026.py"},{"path":"/usr/lib/python3.14/encodings/cp1125.py"},{"path":"/usr/lib/python3.14/encodings/cp1140.py"},{"path":"/usr/lib/python3.14/encodings/cp1250.py"},{"path":"/usr/lib/python3.14/encodings/cp1251.py"},{"path":"/usr/lib/python3.14/encodings/cp1252.py"},{"path":"/usr/lib/python3.14/encodings/cp1253.py"},{"path":"/usr/lib/python3.14/encodings/cp1254.py"},{"path":"/usr/lib/python3.14/encodings/cp1255.py"},{"path":"/usr/lib/python3.14/encodings/cp1256.py"},{"path":"/usr/lib/python3.14/encodings/cp1257.py"},{"path":"/usr/lib/python3.14/encodings/cp1258.py"},{"path":"/usr/lib/python3.14/encodings/cp273.py"},{"path":"/usr/lib/python3.14/encodings/cp424.py"},{"path":"/usr/lib/python3.14/encodings/cp437.py"},{"path":"/usr/lib/python3.14/encodings/cp500.py"},{"path":"/usr/lib/python3.14/encodings/cp720.py"},{"path":"/usr/lib/python3.14/encodings/cp737.py"},{"path":"/usr/lib/python3.14/encodings/cp775.py"},{"path":"/usr/lib/python3.14/encodings/cp850.py"},{"path":"/usr/lib/python3.14/encodings/cp852.py"},{"path":"/usr/lib/python3.14/encodings/cp855.py"},{"path":"/usr/lib/python3.14/encodings/cp856.py"},{"path":"/usr/lib/python3.14/encodings/cp857.py"},{"path":"/usr/lib/python3.14/encodings/cp858.py"},{"path":"/usr/lib/python3.14/encodings/cp860.py"},{"path":"/usr/lib/python3.14/encodings/cp861.py"},{"path":"/usr/lib/python3.14/encodings/cp862.py"},{"path":"/usr/lib/python3.14/encodings/cp863.py"},{"path":"/usr/lib/python3.14/encodings/cp864.py"},{"path":"/usr/lib/python3.14/encodings/cp865.py"},{"path":"/usr/lib/python3.14/encodings/cp866.py"},{"path":"/usr/lib/python3.14/encodings/cp869.py"},{"path":"/usr/lib/python3.14/encodings/cp874.py"},{"path":"/usr/lib/python3.14/encodings/cp875.py"},{"path":"/usr/lib/python3.14/encodings/cp932.py"},{"path":"/usr/lib/python3.14/encodings/cp949.py"},{"path":"/usr/lib/python3.14/encodings/cp950.py"},{"path":"/usr/lib/python3.14/encodings/euc_jis_2004.py"},{"path":"/usr/lib/python3.14/encodings/euc_jisx0213.py"},{"path":"/usr/lib/python3.14/encodings/euc_jp.py"},{"path":"/usr/lib/python3.14/encodings/euc_kr.py"},{"path":"/usr/lib/python3.14/encodings/gb18030.py"},{"path":"/usr/lib/python3.14/encodings/gb2312.py"},{"path":"/usr/lib/python3.14/encodings/gbk.py"},{"path":"/usr/lib/python3.14/encodings/hex_codec.py"},{"path":"/usr/lib/python3.14/encodings/hp_roman8.py"},{"path":"/usr/lib/python3.14/encodings/hz.py"},{"path":"/usr/lib/python3.14/encodings/idna.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp_1.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp_2.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp_2004.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp_3.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_jp_ext.py"},{"path":"/usr/lib/python3.14/encodings/iso2022_kr.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_1.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_10.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_11.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_13.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_14.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_15.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_16.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_2.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_3.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_4.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_5.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_6.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_7.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_8.py"},{"path":"/usr/lib/python3.14/encodings/iso8859_9.py"},{"path":"/usr/lib/python3.14/encodings/johab.py"},{"path":"/usr/lib/python3.14/encodings/koi8_r.py"},{"path":"/usr/lib/python3.14/encodings/koi8_t.py"},{"path":"/usr/lib/python3.14/encodings/koi8_u.py"},{"path":"/usr/lib/python3.14/encodings/kz1048.py"},{"path":"/usr/lib/python3.14/encodings/latin_1.py"},{"path":"/usr/lib/python3.14/encodings/mac_arabic.py"},{"path":"/usr/lib/python3.14/encodings/mac_croatian.py"},{"path":"/usr/lib/python3.14/encodings/mac_cyrillic.py"},{"path":"/usr/lib/python3.14/encodings/mac_farsi.py"},{"path":"/usr/lib/python3.14/encodings/mac_greek.py"},{"path":"/usr/lib/python3.14/encodings/mac_iceland.py"},{"path":"/usr/lib/python3.14/encodings/mac_latin2.py"},{"path":"/usr/lib/python3.14/encodings/mac_roman.py"},{"path":"/usr/lib/python3.14/encodings/mac_romanian.py"},{"path":"/usr/lib/python3.14/encodings/mac_turkish.py"},{"path":"/usr/lib/python3.14/encodings/mbcs.py"},{"path":"/usr/lib/python3.14/encodings/oem.py"},{"path":"/usr/lib/python3.14/encodings/palmos.py"},{"path":"/usr/lib/python3.14/encodings/ptcp154.py"},{"path":"/usr/lib/python3.14/encodings/punycode.py"},{"path":"/usr/lib/python3.14/encodings/quopri_codec.py"},{"path":"/usr/lib/python3.14/encodings/raw_unicode_escape.py"},{"path":"/usr/lib/python3.14/encodings/rot_13.py"},{"path":"/usr/lib/python3.14/encodings/shift_jis.py"},{"path":"/usr/lib/python3.14/encodings/shift_jis_2004.py"},{"path":"/usr/lib/python3.14/encodings/shift_jisx0213.py"},{"path":"/usr/lib/python3.14/encodings/tis_620.py"},{"path":"/usr/lib/python3.14/encodings/undefined.py"},{"path":"/usr/lib/python3.14/encodings/unicode_escape.py"},{"path":"/usr/lib/python3.14/encodings/utf_16.py"},{"path":"/usr/lib/python3.14/encodings/utf_16_be.py"},{"path":"/usr/lib/python3.14/encodings/utf_16_le.py"},{"path":"/usr/lib/python3.14/encodings/utf_32.py"},{"path":"/usr/lib/python3.14/encodings/utf_32_be.py"},{"path":"/usr/lib/python3.14/encodings/utf_32_le.py"},{"path":"/usr/lib/python3.14/encodings/utf_7.py"},{"path":"/usr/lib/python3.14/encodings/utf_8.py"},{"path":"/usr/lib/python3.14/encodings/utf_8_sig.py"},{"path":"/usr/lib/python3.14/encodings/uu_codec.py"},{"path":"/usr/lib/python3.14/encodings/zlib_codec.py"},{"path":"/usr/lib/python3.14/ensurepip"},{"path":"/usr/lib/python3.14/ensurepip/__init__.py"},{"path":"/usr/lib/python3.14/ensurepip/__main__.py"},{"path":"/usr/lib/python3.14/ensurepip/_uninstall.py"},{"path":"/usr/lib/python3.14/ensurepip/_bundled"},{"path":"/usr/lib/python3.14/ensurepip/_bundled/pip-26.2.1-py3-none-any.whl"},{"path":"/usr/lib/python3.14/html"},{"path":"/usr/lib/python3.14/html/__init__.py"},{"path":"/usr/lib/python3.14/html/entities.py"},{"path":"/usr/lib/python3.14/html/parser.py"},{"path":"/usr/lib/python3.14/http"},{"path":"/usr/lib/python3.14/http/__init__.py"},{"path":"/usr/lib/python3.14/http/client.py"},{"path":"/usr/lib/python3.14/http/cookiejar.py"},{"path":"/usr/lib/python3.14/http/cookies.py"},{"path":"/usr/lib/python3.14/http/server.py"},{"path":"/usr/lib/python3.14/importlib"},{"path":"/usr/lib/python3.14/importlib/__init__.py"},{"path":"/usr/lib/python3.14/importlib/_abc.py"},{"path":"/usr/lib/python3.14/importlib/_bootstrap.py"},{"path":"/usr/lib/python3.14/importlib/_bootstrap_external.py"},{"path":"/usr/lib/python3.14/importlib/abc.py"},{"path":"/usr/lib/python3.14/importlib/machinery.py"},{"path":"/usr/lib/python3.14/importlib/readers.py"},{"path":"/usr/lib/python3.14/importlib/simple.py"},{"path":"/usr/lib/python3.14/importlib/util.py"},{"path":"/usr/lib/python3.14/importlib/metadata"},{"path":"/usr/lib/python3.14/importlib/metadata/__init__.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_adapters.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_collections.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_functools.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_itertools.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_meta.py"},{"path":"/usr/lib/python3.14/importlib/metadata/_text.py"},{"path":"/usr/lib/python3.14/importlib/metadata/diagnose.py"},{"path":"/usr/lib/python3.14/importlib/resources"},{"path":"/usr/lib/python3.14/importlib/resources/__init__.py"},{"path":"/usr/lib/python3.14/importlib/resources/_adapters.py"},{"path":"/usr/lib/python3.14/importlib/resources/_common.py"},{"path":"/usr/lib/python3.14/importlib/resources/_functional.py"},{"path":"/usr/lib/python3.14/importlib/resources/_itertools.py"},{"path":"/usr/lib/python3.14/importlib/resources/abc.py"},{"path":"/usr/lib/python3.14/importlib/resources/readers.py"},{"path":"/usr/lib/python3.14/importlib/resources/simple.py"},{"path":"/usr/lib/python3.14/json"},{"path":"/usr/lib/python3.14/json/__init__.py"},{"path":"/usr/lib/python3.14/json/__main__.py"},{"path":"/usr/lib/python3.14/json/decoder.py"},{"path":"/usr/lib/python3.14/json/encoder.py"},{"path":"/usr/lib/python3.14/json/scanner.py"},{"path":"/usr/lib/python3.14/json/tool.py"},{"path":"/usr/lib/python3.14/lib-dynload"},{"path":"/usr/lib/python3.14/lib-dynload/_asyncio.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_bisect.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_blake2.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_bz2.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_cn.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_hk.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_iso2022.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_jp.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_kr.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_codecs_tw.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_csv.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_ctypes_test.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_curses.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_curses_panel.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_dbm.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_decimal.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_elementtree.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_hashlib.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_heapq.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_hmac.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_interpchannels.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_interpqueues.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_interpreters.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_json.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_lsprof.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_lzma.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_md5.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_multibytecodec.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_multiprocessing.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_pickle.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_posixshmem.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_posixsubprocess.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_queue.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_random.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_remote_debugging.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_sha1.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_sha2.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_sha3.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_socket.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_sqlite3.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_ssl.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_statistics.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_struct.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testbuffer.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testcapi.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testclinic_limited.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testimportmultiple.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testinternalcapi.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testlimitedcapi.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testmultiphase.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_testsinglephase.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_xxtestfuzz.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/_zoneinfo.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/array.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/binascii.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/cmath.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/fcntl.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/grp.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/math.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/mmap.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/pyexpat.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/readline.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/resource.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/select.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/syslog.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/termios.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/unicodedata.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/xxlimited_35.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/xxsubtype.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/lib-dynload/zlib.cpython-314-x86_64-linux-musl.so"},{"path":"/usr/lib/python3.14/logging"},{"path":"/usr/lib/python3.14/logging/__init__.py"},{"path":"/usr/lib/python3.14/logging/config.py"},{"path":"/usr/lib/python3.14/logging/handlers.py"},{"path":"/usr/lib/python3.14/multiprocessing"},{"path":"/usr/lib/python3.14/multiprocessing/__init__.py"},{"path":"/usr/lib/python3.14/multiprocessing/connection.py"},{"path":"/usr/lib/python3.14/multiprocessing/context.py"},{"path":"/usr/lib/python3.14/multiprocessing/forkserver.py"},{"path":"/usr/lib/python3.14/multiprocessing/heap.py"},{"path":"/usr/lib/python3.14/multiprocessing/managers.py"},{"path":"/usr/lib/python3.14/multiprocessing/pool.py"},{"path":"/usr/lib/python3.14/multiprocessing/popen_fork.py"},{"path":"/usr/lib/python3.14/multiprocessing/popen_forkserver.py"},{"path":"/usr/lib/python3.14/multiprocessing/popen_spawn_posix.py"},{"path":"/usr/lib/python3.14/multiprocessing/popen_spawn_win32.py"},{"path":"/usr/lib/python3.14/multiprocessing/process.py"},{"path":"/usr/lib/python3.14/multiprocessing/queues.py"},{"path":"/usr/lib/python3.14/multiprocessing/reduction.py"},{"path":"/usr/lib/python3.14/multiprocessing/resource_sharer.py"},{"path":"/usr/lib/python3.14/multiprocessing/resource_tracker.py"},{"path":"/usr/lib/python3.14/multiprocessing/shared_memory.py"},{"path":"/usr/lib/python3.14/multiprocessing/sharedctypes.py"},{"path":"/usr/lib/python3.14/multiprocessing/spawn.py"},{"path":"/usr/lib/python3.14/multiprocessing/synchronize.py"},{"path":"/usr/lib/python3.14/multiprocessing/util.py"},{"path":"/usr/lib/python3.14/multiprocessing/dummy"},{"path":"/usr/lib/python3.14/multiprocessing/dummy/__init__.py"},{"path":"/usr/lib/python3.14/multiprocessing/dummy/connection.py"},{"path":"/usr/lib/python3.14/pathlib"},{"path":"/usr/lib/python3.14/pathlib/__init__.py"},{"path":"/usr/lib/python3.14/pathlib/_local.py"},{"path":"/usr/lib/python3.14/pathlib/_os.py"},{"path":"/usr/lib/python3.14/pathlib/types.py"},{"path":"/usr/lib/python3.14/pydoc_data"},{"path":"/usr/lib/python3.14/pydoc_data/__init__.py"},{"path":"/usr/lib/python3.14/pydoc_data/_pydoc.css"},{"path":"/usr/lib/python3.14/pydoc_data/module_docs.py"},{"path":"/usr/lib/python3.14/pydoc_data/topics.py"},{"path":"/usr/lib/python3.14/re"},{"path":"/usr/lib/python3.14/re/__init__.py"},{"path":"/usr/lib/python3.14/re/_casefix.py"},{"path":"/usr/lib/python3.14/re/_compiler.py"},{"path":"/usr/lib/python3.14/re/_constants.py"},{"path":"/usr/lib/python3.14/re/_parser.py"},{"path":"/usr/lib/python3.14/site-packages"},{"path":"/usr/lib/python3.14/site-packages/README.txt"},{"path":"/usr/lib/python3.14/sqlite3"},{"path":"/usr/lib/python3.14/sqlite3/__init__.py"},{"path":"/usr/lib/python3.14/sqlite3/__main__.py"},{"path":"/usr/lib/python3.14/sqlite3/dbapi2.py"},{"path":"/usr/lib/python3.14/sqlite3/dump.py"},{"path":"/usr/lib/python3.14/string"},{"path":"/usr/lib/python3.14/string/__init__.py"},{"path":"/usr/lib/python3.14/string/templatelib.py"},{"path":"/usr/lib/python3.14/sysconfig"},{"path":"/usr/lib/python3.14/sysconfig/__init__.py"},{"path":"/usr/lib/python3.14/sysconfig/__main__.py"},{"path":"/usr/lib/python3.14/tomllib"},{"path":"/usr/lib/python3.14/tomllib/__init__.py"},{"path":"/usr/lib/python3.14/tomllib/_parser.py"},{"path":"/usr/lib/python3.14/tomllib/_re.py"},{"path":"/usr/lib/python3.14/tomllib/_types.py"},{"path":"/usr/lib/python3.14/tomllib/mypy.ini"},{"path":"/usr/lib/python3.14/turtledemo"},{"path":"/usr/lib/python3.14/turtledemo/__init__.py"},{"path":"/usr/lib/python3.14/turtledemo/__main__.py"},{"path":"/usr/lib/python3.14/turtledemo/bytedesign.py"},{"path":"/usr/lib/python3.14/turtledemo/chaos.py"},{"path":"/usr/lib/python3.14/turtledemo/clock.py"},{"path":"/usr/lib/python3.14/turtledemo/colormixer.py"},{"path":"/usr/lib/python3.14/turtledemo/forest.py"},{"path":"/usr/lib/python3.14/turtledemo/fractalcurves.py"},{"path":"/usr/lib/python3.14/turtledemo/lindenmayer.py"},{"path":"/usr/lib/python3.14/turtledemo/minimal_hanoi.py"},{"path":"/usr/lib/python3.14/turtledemo/nim.py"},{"path":"/usr/lib/python3.14/turtledemo/paint.py"},{"path":"/usr/lib/python3.14/turtledemo/peace.py"},{"path":"/usr/lib/python3.14/turtledemo/penrose.py"},{"path":"/usr/lib/python3.14/turtledemo/planet_and_moon.py"},{"path":"/usr/lib/python3.14/turtledemo/rosette.py"},{"path":"/usr/lib/python3.14/turtledemo/round_dance.py"},{"path":"/usr/lib/python3.14/turtledemo/sorting_animate.py"},{"path":"/usr/lib/python3.14/turtledemo/tree.py"},{"path":"/usr/lib/python3.14/turtledemo/turtle.cfg"},{"path":"/usr/lib/python3.14/turtledemo/two_canvases.py"},{"path":"/usr/lib/python3.14/turtledemo/yinyang.py"},{"path":"/usr/lib/python3.14/unittest"},{"path":"/usr/lib/python3.14/unittest/__init__.py"},{"path":"/usr/lib/python3.14/unittest/__main__.py"},{"path":"/usr/lib/python3.14/unittest/_log.py"},{"path":"/usr/lib/python3.14/unittest/async_case.py"},{"path":"/usr/lib/python3.14/unittest/case.py"},{"path":"/usr/lib/python3.14/unittest/loader.py"},{"path":"/usr/lib/python3.14/unittest/main.py"},{"path":"/usr/lib/python3.14/unittest/mock.py"},{"path":"/usr/lib/python3.14/unittest/result.py"},{"path":"/usr/lib/python3.14/unittest/runner.py"},{"path":"/usr/lib/python3.14/unittest/signals.py"},{"path":"/usr/lib/python3.14/unittest/suite.py"},{"path":"/usr/lib/python3.14/unittest/util.py"},{"path":"/usr/lib/python3.14/urllib"},{"path":"/usr/lib/python3.14/urllib/__init__.py"},{"path":"/usr/lib/python3.14/urllib/error.py"},{"path":"/usr/lib/python3.14/urllib/parse.py"},{"path":"/usr/lib/python3.14/urllib/request.py"},{"path":"/usr/lib/python3.14/urllib/response.py"},{"path":"/usr/lib/python3.14/urllib/robotparser.py"},{"path":"/usr/lib/python3.14/venv"},{"path":"/usr/lib/python3.14/venv/__init__.py"},{"path":"/usr/lib/python3.14/venv/__main__.py"},{"path":"/usr/lib/python3.14/venv/scripts"},{"path":"/usr/lib/python3.14/venv/scripts/common"},{"path":"/usr/lib/python3.14/venv/scripts/common/Activate.ps1"},{"path":"/usr/lib/python3.14/venv/scripts/common/activate"},{"path":"/usr/lib/python3.14/venv/scripts/common/activate.fish"},{"path":"/usr/lib/python3.14/venv/scripts/posix"},{"path":"/usr/lib/python3.14/venv/scripts/posix/activate.csh"},{"path":"/usr/lib/python3.14/wsgiref"},{"path":"/usr/lib/python3.14/wsgiref/__init__.py"},{"path":"/usr/lib/python3.14/wsgiref/handlers.py"},{"path":"/usr/lib/python3.14/wsgiref/headers.py"},{"path":"/usr/lib/python3.14/wsgiref/simple_server.py"},{"path":"/usr/lib/python3.14/wsgiref/types.py"},{"path":"/usr/lib/python3.14/wsgiref/util.py"},{"path":"/usr/lib/python3.14/wsgiref/validate.py"},{"path":"/usr/lib/python3.14/xml"},{"path":"/usr/lib/python3.14/xml/__init__.py"},{"path":"/usr/lib/python3.14/xml/dom"},{"path":"/usr/lib/python3.14/xml/dom/NodeFilter.py"},{"path":"/usr/lib/python3.14/xml/dom/__init__.py"},{"path":"/usr/lib/python3.14/xml/dom/domreg.py"},{"path":"/usr/lib/python3.14/xml/dom/expatbuilder.py"},{"path":"/usr/lib/python3.14/xml/dom/minicompat.py"},{"path":"/usr/lib/python3.14/xml/dom/minidom.py"},{"path":"/usr/lib/python3.14/xml/dom/pulldom.py"},{"path":"/usr/lib/python3.14/xml/dom/xmlbuilder.py"},{"path":"/usr/lib/python3.14/xml/etree"},{"path":"/usr/lib/python3.14/xml/etree/ElementInclude.py"},{"path":"/usr/lib/python3.14/xml/etree/ElementPath.py"},{"path":"/usr/lib/python3.14/xml/etree/ElementTree.py"},{"path":"/usr/lib/python3.14/xml/etree/__init__.py"},{"path":"/usr/lib/python3.14/xml/etree/cElementTree.py"},{"path":"/usr/lib/python3.14/xml/parsers"},{"path":"/usr/lib/python3.14/xml/parsers/__init__.py"},{"path":"/usr/lib/python3.14/xml/parsers/expat.py"},{"path":"/usr/lib/python3.14/xml/sax"},{"path":"/usr/lib/python3.14/xml/sax/__init__.py"},{"path":"/usr/lib/python3.14/xml/sax/_exceptions.py"},{"path":"/usr/lib/python3.14/xml/sax/expatreader.py"},{"path":"/usr/lib/python3.14/xml/sax/handler.py"},{"path":"/usr/lib/python3.14/xml/sax/saxutils.py"},{"path":"/usr/lib/python3.14/xml/sax/xmlreader.py"},{"path":"/usr/lib/python3.14/xmlrpc"},{"path":"/usr/lib/python3.14/xmlrpc/__init__.py"},{"path":"/usr/lib/python3.14/xmlrpc/client.py"},{"path":"/usr/lib/python3.14/xmlrpc/server.py"},{"path":"/usr/lib/python3.14/zipfile"},{"path":"/usr/lib/python3.14/zipfile/__init__.py"},{"path":"/usr/lib/python3.14/zipfile/__main__.py"},{"path":"/usr/lib/python3.14/zipfile/_path"},{"path":"/usr/lib/python3.14/zipfile/_path/__init__.py"},{"path":"/usr/lib/python3.14/zipfile/_path/glob.py"},{"path":"/usr/lib/python3.14/zoneinfo"},{"path":"/usr/lib/python3.14/zoneinfo/__init__.py"},{"path":"/usr/lib/python3.14/zoneinfo/_common.py"},{"path":"/usr/lib/python3.14/zoneinfo/_tzpath.py"},{"path":"/usr/lib/python3.14/zoneinfo/_zoneinfo.py"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"python3"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:python:python:3.14.8:*:*:*:*:*:*:*"],"package":{"name":"python3","version":"3.14.8-r0"},"namespace":"nvd:cpe"}},{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:python_software_foundation:python:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-15367","versionConstraint":"< 3.15.0a6 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:python_software_foundation:python:3.14.8:*:*:*:*:*:*:*"],"package":{"name":"python3","version":"3.14.8-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-15367","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"cna@python.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15367","cwe":"CWE-77","type":"Secondary","source":"cna@python.org"}],"epss":[{"cve":"CVE-2025-15367","date":"2026-10-08","epss":0.00369,"percentile":0.28652}],"risk":0.20110500000000003,"urls":["https://github.com/python/cpython/commit/b234a2b67539f787e191d2ef19a7cbdce32874e7","https://github.com/python/cpython/issues/143923","https://github.com/python/cpython/pull/143924","https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15367","description":"The poplib module, when passed a user-controlled command, can have\nadditional commands injected using newlines. Mitigation rejects commands\ncontaining control characters."},"relatedVulnerabilities":[]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.0.0a1,<=2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-42vr-xj54-vc7v","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101918","date":"2026-10-08","epss":0.00358,"percentile":0.27501}],"risk":0.18437,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v","https://nvd.nist.gov/vuln/detail/CVE-2026-101918","https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-42vr-xj54-vc7v","description":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)"},"relatedVulnerabilities":[{"id":"CVE-2026-101918","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101918","cwe":"CWE-248","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-101918","date":"2026-10-08","epss":0.00358,"percentile":0.27501}],"urls":["https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101918","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occurs when an attacker-controlled recursively nested payload reaches json.loads. As a result, documented PyJWT exception handling does not contain the failure. Consequently, an unauthenticated request can raise an exception that may produce an HTTP 500 response. The advisory-defined affected implementation also includes jwt/api_jwt.py, verify_signature=False. This issue is fixed in version 2.15.0."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=1.26.0,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8988-9cw3-xx77","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-10-08","epss":0.00242,"percentile":0.14092}],"risk":0.18270999999999998,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8988-9cw3-xx77","description":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden"},"relatedVulnerabilities":[{"id":"CVE-2026-97687","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97687","cwe":"CWE-295","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97687","cwe":"CWE-440","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97687","date":"2026-10-08","epss":0.00242,"percentile":0.14092}],"urls":["https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97687","description":"urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain separated because target-server TLS settings are incorrectly applied to the HTTPS proxy connection. The trigger is that an application uses an HTTPS proxy and configures target-server TLS settings that must remain separate from the proxy TLS handshake, including HTTPS forwarding with target-specific identity or credentials. Applying cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections reusing the same context may connect to the HTTPS proxy without certificate verification. The attack mechanism is that an attacker intercepts and impersonates the HTTPS proxy after the effective proxy policy accepts the attacker's certificate. The impact is that the attacker can observe or modify forwarded traffic or receive a target TLS client certificate, while CONNECT tunneling still preserves the separate end-to-end target TLS connection. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"206b2f5eb82ce0f1","cpes":["cpe:2.3:a:python:urllib3:2.7.0:*:*:*:*:*:*:*"],"name":"urllib3","purl":"pkg:pypi/urllib3@2.7.0","type":"python","version":"2.7.0","language":"python","licenses":["MIT"],"locations":[{"path":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/urllib3-2.7.0.dist-info/RECORD","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"2.8.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-gh4c-6fx4-qh6g","versionConstraint":">=2.6.2,<2.8.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"urllib3","version":"2.7.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gh4c-6fx4-qh6g","fix":{"state":"fixed","versions":["2.8.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.8.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97688","date":"2026-10-08","epss":0.00291,"percentile":0.19899}],"risk":0.173145,"urls":["https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gh4c-6fx4-qh6g","description":"urllib3: Chunked Deflate streaming can enter an infinite loop"},"relatedVulnerabilities":[{"id":"CVE-2026-97688","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97688","cwe":"CWE-835","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97688","date":"2026-10-08","epss":0.00291,"percentile":0.19899}],"urls":["https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f","https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97688","description":"urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes, specifically a response with Transfer-Encoding: chunked and Content-Encoding: deflate, content decoding enabled, and the positive finite amt=N streaming chunk size. The attack mechanism is that a malicious server returns a compressed chunked response with trailing bytes after the Deflate stream. The impact is excessive CPU usage and a request that does not complete, and network read timeouts do not interrupt the loop because no further socket read occurs. This issue is fixed in version 2.8.0."}]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-10-08","epss":0.00291,"percentile":0.19874}],"risk":0.16732499999999997,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.13.0,<2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-8wjv-2p76-3863","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102265","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102265","date":"2026-10-08","epss":0.00301,"percentile":0.20929}],"risk":0.15501500000000001,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863","https://nvd.nist.gov/vuln/detail/CVE-2026-102265","https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-8wjv-2p76-3863","description":"PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header"},"relatedVulnerabilities":[{"id":"CVE-2026-102265","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102265","cwe":"CWE-674","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102265","date":"2026-10-08","epss":0.00301,"percentile":0.20929}],"urls":["https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102265","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError. This occurs when a deeply nested token header reaches json.loads. As a result, RecursionError escapes the documented PyJWT error hierarchy. Consequently, an unauthenticated malformed token can cause a request-level failure and HTTP 500. This issue is fixed in version 2.14.0."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.11.0,<=2.13.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-gvp8-978c-rx2q","fix":{"state":"not-fixed","versions":[]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103001","cwe":"CWE-471","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-103001","date":"2026-10-08","epss":0.00236,"percentile":0.13323}],"risk":0.1357,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q","https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-gvp8-978c-rx2q","description":"PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse"},"relatedVulnerabilities":[{"id":"CVE-2026-103001","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103001","cwe":"CWE-471","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-103001","date":"2026-10-08","epss":0.00236,"percentile":0.13323}],"urls":["https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35","https://github.com/jpadilla/pyjwt/issues/679","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103001","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses that same mapping for a later decode() or decode_complete() call and changes verify_signature to true, the mapping can retain false values for expiration, not-before, issued-at, audience, issuer, subject, and JWT ID checks. A signed token with invalid registered claims can then be accepted without disabling signature verification, but applications that create a fresh options mapping for each call are not affected."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.13.0,<2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-9j54-fg26-wv3r","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102266","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102266","date":"2026-10-08","epss":0.00182,"percentile":0.07143}],"risk":0.13559,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r","https://nvd.nist.gov/vuln/detail/CVE-2026-102266","https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-9j54-fg26-wv3r","description":"PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation"},"relatedVulnerabilities":[{"id":"CVE-2026-102266","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102266","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102266","date":"2026-10-08","epss":0.00182,"percentile":0.07143}],"urls":["https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102266","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. This occurs when a trusted JWK Set contains an oct entry with an empty k value. As a result, an attacker signs an HMAC token with the same zero-length key accepted by PyJWT. Consequently, forged token can carry arbitrary authenticated claims. This issue is fixed in version 2.14.0."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.4.0,<2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-p4g4-x82p-q773","fix":{"state":"fixed","versions":["2.14.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"2.14.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102271","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102271","date":"2026-10-08","epss":0.0018,"percentile":0.06971}],"risk":0.1341,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773","https://nvd.nist.gov/vuln/detail/CVE-2026-102271","https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0"],"severity":"High","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-p4g4-x82p-q773","description":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard"},"relatedVulnerabilities":[{"id":"CVE-2026-102271","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102271","cwe":"CWE-347","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102271","date":"2026-10-08","epss":0.0018,"percentile":0.06971}],"urls":["https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499","https://github.com/jpadilla/pyjwt/releases/tag/2.14.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102271","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.4.0 until 2.14.0, PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a DER public key as the shared verification key. As a result, PyJWT uses public DER bytes as an HMAC secret. Consequently, an attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0."}]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-08","epss":0.00171,"percentile":0.05865}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-08","epss":0.00171,"percentile":0.05865}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-08","epss":0.00171,"percentile":0.05865}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-10-08","epss":0.00171,"percentile":0.05865}],"risk":0.0884925,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.2","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-08","epss":0.00186,"percentile":0.07525}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-08","epss":0.00186,"percentile":0.07525}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-08","epss":0.00186,"percentile":0.07525}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.2&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-10-08","epss":0.00186,"percentile":0.07525}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"b5b0f3c0df9bfa23","cpes":["cpe:2.3:a:jose_padilla_\\=2.1.0,<=2.14.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"pyjwt","version":"2.13.0"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-x33g-cr3x-6449","fix":{"state":"fixed","versions":["2.15.0"],"available":[{"date":"2026-10-06","kind":"first-observed","version":"2.15.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102275","cwe":"CWE-348","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102275","date":"2026-10-08","epss":0.00143,"percentile":0.03096}],"risk":0.08222499999999999,"urls":["https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449","https://nvd.nist.gov/vuln/detail/CVE-2026-102275","https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-x33g-cr3x-6449","description":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion"},"relatedVulnerabilities":[{"id":"CVE-2026-102275","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102275","cwe":"CWE-345","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-102275","cwe":"CWE-348","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-102275","date":"2026-10-08","epss":0.00143,"percentile":0.03096}],"urls":["https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c","https://github.com/jpadilla/pyjwt/releases/tag/2.15.0","https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102275","description":"PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x. This occurs when an OKP private JWK supplies non-corresponding x and d components. As a result, identity derived from x can differ from operations performed with d. Consequently, if an integration also accepts private key parameters from a proof header without rejecting them, an attacker may use a stolen sender-constrained token without the legitimate private key. This issue is fixed in version 2.15.0."}]},{"artifact":{"id":"3f1c2605b180cc39","cpes":["cpe:2.3:a:oauthlib_community_project:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community_project:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community_project:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:oauthlib:3.3.1:*:*:*:*:*:*:*"],"name":"oauthlib","purl":"pkg:pypi/oauthlib@3.3.1","type":"python","version":"3.3.1","language":"python","licenses":["BSD-3-Clause"],"locations":[{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/METADATA","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/RECORD","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/top_level.txt","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-hj66-6f7g-4r5v","versionConstraint":">=0.6.1,<=3.3.1 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"oauthlib","version":"3.3.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-hj66-6f7g-4r5v","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-hj66-6f7g-4r5v","https://github.com/oauthlib/oauthlib/pull/951","https://github.com/oauthlib/oauthlib/commit/c888359f3c42bec235b2c5caab2069c9ed62457c"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-hj66-6f7g-4r5v","description":"Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation"},"relatedVulnerabilities":[{"id":"CVE-2026-49264","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"3f1c2605b180cc39","cpes":["cpe:2.3:a:oauthlib_community_project:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community_project:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community_project:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_communityproject:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib_community:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python-oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python_oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python-oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:python_oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:oauthlib:oauthlib:3.3.1:*:*:*:*:*:*:*","cpe:2.3:a:python:oauthlib:3.3.1:*:*:*:*:*:*:*"],"name":"oauthlib","purl":"pkg:pypi/oauthlib@3.3.1","type":"python","version":"3.3.1","language":"python","licenses":["BSD-3-Clause"],"locations":[{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/METADATA","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/METADATA","annotations":{"evidence":"primary"}},{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/RECORD","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/RECORD","annotations":{"evidence":"supporting"}},{"path":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/top_level.txt","layerID":"sha256:8d6d76870c837003d38092f62fb546f288a8c6c7c467e64ed8dd59d95b2f45a2","accessPath":"/lsiopy/lib/python3.14/site-packages/oauthlib-3.3.1.dist-info/top_level.txt","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"4.0.0"},"type":"exact-direct-match","found":{"vulnerabilityID":"GHSA-xpv3-w29h-x7cv","versionConstraint":">=3.0.0,<4.0.0 (python)"},"matcher":"python-matcher","searchedBy":{"package":{"name":"oauthlib","version":"3.3.1"},"language":"python","namespace":"github:language:python"}}],"vulnerability":{"id":"GHSA-xpv3-w29h-x7cv","fix":{"state":"fixed","versions":["4.0.0"],"available":[{"date":"2026-09-30","kind":"first-observed","version":"4.0.0"}]},"cvss":[{"type":"Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.8,"impactScore":5.2,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"risk":0,"urls":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950"],"severity":"Medium","namespace":"github:language:python","advisories":[],"dataSource":"https://github.com/advisories/GHSA-xpv3-w29h-x7cv","description":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)"},"relatedVulnerabilities":[{"id":"CVE-2026-49265","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-10-09T22:13:02.387Z","grype_db_version":"2026-10-09T06:32:32.000Z"}