Supplier SBOM under review
| Severity | CVE | Package | Installed | Fixed | Deadline |
|---|---|---|---|---|---|
| CRITICAL | GHSA-6q48-6c7w-9gw2 | certifi | 2026.7.22 | 2026.10.19 | within 7 days |
| HIGH | CVE-2024-34069 | Werkzeug | 3.0.1 | 3.0.3 | within 30 days |
| HIGH | CVE-2026-114134 | black | 23.12.1 | 26.10.1 | within 30 days |
| HIGH | CVE-2025-66418 | urllib3 | 2.1.0 | 2.6.0 | within 30 days |
| HIGH | CVE-2025-66471 | urllib3 | 2.1.0 | 2.6.0 | within 30 days |
| HIGH | CVE-2026-21441 | urllib3 | 2.1.0 | 2.6.3 | within 30 days |
| HIGH | CVE-2026-44431 | urllib3 | 2.1.0 | 2.7.0 | within 30 days |
| HIGH | CVE-2026-97687 | urllib3 | 2.1.0 | 2.8.0 | within 30 days |
| HIGH | CVE-2026-97689 | urllib3 | 2.1.0 | 2.8.0 | within 30 days |
| MEDIUM | CVE-2024-49766 | Werkzeug | 3.0.1 | 3.0.6 | Per policy |
| MEDIUM | CVE-2024-49767 | Werkzeug | 3.0.1 | 3.0.6 | Per policy |
| MEDIUM | CVE-2025-66221 | Werkzeug | 3.0.1 | 3.1.4 | Per policy |
| MEDIUM | CVE-2026-102598 | Werkzeug | 3.0.1 | 3.1.9 | Per policy |
| MEDIUM | CVE-2026-21860 | Werkzeug | 3.0.1 | 3.1.5 | Per policy |
| MEDIUM | CVE-2026-27199 | Werkzeug | 3.0.1 | 3.1.6 | Per policy |
| MEDIUM | CVE-2024-21503 | black | 23.12.1 | 24.3.0 | Per policy |
| MEDIUM | CVE-2025-71176 | pytest | 7.4.3 | 9.0.3 | Per policy |
| MEDIUM | CVE-2026-28684 | python-dotenv | 1.0.0 | 1.2.2 | Per policy |
| MEDIUM | CVE-2024-35195 | requests | 2.31.0 | 2.32.0 | Per policy |
| MEDIUM | CVE-2024-47081 | requests | 2.31.0 | 2.32.4 | Per policy |
| MEDIUM | CVE-2026-25645 | requests | 2.31.0 | 2.33.0 | Per policy |
| MEDIUM | CVE-2024-37891 | urllib3 | 2.1.0 | 1.26.19, 2.2.2 | Per policy |
| MEDIUM | CVE-2025-50181 | urllib3 | 2.1.0 | 2.5.0 | Per policy |
| LOW | CVE-2026-27205 | Flask | 3.0.0 | 3.1.3 | Per policy |
Distinct licenses identified: 9 (see the NOTICE artifact for details).
Each component is also recorded in the SBOM with a bomlens:licenseClass property. An unrecognized license is left uncategorized rather than assumed permissive.