| CRITICAL | | | | GHSA-6q48-6c7w-9gw2 | certifi | 2026.7.22 | 2026.10.19 | certifi bundles emSign root CAs with compromised intermediate CA keys |
| HIGH | | 7.5 | 0.033 | CVE-2024-34069 | Werkzeug | 3.0.1 | 3.0.3 | python-werkzeug: user may execute code on a developer's machine |
| HIGH | | 7.5 | 0.029 | CVE-2026-21441 | urllib3 | 2.1.0 | 2.6.3 | urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) |
| HIGH | | 7.5 | 0.006 | CVE-2025-66418 | urllib3 | 2.1.0 | 2.6.0 | urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion |
| HIGH | | 7.5 | 0.006 | CVE-2025-66471 | urllib3 | 2.1.0 | 2.6.0 | urllib3: urllib3 Streaming API improperly handles highly compressed data |
| HIGH | | 7.5 | 0.003 | CVE-2026-97689 | urllib3 | 2.1.0 | 2.8.0 | urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser |
| HIGH | | 5.9 | 0.003 | CVE-2026-44431 | urllib3 | 2.1.0 | 2.7.0 | urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers |
| HIGH | | 8.1 | 0.002 | CVE-2026-97687 | urllib3 | 2.1.0 | 2.8.0 | urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override |
| HIGH | | | | CVE-2026-114134 | black | 23.12.1 | 26.10.1 | Black: GitHub Action installs unvalidated required-version from pyproject.toml |
| MEDIUM | | 6.5 | 0.011 | CVE-2024-37891 | urllib3 | 2.1.0 | 1.26.19, 2.2.2 | urllib3: proxy-authorization request header is not stripped during cross-origin redirects |
| MEDIUM | | 7.5 | 0.01 | CVE-2024-49767 | Werkzeug | 3.0.1 | 3.0.6 | werkzeug: python-werkzeug: Werkzeug possible resource exhaustion when parsing file data in forms |
| MEDIUM | | 5.3 | 0.009 | CVE-2024-47081 | requests | 2.31.0 | 2.32.4 | requests: Requests vulnerable to .netrc credentials leak via malicious URLs |
| MEDIUM | | 5.3 | 0.009 | CVE-2024-21503 | black | 23.12.1 | 24.3.0 | psf/black: ReDoS via the lines_with_leading_tabs_expanded() function in strings.py file |
| MEDIUM | | 5.3 | 0.007 | CVE-2024-49766 | Werkzeug | 3.0.1 | 3.0.6 | werkzeug: python-werkzeug: Werkzeug safe_join not safe on Windows |
| MEDIUM | | 5.3 | 0.006 | CVE-2026-27199 | Werkzeug | 3.0.1 | 3.1.6 | Werkzeug safe_join() allows Windows special device names |
| MEDIUM | | 5.3 | 0.005 | CVE-2025-66221 | Werkzeug | 3.0.1 | 3.1.4 | Werkzeug: Werkzeug: Denial of service via Windows device names in path segments |
| MEDIUM | | 5.3 | 0.004 | CVE-2026-21860 | Werkzeug | 3.0.1 | 3.1.5 | Werkzeug safe_join() allows Windows special device names with compound extensions |
| MEDIUM | | 6.1 | 0.004 | CVE-2025-50181 | urllib3 | 2.1.0 | 2.5.0 | urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation |
| MEDIUM | | 5.3 | 0.003 | CVE-2026-102598 | Werkzeug | 3.0.1 | 3.1.9 | werkzeug: werkzeug: Denial of Service via safe_join() Windows special device paths |
| MEDIUM | | 5.6 | 0.003 | CVE-2024-35195 | requests | 2.31.0 | 2.32.0 | requests: subsequent requests to the same host ignore cert verification |
| MEDIUM | | 7.1 | 0.002 | CVE-2026-28684 | python-dotenv | 1.0.0 | 1.2.2 | python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following |
| MEDIUM | | 5.5 | 0.001 | CVE-2026-25645 | requests | 2.31.0 | 2.33.0 | requests: Requests: Security bypass due to predictable temporary file creation |
| MEDIUM | | 6.8 | 0.001 | CVE-2025-71176 | pytest | 7.4.3 | 9.0.3 | pytest: pytest: Denial of Service or Privilege Escalation via insecure temporary directory handling |
| LOW | | 4.3 | 0.004 | CVE-2026-27205 | Flask | 3.0.0 | 3.1.3 | flask: Flask: Information disclosure via improper caching of session data |