ESL SBOMator

Professional SBOM Analysis & Vulnerability Management

www.eswlab.com | Engineering Software Lab

ESL SBOMator

Project in Report:

XFusion

Report created: 2026-11-03 10:22:41

About This Report: XFusion Supply-Chain Scan

Project: xray-imaging/XFusion is an open-source X-ray imaging application. This scan inventories every software component in the project's build and runtime environment (including its pinned conda environment), matches each component against the local NVD database, OSV, CISA KEV and EPSS, and screens the dependency tree for malicious packages and supply-chain threats.

Findings: 554 components were analyzed; 84 components have CVE matches, 943 application CVEs are reported (0 from vendored SDKs), each with severity, exploitability and lifecycle data, plus a VEX section documenting the triage state of every finding. The malicious-package screen reports 0 malicious packages: one "Shai-Hulud 2.0 Worm" alert raised against conda's brotli-python 1.0.9 was identified as a false positive. The conda package is the official Python binding of Google's Brotli library; the alert came from a removed PyPI typosquatter that shares only the package name (advisories MAL-2025-47749 and GHSA-Q598-9GX5-VWMW were withdrawn from this report, and the parser now emits the correct package identity). The data-quality warning below flags components with unresolved versions or missing licenses; those need review before any regulator submission.

⚠️ SBOM DATA QUALITY WARNING: DO NOT SUBMIT TO REGULATORS ⚠️

🔴 1 component(s) with unresolved versions: aws-iot-device-sdk-cpp-v2

🔴 23 component(s) with missing licenses: einops, taming-transformers, -anaconda-depends, _libgcc_mutex, backports, conda-content-trust, conda-package-handling, conda-verify, dask-core, jupyterlab-variableinspector (+13 more)

Why this matters: Exact versions are needed for reliable vulnerability matching. Unresolved versions mean "0 CVEs" for these components is not analyzed, not no vulnerabilities. Complete license evidence is required by SBOMator's release-quality policy. Licenses are not an NTIA SBOM minimum element.

aws-iot-device-sdk-cpp-v2
Why unresolved: aws-iot-device-sdk-cpp-v2 is declared as a component, but its metadata contains no trustworthy exact version evidence. A declaration alone does not prove presence in the delivered product or at runtime.
Evidence needed: Provide delivered-product evidence for the exact version, such as a package manifest, lockfile, binary metadata, linker map, or signed supplier build record.

How to fix:

Use delivered-product evidence: package/root-filesystem manifests, lockfiles, binary metadata, linker maps, or signed supplier build records.
For C/C++ and embedded builds, provide the production sysroot or image manifest and the deployed libraries; a CMake minimum requirement is not an exact delivered version.
For managed ecosystems, provide the applicable lockfile or installed-environment export with exact versions, then re-scan.
For missing licenses, enable Online Mode for registry metadata or attach authoritative package, source, or supplier license evidence.

554

Total Components

84

Components with CVE Matches

943

App CVEs

0

Vendored SDK CVEs

15.2%

Components with CVE Matches

🤖 AI/ML SBOM Profile

Status: Enabled

Checking Level: Medium

AI SBOM add-on metadata is present.
The scan requested AI model/framework, dataset, infrastructure, and AI minimum-elements review guidance. Some AI fields still require manual confirmation, including dataset provenance, data sensitivity, training/fine-tuning method, user-data retention, and implemented AI security controls.

🛡️ Model Artifact Security

Model inspection is static; it reports what a file can execute when loaded and does not assess model weights, training data or model behaviour. Findings use ESL model finding classes and are listed here, not in the CVE tables; every inspection state is shown, including files that were not or could not be inspected.

File	Detected format	Status	Risk	Finding	Licence	Licence source
niqe_pris_params.npz	numpy-npz-archive	inspected	low	no finding — static inspection of the file contents reported no code-execution construct	Not declared

0

Ransomware CVEs

Used in ransomware campaigns

3

Weaponized CVEs

Actively exploited in wild

868

No Known Exploitation

CVEs without active exploitation

72

Exploitation Not Assessed

No KEV analysis evidence in this SBOM

0

VEX Not Affected

KEV status does not apply to this component

🏢 Vendor/Manufacturer Distribution

Conda (Anaconda)

501 components

90.4%

Amazon Web Services

3 components

0.5%

Tom Ritchford

3 components

0.5%

Lightning AI et al.

3 components

0.5%

Google LLC

2 components

0.4%

Unique CVE/Advisory Severity Distribution

62 Critical

455 High

343 Medium

79 Low

4 Unknown

943 unique CVE/advisory IDs across 947 component/CVE matches.

A finding linked to multiple installed packages is counted once in this severity and KEV summary, and once per component in the table.

Click any CVE/advisory ID below to view detailed vulnerability information from the source database

SBOM Version and License Quality Gate

BLOCKED. 1 unresolved version(s) and 24 missing license(s) lack a valid, matching approval. This SBOM is NOT regulator-ready. Resolve each field below or add a component-specific approval to .sbomator_component_suppressions.json.

Scan warnings. These limit what the versions and CVE results above can prove.

Detected partially supported C/C++ build systems (Make/Makefile). Automatic scanning will run, but review the output for missing proprietary, SDK, or vendored components.

553
Non-placeholder version values

0
Justified version exceptions

530
Non-placeholder license values

0
Justified license exceptions

Component	ID	Field	Observed Value	Reason
einops	pkg:pypi/einops@0.3.0	license	`<missing>`	no valid component-specific approval was found
taming-transformers	pkg:pypi/taming-transformers@0.0.1	license	`<missing>`	no valid component-specific approval was found
-anaconda-depends	pkg:pypi/-anaconda-depends@2024.02	license	`<missing>`	no valid component-specific approval was found
_libgcc_mutex	pkg:generic/libgcc-mutex@0.1	license	`<missing>`	no valid component-specific approval was found
backports	pkg:pypi/backports@1.1	license	`<missing>`	no valid component-specific approval was found
brotli	pkg:pypi/brotli@1.0.9	license	`<missing>`	no valid component-specific approval was found
conda-content-trust	pkg:pypi/conda-content-trust@0.2.0	license	`<missing>`	no valid component-specific approval was found
conda-package-handling	pkg:pypi/conda-package-handling@2.2.0	license	`<missing>`	no valid component-specific approval was found
conda-verify	pkg:pypi/conda-verify@3.4.2	license	`<missing>`	no valid component-specific approval was found
dask-core	pkg:pypi/dask-core@2023.11.0	license	`<missing>`	no valid component-specific approval was found
jupyterlab-variableinspector	pkg:pypi/jupyterlab-variableinspector@3.1.0	license	`<missing>`	no valid component-specific approval was found
libmambapy	pkg:pypi/libmambapy@1.5.6	license	`<missing>`	no valid component-specific approval was found
matplotlib-base	pkg:pypi/matplotlib-base@3.8.0	license	`<missing>`	no valid component-specific approval was found
menuinst	pkg:pypi/menuinst@2.0.2	license	`<missing>`	no valid component-specific approval was found
numpy-base	pkg:pypi/numpy-base@1.26.4	license	`<missing>`	no valid component-specific approval was found
pyqt	pkg:pypi/pyqt@5.15.10	license	`<missing>`	no valid component-specific approval was found
pyqtwebengine	pkg:pypi/pyqtwebengine@5.15.10	license	`<missing>`	no valid component-specific approval was found
pytables	pkg:pypi/pytables@3.9.2	license	`<missing>`	no valid component-specific approval was found
python-lsp-jsonrpc	pkg:pypi/python-lsp-jsonrpc@1.0.0	license	`<missing>`	no valid component-specific approval was found
pytorch-cuda	pkg:generic/pytorch-cuda@12.1	license	`<missing>`	no valid component-specific approval was found
pytorch-mutex	pkg:generic/pytorch-mutex@1.0	license	`<missing>`	no valid component-specific approval was found
torchtriton	pkg:pypi/torchtriton@2.2.0	license	`<missing>`	no valid component-specific approval was found
zope	pkg:pypi/zope@1.0	license	`<missing>`	no valid component-specific approval was found
aws-iot-device-sdk-cpp-v2	pkg:github/aws/aws-iot-device-sdk-cpp-v2	version	`<missing>`	no valid component-specific approval was found
niqe_pris_params.npz	model:xfusion/train/basicsr/metrics/niqe_pris_params.npz@sha256:2a7c182a68c9e7f1	license	`<missing>`	no valid component-specific approval was found

No approved version or license exceptions were required.

Component Vulnerability Analysis

OSV/PyPA/GHSA enrichment: Queried 403 ecosystem package(s) via OSV.dev querybatch API and added 35 additional advisories.

CVE analysis coverage (configured sources): 85 matched 348 scanned, no CVE 119 not analyzed 1 not evaluated (unversioned) 1 not applicable
119 of 554 components (21%) could not be assessed by the configured CVE sources (for example: no concrete version, no queryable package identity, or an excluded system component), so their absence of CVEs is not evidence they are unaffected. Only the 348 "scanned, no CVE" components were queried and returned no version-applicable advisory. See each component's esl:cve_analysis property for its exact status and reason.

Unversioned components: 1 component(s) 0 candidate CVE(s)
These components have no usable version (missing, unknown, UNRESOLVED, system, latest or n/a), so CVE applicability could not be evaluated. Candidate CVEs for the product name are recorded in the SBOM as in_triage with esl:vulnerability:applicability = version_unresolved; they are not confirmed findings and are excluded from the counts above. Resolve the version with the Investigate unknown version workflow (Step 37) or record an analyst decision.

Component	Recorded version	Supplier	Candidate CVEs	Truncated	Ledger status
`aws-iot-device-sdk-cpp-v2`	`(missing)`	Amazon.com, Inc	0	no	not_evaluated: unversioned

Threat-Based Prioritization: Components are sorted by security threat level: RANSOMWARE WEAPONIZED Standard CVEs No CVEs

Show response window ⓘ

Component	Version	Type	Vendor	License	CVEs	Score	Severity	Claimed / Computed	Response window ⓘ	Vulnerabilities (Click CVE IDs)
brotli WEAPONIZED conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-111497; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-111497	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	1	9.2	Critical	CRITICAL / n/a	6 days left	Out-of-Bounds Write 1 CVE CVE-2026-111497 EUVD-2026-108169 WEAPONIZED CWE-252 CWE-787 EPSS 82.6% Grype
starlette WEAPONIZED conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-86qp-5c8j-p5mr, https://github.com/advisories/GHSA-v5gw-mw7f-84px, https://github.com/advisories/GHSA-74m5-2c7w-9w3x (+6 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-86qp-5c8j-p5mr \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-v5gw-mw7f-84px \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-74m5-2c7w-9w3x	0.22.0	library	📦 Tom Christie Source: registry_cache:pypi_api	BSD-3-Clause PYPI	9	8.7	High	HIGH / HIGH	overdue by 48 days overdue by 1237 days overdue by 1277 days overdue by 455 days overdue by 734 days overdue by 119 days overdue by 124 days overdue by 119 days overdue by 124 days	HTTP Request/Response Smuggling 1 CVE CVE-2026-48710 EUVD-2026-32016 WEAPONIZED CWE-444 CWE-1289 EPSS 70.3% Grype Path Traversal 1 CVE CVE-2023-29159 EUVD-2023-0245 CWE-22 CWE-22 EPSS 2.0% Grype Uncontrolled Resource Consumption 1 CVE CVE-2023-30798 EUVD-2023-0244 CWE-400 CWE-400 EPSS 1.3% Grype Starlette has possible denial-of-service vector when parsing large files in multipart forms 1 CVE CVE-2025-54121 EUVD-2025-22159 CWE-770 EPSS 0.7% Grype Starlette Denial of service (DoS) via multipart/form-data 1 CVE CVE-2024-47874 EUVD-2024-3029 CWE-770 EPSS 0.7% Grype Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS 1 CVE CVE-2026-54283 EUVD-2026-38319 CWE-770 EPSS 0.5% Grype Server-Side Request Forgery 1 CVE CVE-2026-48818 EUVD-2026-37773 CWE-918 CWE-918 EPSS 0.4% Grype Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname 1 CVE CVE-2026-54282 EUVD-2026-38318 CWE-706 EPSS 0.3% Grype Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr` 1 CVE CVE-2026-48817 EUVD-2026-37788 CWE-470 EPSS 0.2% Grype
FreeType WEAPONIZED conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2025-27363; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-27363	2.12.1	library	📦 FreeType Project Source: existing	FTL	1	8.1	High	HIGH / HIGH	overdue by 525 days	Out-of-Bounds Write 1 CVE CVE-2025-27363 EUVD-2025-6367 WEAPONIZED CWE-787 EPSS 27.8% Grype
deepdiff conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-mw26-5g2v-hqw3, https://github.com/advisories/GHSA-54jj-px8x-5w5q; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-mw26-5g2v-hqw3 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-54jj-px8x-5w5q	6.7.1	library	📦 Seperman Source: registry_cache:pypi_api	MIT PYPI	2	10.0	Critical	CRITICAL / n/a	overdue by 409 days overdue by 213 days	DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more 1 CVE CVE-2025-58367 EUVD-2025-27049 CWE-915 EPSS 1.2% Grype Uncontrolled Resource Consumption 1 CVE CVE-2026-33155 EUVD-2026-13792 CWE-400 CWE-770 EPSS 0.5% Grype
nltk conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-cgvx-9447-vcch, https://github.com/advisories/GHSA-x99w-6fgc-pmfw, https://github.com/advisories/GHSA-jm6w-m3j8-898g (+42 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-cgvx-9447-vcch \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-x99w-6fgc-pmfw \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-jm6w-m3j8-898g	3.8.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	45	10.0	Critical	CRITICAL / CRITICAL	overdue by 844 days overdue by 55 days overdue by 213 days overdue by 243 days overdue by 229 days overdue by 55 days overdue by 60 days overdue by 58 days overdue by 54 days overdue by 119 days	Deserialization of Untrusted Data 3 CVEs CVE-2024-39705 EUVD-2024-0118 CWE-502 EPSS 1.3% Grype CVE-2026-79657 EUVD-2026-65440 CWE-502 EPSS 1.3% Grype CVE-2026-78683 EUVD-2026-65229 CWE-502 EPSS 0.5% Grype Unauthenticated remote shutdown in nltk.app.wordnet_app 1 CVE CVE-2026-33231 EUVD-2026-13885 CWE-306 CWE-306 EPSS 1.2% Grype Code Injection 2 CVEs CVE-2025-14009 EUVD-2025-207820 CWE-94 CWE-94 EPSS 1.0% Grype CVE-2026-12252 EUVD-2026-41656 CWE-94 EPSS 0.2% Grype Path Traversal 9 CVEs CVE-2026-0847 EUVD-2026-9475 CWE-22 CWE-22 EPSS 1.0% Grype CVE-2026-63312 EUVD-2026-64333 CWE-22 EPSS 0.7% Grype CVE-2026-54293 EUVD-2026-38333 CWE-22 CWE-22 EPSS 0.6% Grype CVE-2026-33236 EUVD-2026-13887 CWE-22 CWE-22 EPSS 0.6% Grype
lightning conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-cgwc-qvrx-rf7f, https://github.com/advisories/GHSA-mr7h-w2qc-ffc2, https://github.com/advisories/GHSA-qqmf-gpg7-g8gw; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-cgwc-qvrx-rf7f \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-mr7h-w2qc-ffc2 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-qqmf-gpg7-g8gw	1.9.0	library	📦 Lightning AI et al. Source: registry_cache:pypi_api	Apache-2.0 PYPI	3	9.8	Critical	CRITICAL / CRITICAL	overdue by 865 days overdue by 844 days overdue by 96 days	Remote code execution in pytorch lightning 1 CVE CVE-2024-5452 EUVD-2024-2023 CWE-915 CWE-913 EPSS 26.8% Grype Path Traversal 1 CVE CVE-2024-5980 EUVD-2024-2112 CWE-22 EPSS 1.3% Grype PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparameters 1 CVE CVE-2026-58659 EUVD-2026-44751 CWE-470 EPSS 0.6% Grype
curl conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-2398, https://nvd.nist.gov/vuln/detail/CVE-2024-7264, https://nvd.nist.gov/vuln/detail/CVE-2024-9681 (+53 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-2398 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-7264 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-9681	8.5.0	library	📦 Daniel Stenberg Source: existing	MIT AND/OR curl	56	9.8	Critical	CRITICAL / CRITICAL	overdue by 937 days overdue by 811 days overdue by 713 days overdue by 678 days overdue by 621 days overdue by 937 days overdue by 403 days overdue by 937 days 0 days left overdue by 43 days	Other vulnerabilities 37 CVEs CVE-2024-2398 EUVD-2024-27350 CWE-772 EPSS 36.1% Grype CVE-2024-9681 EUVD-2024-50377 CWE-697 EPSS 2.0% Grype CVE-2024-11053 EUVD-2024-34411 EPSS 2.0% Grype CVE-2025-0725 EUVD-2025-1837 CWE-120 EPSS 1.8% Grype CVE-2024-2004 EUVD-2024-26974 CWE-436 EPSS 1.7% Grype CVE-2025-9086 EUVD-2025-29014 CWE-125 CWE-125 EPSS 1.5% Grype CVE-2024-2466 EUVD-2024-27415 CWE-297 EPSS 1.5% Grype CVE-2026-92391 EUVD-2026-105322 CWE-674 EPSS 1.2% Grype CVE-2026-19931 EUVD-2026-72166 CWE-488 CWE-488 EPSS 1.1% Grype CVE-2026-86409 EUVD-2026-105274 CWE-201 EPSS 1.1% Grype
expat conda Scanner: grype, osv_crosscheck; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2023-52425, https://nvd.nist.gov/vuln/detail/CVE-2024-28757, https://nvd.nist.gov/vuln/detail/CVE-2024-45490 (+34 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-52425 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-28757 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-45490	2.5.0	library	📦 Conda (Anaconda) Source: existing	MIT	39	9.8	Critical	CRITICAL / CRITICAL	overdue by 988 days overdue by 954 days overdue by 781 days overdue by 781 days overdue by 400 days overdue by 584 days overdue by 781 days overdue by 723 days overdue by 62 days overdue by 163 days	Uncontrolled Resource Consumption 1 CVE CVE-2023-52425 EUVD-2023-57052 CWE-400 CWE-400 EPSS 2.1% Grype Other vulnerabilities 12 CVEs CVE-2024-28757 EUVD-2024-25843 CWE-776 CWE-776 EPSS 2.0% Grype CVE-2025-59375 EUVD-2025-29148 CWE-770 EPSS 1.4% Grype CVE-2026-45186 EUVD-2026-28985 CWE-407 CWE-407 EPSS 0.5% Grype CVE-2026-93990 EUVD-2026-83618 CWE-176 EPSS 0.4% Grype CVE-2025-66382 EUVD-2025-199862 CWE-407 EPSS 0.2% Grype CVE-2026-25210 EUVD-2026-5042 CWE-190 EPSS 0.2% Grype CVE-2026-50219 EUVD-2026-34206 CWE-416 EPSS 0.2% Grype CVE-2026-56412 EUVD-2026-38189 CWE-416 EPSS 0.2% Grype CVE-2026-56131 EUVD-2026-37976 CWE-416 EPSS 0.2% Grype
FFmpeg conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2021-38291, https://nvd.nist.gov/vuln/detail/CVE-2020-14212, https://nvd.nist.gov/vuln/detail/CVE-2026-8461 (+59 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-38291 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2020-14212 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-8461	4.3	library	📦 FFmpeg team Source: existing	LGPL-2.1-or-later	62	9.8	Critical	CRITICAL / CRITICAL	overdue by 1894 days overdue by 2316 days overdue by 123 days overdue by 1403 days overdue by 913 days overdue by 1300 days overdue by 805 days overdue by 1165 days overdue by 798 days overdue by 1631 days	Other vulnerabilities 13 CVEs CVE-2021-38291 EUVD-2021-24749 CWE-617 EPSS 2.7% Grype CVE-2022-3109 EUVD-2022-42536 CWE-476 CWE-476 EPSS 1.6% Grype CVE-2022-48434 EUVD-2022-51130 CWE-416 CWE-416 EPSS 1.5% Grype CVE-2020-36138 EUVD-2020-23716 CWE-476 EPSS 1.2% Grype CVE-2022-3341 EUVD-2022-42728 CWE-476 CWE-476 EPSS 0.9% Grype CVE-2023-50010 EUVD-2023-54840 CWE-120 EPSS 0.5% Grype CVE-2026-30999 EUVD-2026-21976 CWE-122 EPSS 0.5% Grype CVE-2025-9951 EUVD-2025-27255 CWE-122 EPSS 0.4% Grype CVE-2025-22919 EUVD-2025-4646 CWE-617 EPSS 0.4% Grype CVE-2026-30997 EUVD-2026-21972 CWE-125 EPSS 0.3% Grype
hdf5 conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2021-37501, https://nvd.nist.gov/vuln/detail/CVE-2024-32615, https://nvd.nist.gov/vuln/detail/CVE-2024-32622 (+52 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-37501 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-32615 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-32622	1.12.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	55	9.8	Critical	CRITICAL / CRITICAL	overdue by 1354 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days overdue by 888 days	Out-of-Bounds Write 11 CVEs CVE-2021-37501 EUVD-2021-24066 CWE-787 CWE-787 EPSS 1.5% Grype CVE-2024-32615 EUVD-2024-30417 CWE-787 EPSS 1.1% Grype CVE-2024-32608 EUVD-2024-30410 CWE-787 CWE-787 EPSS 0.7% Grype CVE-2026-26200 EUVD-2026-7979 CWE-122 CWE-787 +1 EPSS 0.4% Grype CVE-2025-6516 EUVD-2025-18903 CWE-119 CWE-122 +1 EPSS 0.4% Grype CVE-2025-2915 EUVD-2025-8640 CWE-119 CWE-122 +1 EPSS 0.3% Grype CVE-2025-2924 EUVD-2025-8649 CWE-119 CWE-122 +1 EPSS 0.3% Grype CVE-2025-2912 EUVD-2025-8636 CWE-119 CWE-122 +1 EPSS 0.3% Grype CVE-2025-2923 EUVD-2025-8650 CWE-119 CWE-122 +1 EPSS 0.3% Grype CVE-2025-2914 EUVD-2025-8637 CWE-119 CWE-122 +1 EPSS 0.3% Grype
jupyterlab conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-37w4-hwhx-4rc4, https://github.com/advisories/GHSA-pppj-hq3g-57pj, https://github.com/advisories/GHSA-gx64-gj6p-pc4c (+9 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-37w4-hwhx-4rc4 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-pppj-hq3g-57pj \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-gx64-gj6p-pc4c	4.0.11	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	12	9.8	Critical	CRITICAL / CRITICAL	overdue by 159 days overdue by 67 days overdue by 68 days overdue by 159 days overdue by 166 days overdue by 782 days overdue by 20 days overdue by 388 days overdue by 20 days overdue by 825 days	Other vulnerabilities 3 CVEs CVE-2026-42266 EUVD-2026-29995 CWE-88 CWE-602 +1 EPSS 5.7% Grype CVE-2024-39700 OSV ⚠️GHSA-WHVH-WF3X-G77J Grype Cross-Site Scripting 7 CVEs CVE-2026-73417 EUVD-2026-58522 CWE-79 CWE-116 EPSS 0.7% Grype CVE-2026-73415 EUVD-2026-57535 CWE-79 EPSS 0.7% Grype CVE-2026-42557 EUVD-2026-30000 CWE-79 CWE-79 EPSS 0.5% Grype CVE-2026-40171 EUVD-2026-28153 CWE-79 EPSS 0.5% Grype CVE-2024-43805 EUVD-2024-2550 CWE-79 CWE-79 EPSS 0.4% Grype CVE-2026-102830 EUVD-2026-89337 CWE-79 CWE-94 EPSS 0.3% Grype ⚠️GHSA-VMHF-C436-HXJ4 Grype
libarchive conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-26256, https://nvd.nist.gov/vuln/detail/CVE-2024-20697, https://nvd.nist.gov/vuln/detail/CVE-2026-4424 (+16 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-26256 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-20697 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-4424	3.6.2	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	19	9.8	Critical	CRITICAL / CRITICAL	overdue by 923 days overdue by 1014 days overdue by 214 days overdue by 204 days overdue by 740 days overdue by 570 days overdue by 740 days overdue by 497 days overdue by 497 days overdue by 597 days	Out-of-Bounds Write 2 CVEs CVE-2024-26256 EUVD-2024-23532 CWE-122 CWE-787 EPSS 87.9% Grype CVE-2025-5917 EUVD-2025-17574 CWE-787 EPSS 0.2% Grype Windows libarchive Remote Code Execution 1 CVE CVE-2024-20697 EUVD-2024-18412 CWE-122 EPSS 72.2% Grype A flaw was found in libarchive. This heap out-of-bounds read 1 CVE CVE-2026-4424 EUVD-2026-13097 CWE-125 CWE-125 EPSS 1.3% Grype A flaw was found in libarchive. On 32-bit systems, an integer overflow 1 CVE CVE-2026-5121 EUVD-2026-17073 CWE-190 CWE-190 EPSS 1.1% Grype Other vulnerabilities 5 CVEs CVE-2024-48958 EUVD-2024-43151 CWE-125 CWE-125 EPSS 0.6% Grype CVE-2024-48957 EUVD-2024-43150 CWE-125 CWE-125 EPSS 0.5% Grype CVE-2025-5914 EUVD-2025-17572 CWE-190 EPSS 0.5% Grype CVE-2025-25724 EUVD-2025-5869 CWE-252 EPSS 0.4% Grype CVE-2024-57970 EUVD-2024-53870 CWE-126 EPSS 0.2% Grype
libglib conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-52533, https://nvd.nist.gov/vuln/detail/CVE-2026-58015, https://nvd.nist.gov/vuln/detail/CVE-2025-14087 (+12 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-52533 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-58015 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-14087	2.78.4	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later	15	9.8	Critical	CRITICAL / CRITICAL ⚠	overdue by 707 days overdue by 195 days overdue by 313 days overdue by 895 days overdue by 560 days overdue by 313 days overdue by 111 days overdue by 196 days overdue by 448 days overdue by 493 days	An off-by-one error and resultant buffer overflow 1 CVE CVE-2024-52533 EUVD-2024-45936 CWE-120 EPSS 1.5% Grype Path Traversal 1 CVE CVE-2026-58015 EUVD-2026-40318 CWE-22 CWE-22 EPSS 0.8% Grype A flaw was found in GLib (Gnome Lib). This 1 CVE CVE-2025-14087 EUVD-2025-202405 CWE-190 EPSS 0.8% Grype An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. 1 CVE CVE-2024-34397 EUVD-2024-34763 CWE-290 EPSS 0.8% Grype A flaw was found in GLib. 4 CVEs CVE-2025-3360 EUVD-2025-10006 CWE-190 EPSS 0.7% Grype CVE-2026-58016 EUVD-2026-40319 CWE-191 EPSS 0.6% Grype CVE-2026-58014 EUVD-2026-40316 CWE-193 EPSS 0.6% Grype CVE-2026-58011 EUVD-2026-40313 CWE-125 EPSS 0.5% Grype A flaw was found in glib. This 1 CVE CVE-2025-14512 EUVD-2025-202664 CWE-190 EPSS 0.6% Grype Code Injection 1 CVE CVE-2025-4056 EUVD-2025-22903 CWE-94 EPSS 0.5% Grype
libxml2 conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-34459, https://nvd.nist.gov/vuln/detail/CVE-2025-49796, https://nvd.nist.gov/vuln/detail/CVE-2025-6021 (+26 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-34459 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-49796 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-6021	2.10.4	library	📦 Conda (Anaconda) Source: existing	MIT	29	9.8	Critical	CRITICAL / CRITICAL	overdue by 888 days overdue by 490 days overdue by 494 days overdue by 988 days overdue by 608 days overdue by 608 days overdue by 1109 days overdue by 277 days overdue by 497 days overdue by 490 days	An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. 1 CVE CVE-2024-34459 EUVD-2024-34814 CWE-122 EPSS 1.8% Grype A vulnerability was found in libxml2. 1 CVE CVE-2025-49796 EUVD-2025-18415 CWE-125 EPSS 1.6% Grype Out-of-Bounds Write 1 CVE CVE-2025-6021 EUVD-2025-18175 CWE-787 CWE-787 EPSS 1.4% Grype An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. 1 CVE CVE-2024-25062 EUVD-2024-22424 CWE-416 CWE-416 EPSS 1.3% Grype Other vulnerabilities 8 CVEs CVE-2024-56171 EUVD-2025-4769 CWE-416 EPSS 1.2% Grype CVE-2025-32415 EUVD-2025-11554 CWE-1284 CWE-125 EPSS 0.6% Grype CVE-2025-7425 EUVD-2025-20998 CWE-416 EPSS 0.4% Grype CVE-2025-32414 EUVD-2025-10440 CWE-393 CWE-252 EPSS 0.4% Grype CVE-2026-86137 EUVD-2026-71830 CWE-125 EPSS 0.2% Grype CVE-2026-86143 EUVD-2026-71822 CWE-192 EPSS 0.2% Grype
OpenSSL conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2025-15467, https://nvd.nist.gov/vuln/detail/CVE-2026-45447, https://nvd.nist.gov/vuln/detail/CVE-2026-63076 (+32 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-15467 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-45447 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-63076	3.0.18	library	📦 OpenSSL Software Foundation Source: existing	Apache-2.0	35	9.8	Critical	CRITICAL / CRITICAL	overdue by 265 days overdue by 132 days overdue by 55 days overdue by 20 days overdue by 132 days overdue by 132 days overdue by 195 days overdue by 132 days overdue by 265 days overdue by 265 days	Out-of-Bounds Write 6 CVEs CVE-2025-15467 EUVD-2025-206379 CWE-787 CWE-120 EPSS 74.8% Grype CVE-2026-63072 EUVD-2026-65482 CWE-787 EPSS 0.9% Grype CVE-2026-7383 EUVD-2026-35474 CWE-787 EPSS 0.8% Grype CVE-2025-69419 EUVD-2025-206395 CWE-787 EPSS 0.6% Grype CVE-2026-31789 EUVD-2026-19968 CWE-787 EPSS 0.2% Grype CVE-2025-68160 EUVD-2025-206397 CWE-787 EPSS 0.2% Grype Other vulnerabilities 26 CVEs CVE-2026-45447 EUVD-2026-35491 CWE-416 CWE-825 EPSS 4.0% Grype CVE-2026-63076 EUVD-2026-65487 CWE-476 EPSS 1.6% Grype CVE-2026-75806 EUVD-2026-89011 CWE-1284 EPSS 1.1% Grype CVE-2026-42766 EUVD-2026-35483 CWE-476 EPSS 1.1% Grype
pyarrow conda Scanner: osv_crosscheck; Advisory source: OSV; Match evidence: Affected release range detected by OSV; product reachability requires review. Aliases: CVE-2024-52338	14.0.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	1	9.8	Critical	CRITICAL / CRITICAL	overdue by 690 days	Other vulnerabilities 1 CVE CVE-2024-52338 OSV
torch conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-53q9-r3pm-6pq6, https://github.com/advisories/GHSA-c678-jfcj-6jmf, https://github.com/advisories/GHSA-887c-mr87-cxwp (+7 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-53q9-r3pm-6pq6 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c678-jfcj-6jmf \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-887c-mr87-cxwp	2.2.1	library	📦 Conda (Anaconda) Source: existing	BSD-3 PYPI	20	9.8	Critical	CRITICAL / CRITICAL	overdue by 549 days overdue by 588 days overdue by 551 days overdue by 568 days overdue by 588 days overdue by 567 days overdue by 567 days overdue by 567 days overdue by 567 days overdue by 720 days	Deserialization of Untrusted Data 1 CVE CVE-2025-32434 EUVD-2025-11856 CWE-502 EPSS 2.4% Grype PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument 1 CVE CVE-2025-2148 EUVD-2025-7522 CWE-119 EPSS 0.4% Grype PyTorch Improper Resource Shutdown or Release 1 CVE CVE-2025-3730 EUVD-2025-11538 CWE-404 EPSS 0.3% Grype PyTorch susceptible to local Denial of Service 1 CVE CVE-2025-2953 EUVD-2025-8684 CWE-404 EPSS 0.3% Grype PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module 1 CVE CVE-2025-2149 EUVD-2025-7523 CWE-665 EPSS 0.3% Grype PyTorch is vulnerable to memory corruption through its torch.jit.script function 1 CVE CVE-2025-3000 EUVD-2025-8759 CWE-119 EPSS 0.2% Grype PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function 1 CVE CVE-2025-2998 EUVD-2025-8748 CWE-119 EPSS 0.2% Grype PyTorch is vulnerable to memory corruption through its unpack_sequence function 1 CVE CVE-2025-2999 EUVD-2025-8755 CWE-119 EPSS 0.2% Grype PyTorch is vulnerable to memory corruption through its torch.lstm_cell function 1 CVE CVE-2025-3001 EUVD-2025-8856 CWE-119 EPSS 0.2% Grype Other vulnerabilities 11 CVEs CVE-2024-48063 OSV
python conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2023-27043, https://nvd.nist.gov/vuln/detail/CVE-2024-7592, https://nvd.nist.gov/vuln/detail/CVE-2024-6232 (+72 more); Match evidence: Installed component version is outside the affected range for this CVE (version-aware guard). \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-7592 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-6232	3.11.7	library	📦 Conda (Anaconda) Source: existing	Python-2.0	75	9.4	Critical	CRITICAL / CRITICAL	overdue by 1280 days overdue by 791 days overdue by 776 days overdue by 322 days overdue by 626 days overdue by 503 days overdue by 503 days overdue by 788 days overdue by 723 days overdue by 809 days	The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. 1 CVE CVE-2023-27043 EUVD-2023-30832 CWE-20 CWE-20 +1 EPSS 2.5% Grype Uncontrolled Resource Consumption 6 CVEs CVE-2024-7592 EUVD-2024-48488 CWE-400 CWE-1333 EPSS 2.3% Grype CVE-2025-13836 EUVD-2025-200070 CWE-400 EPSS 1.7% Grype CVE-2026-15308 EUVD-2026-42638 CWE-400 EPSS 0.6% Grype CVE-2026-15310 EUVD-2026-65519 CWE-400 EPSS 0.5% Grype CVE-2025-13837 EUVD-2025-200069 CWE-400 EPSS 0.2% Grype CVE-2025-6075 EUVD-2025-37384 CWE-400 EPSS 0.1% Grype There is a MEDIUM severity 1 CVE CVE-2024-6232 EUVD-2024-48018 CWE-1333 CWE-1333 EPSS 2.2% Grype Other vulnerabilities 37 CVEs CVE-2025-0938 EUVD-2025-1935 CWE-20 EPSS 1.6% Grype CVE-2024-4032 EUVD-2024-32597 CWE-697 EPSS 1.1% Grype
anyio conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-82r6-8w77-94w6, https://github.com/advisories/GHSA-5p39-cfhj-2xmp; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-82r6-8w77-94w6 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5p39-cfhj-2xmp	4.2.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	2	9.3	Critical	CRITICAL / n/a	overdue by 27 days overdue by 31 days	Improper Certificate Validation 1 CVE CVE-2026-63374 EUVD-2026-84522 CWE-295 CWE-297 EPSS 0.3% Grype AnyIO process-pool workers can block indefinitely on undrained stderr 1 CVE CVE-2026-64847 EUVD-2026-83193 CWE-770 EPSS 0.2% Grype
gitpython conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-2f96-g7mh-g2hx, https://github.com/advisories/GHSA-956x-8gvw-wg5v, https://github.com/advisories/GHSA-rpm5-65cw-6hj4 (+35 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-2f96-g7mh-g2hx \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-956x-8gvw-wg5v \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-rpm5-65cw-6hj4	3.1.37	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	38	9.3	Critical	CRITICAL / HIGH	overdue by 79 days overdue by 79 days overdue by 165 days overdue by 61 days overdue by 56 days overdue by 61 days overdue by 165 days overdue by 56 days overdue by 61 days overdue by 40 days	OS Command Injection 3 CVEs CVE-2026-67325 EUVD-2026-51858 CWE-78 EPSS 2.2% Grype CVE-2026-67323 EUVD-2026-51805 CWE-77 EPSS 1.3% Grype CVE-2026-42215 EUVD-2026-28411 CWE-78 EPSS 0.7% Grype GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks 1 CVE CVE-2026-76218 EUVD-2026-62459 CWE-88 EPSS 0.7% Grype Path Traversal 4 CVEs CVE-2026-78677 EUVD-2026-65223 CWE-22 EPSS 0.7% Grype CVE-2026-76222 EUVD-2026-62463 CWE-22 EPSS 0.4% Grype CVE-2026-44243 EUVD-2026-28413 CWE-22 EPSS 0.4% Grype ⚠️GHSA-59CR-6R3X-644W Grype Other vulnerabilities 15 CVEs CVE-2026-76220 EUVD-2026-62461 CWE-88 EPSS 0.6% Grype CVE-2026-76219 EUVD-2026-62460 CWE-88 EPSS 0.5% Grype
jupyter-server conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-h56g-gq9v-vc8r, https://github.com/advisories/GHSA-hrw6-wg82-cm62, https://github.com/advisories/GHSA-5789-5fc7-67v3 (+6 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-h56g-gq9v-vc8r \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-hrw6-wg82-cm62 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5789-5fc7-67v3	2.10.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	10	9.3	Critical	CRITICAL / HIGH	overdue by 1050 days overdue by 865 days overdue by 167 days overdue by 119 days overdue by 32 days overdue by 167 days overdue by 167 days overdue by 167 days overdue by 139 days overdue by 138 days	jupyter-server errors include tracebacks with path information 1 CVE CVE-2023-49080 EUVD-2023-0104 CWE-209 EPSS 0.8% Grype Exposure of Sensitive Information 1 CVE CVE-2024-35178 EUVD-2024-0079 CWE-200 EPSS 0.8% Grype Path Traversal 2 CVEs CVE-2026-35397 EUVD-2026-27470 CWE-22 CWE-22 EPSS 0.6% Grype CVE-2026-5422 OSV Cross-Site Scripting 1 CVE CVE-2026-44727 EUVD-2026-38347 CWE-79 CWE-1021 +2 EPSS 0.4% Grype Jupyter Server: 5xx request logging leaks token-bearing Referer header values 1 CVE CVE-2026-86049 EUVD-2026-82436 CWE-532 EPSS 0.4% Grype Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart 1 CVE CVE-2026-40934 EUVD-2026-27513 CWE-613 EPSS 0.3% Grype Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat` 1 CVE CVE-2026-40110 EUVD-2026-27510 CWE-777 CWE-625 EPSS 0.3% Grype Jupyter Server has an open redirection 1 CVE CVE-2025-61669 EUVD-2025-209644 CWE-601 EPSS 0.2% Grype jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used 1 CVE CVE-2026-6657 OSV
pillow conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-w889-685w-c8fh, https://github.com/advisories/GHSA-332p-7hrc-92wf, https://github.com/advisories/GHSA-44wm-f244-xhp3 (+47 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-w889-685w-c8fh \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-332p-7hrc-92wf \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-44wm-f244-xhp3	10.2.0	library	📦 Conda (Anaconda) Source: existing	HPND	50	9.2	Critical	CRITICAL / HIGH	0 days left 0 days left overdue by 930 days 0 days left 0 days left 0 days left 1 days left 0 days left 0 days left 0 days left	OS Command Injection 2 CVEs CVE-2026-112900 EUVD-2026-104661 CWE-78 CWE-88 EPSS 1.3% Grype CVE-2026-55798 EUVD-2026-41898 CWE-78 EPSS 0.2% Grype Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO 1 CVE CVE-2026-112393 EUVD-2026-104603 CWE-122 EPSS 1.0% Grype Pillow buffer overflow 1 CVE CVE-2024-28219 EUVD-2024-1085 CWE-680 EPSS 1.0% Grype Pillow: Heap buffer overflow in ImagingJpegDecode 1 CVE CVE-2026-112403 EUVD-2026-104642 CWE-122 EPSS 0.9% Grype Out-of-Bounds Write 6 CVEs CVE-2026-112398 EUVD-2026-104634 CWE-122 CWE-787 EPSS 0.7% Grype CVE-2026-112397 EUVD-2026-104640 CWE-787 EPSS 0.6% Grype CVE-2026-96778 EUVD-2026-107566 CWE-787 EPSS 0.5% Grype CVE-2026-59197 EUVD-2026-43734 CWE-190 CWE-787 EPSS 0.4% Grype CVE-2026-59205 EUVD-2026-43746 CWE-787 EPSS 0.4% Grype
libevent conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-63385, https://nvd.nist.gov/vuln/detail/CVE-2026-63382, https://nvd.nist.gov/vuln/detail/CVE-2026-63379 (+6 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-63385 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-63382 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-63379	2.1.12	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	9	9.2	Critical	CRITICAL / HIGH	overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days overdue by 60 days	HTTP Request/Response Smuggling 3 CVEs CVE-2026-63385 EUVD-2026-63563 CWE-444 EPSS 1.3% Grype CVE-2026-63382 EUVD-2026-63505 CWE-444 EPSS 0.8% Grype CVE-2026-63379 EUVD-2026-63562 CWE-444 EPSS 0.7% Grype Libevent is an event notification library. 4 CVEs CVE-2026-63384 EUVD-2026-63507 CWE-190 EPSS 0.5% Grype CVE-2026-63383 EUVD-2026-63502 CWE-125 EPSS 0.5% Grype CVE-2026-63381 EUVD-2026-63504 CWE-908 EPSS 0.2% Grype CVE-2026-63380 EUVD-2026-63506 CWE-416 CWE-476 EPSS 0.1% Grype Out-of-Bounds Write 2 CVEs CVE-2026-63387 EUVD-2026-63508 CWE-121 CWE-193 +1 EPSS 0.4% Grype CVE-2026-63388 EUVD-2026-63501 CWE-617 CWE-787 EPSS 0.1% Grype
h11 conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-vqfr-h8mv-ghfj; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-vqfr-h8mv-ghfj	0.14.0	library	📦 Nathaniel J. Smith Source: registry_cache:pypi_api	MIT PYPI	1	9.1	Critical	CRITICAL / CRITICAL	overdue by 543 days	HTTP Request/Response Smuggling 1 CVE CVE-2025-43859 EUVD-2025-11981 CWE-444 EPSS 0.6% Grype
pytorch-lightning conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-4cv3-v7pv-rfhf, https://github.com/advisories/GHSA-98fp-7v67-4v3q, https://github.com/advisories/GHSA-75m9-98v2-hjpm; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-4cv3-v7pv-rfhf \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-98fp-7v67-4v3q \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-75m9-98v2-hjpm	2.2.1	library	📦 Lightning AI et al. Source: registry_cache:pypi_api	Apache-2.0 PYPI	3	9.1	Critical	CRITICAL / CRITICAL	overdue by 578 days overdue by 578 days overdue by 160 days	Path Traversal 1 CVE CVE-2024-8019 EUVD-2025-6932 CWE-434 EPSS 1.1% Grype PyTorch Lightning denial of service 1 CVE CVE-2024-8020 EUVD-2025-6922 CWE-248 EPSS 0.6% Grype Deserialization of Untrusted Data 1 CVE CVE-2026-31221 EUVD-2026-29505 CWE-502 CWE-502 EPSS 0.4% Grype
certifi conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-6q48-6c7w-9gw2; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-6q48-6c7w-9gw2	2026.01.04	library	📦 Conda (Anaconda) Source: existing	MPL-2.0 PYPI	1	9.1	Critical	CRITICAL / n/a	Deadline unavailable	certifi bundles emSign root CAs with compromised intermediate CA keys 1 CVE ⚠️GHSA-6Q48-6C7W-9GW2 Grype
pyjwt conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-2gx3-rcp4-g85q, https://github.com/advisories/GHSA-xgmm-8j9v-c9wx, https://github.com/advisories/GHSA-42vr-xj54-vc7v (+11 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-2gx3-rcp4-g85q \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-xgmm-8j9v-c9wx \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-42vr-xj54-vc7v	2.4.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	14	9.1	Critical	CRITICAL / CRITICAL	overdue by 21 days overdue by 144 days overdue by 21 days overdue by 144 days overdue by 220 days overdue by 21 days overdue by 21 days overdue by 21 days overdue by 144 days overdue by 21 days	PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524) 1 CVE CVE-2026-101917 EUVD-2026-88478 CWE-770 EPSS 0.4% Grype Improper Authentication 1 CVE CVE-2026-48526 EUVD-2026-32917 CWE-287 CWE-347 +1 EPSS 0.4% Grype Other vulnerabilities 3 CVEs CVE-2026-101918 EUVD-2026-88479 CWE-248 EPSS 0.4% Grype CVE-2026-102268 EUVD-2026-88535 CWE-347 EPSS 0.2% Grype CVE-2025-45768 OSV PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS) 1 CVE CVE-2026-48524 EUVD-2026-32916 CWE-460 CWE-755 EPSS 0.4% Grype PyJWT accepts unknown `crit` header extensions 1 CVE CVE-2026-32597 EUVD-2026-11728 CWE-345 CWE-863 +1 EPSS 0.3% Grype PyJWT: ReDoS 1 CVE CVE-2026-102270 EUVD-2026-88537 CWE-1333 EPSS 0.2% Grype PyJWT: Non-canonical signature segments enable raw-token revocation bypass 1 CVE CVE-2026-102269 EUVD-2026-88536 CWE-180 EPSS 0.2% Grype Server-Side Request Forgery 1 CVE CVE-2026-48522 EUVD-2026-32915 CWE-441 CWE-918 EPSS 0.2% Grype
urllib3 conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-38jv-5279-wg99, https://github.com/advisories/GHSA-34jh-p97f-mpxf, https://github.com/advisories/GHSA-2xpw-w6gg-jr37 (+5 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-38jv-5279-wg99 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-34jh-p97f-mpxf \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-2xpw-w6gg-jr37	2.0.7	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	8	8.9	High	HIGH / MEDIUM	overdue by 285 days overdue by 854 days overdue by 318 days overdue by 318 days overdue by 488 days overdue by 20 days overdue by 159 days overdue by 20 days	Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) 1 CVE CVE-2026-21441 EUVD-2026-1188 CWE-409 CWE-409 EPSS 2.9% Grype urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects 1 CVE CVE-2024-37891 EUVD-2024-1894 CWE-669 EPSS 1.1% Grype urllib3 streaming API improperly handles highly compressed data 1 CVE CVE-2025-66471 EUVD-2025-201419 CWE-409 EPSS 0.7% Grype urllib3 allows an unbounded number of links in the decompression chain 1 CVE CVE-2025-66418 EUVD-2025-201421 CWE-770 EPSS 0.7% Grype urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation 1 CVE CVE-2025-50181 EUVD-2025-18908 CWE-601 EPSS 0.5% Grype urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory 1 CVE CVE-2026-97689 EUVD-2026-89017 CWE-770 EPSS 0.3% Grype Exposure of Sensitive Information 1 CVE CVE-2026-44431 EUVD-2026-30046 CWE-200 EPSS 0.3% Grype Improper Certificate Validation 1 CVE CVE-2026-97687 EUVD-2026-89000 CWE-295 CWE-440 EPSS 0.2% Grype
transformers conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-qxrp-vhvm-j765, https://github.com/advisories/GHSA-wrfc-pvp9-mr9g, https://github.com/advisories/GHSA-hxxf-235m-72v3 (+16 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-qxrp-vhvm-j765 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-wrfc-pvp9-mr9g \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-hxxf-235m-72v3	4.39.3	library	📦 The Hugging Face team (past and future) with the help of all our contributors (https://github.com/huggingface/transformers/graphs/contributors) Source: registry_cache:pypi_api	Apache-2.0 PYPI	26	8.8	High	HIGH / HIGH	overdue by 696 days overdue by 696 days overdue by 696 days overdue by 578 days overdue by 148 days overdue by 518 days overdue by 138 days overdue by 402 days overdue by 391 days overdue by 469 days	Deserialization of Untrusted Data 5 CVEs CVE-2024-11392 EUVD-2024-33791 CWE-502 EPSS 7.7% Grype CVE-2024-11393 EUVD-2024-34102 CWE-502 EPSS 3.3% Grype CVE-2024-11394 EUVD-2024-34103 CWE-502 EPSS 2.7% Grype CVE-2026-4372 EUVD-2026-31598 CWE-1066 CWE-502 EPSS 0.7% Grype CVE-2026-1839 EUVD-2026-19573 CWE-502 EPSS 0.4% Grype Transformers Regular Expression Denial of Service (ReDoS) 2 CVEs CVE-2024-12720 EUVD-2025-7016 CWE-1333 EPSS 0.7% Grype CVE-2025-1194 EUVD-2025-15128 CWE-1333 EPSS 0.5% Grype Hugging Face Transformers Regular Expression Denial of Service 1 CVE CVE-2025-2099 EUVD-2025-15691 CWE-1333 EPSS 0.6% Grype huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path 1 CVE CVE-2026-5241 EUVD-2026-34084 CWE-829 CWE-829 EPSS 0.6% Grype Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer 1 CVE CVE-2025-6638 EUVD-2025-29032 CWE-1333 EPSS 0.6% Grype
dav1d conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-1580; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-1580	1.2.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	1	8.8	High	HIGH / HIGH	overdue by 973 days	An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. 1 CVE CVE-2024-1580 EUVD-2024-17324 CWE-190 CWE-190 EPSS 1.8% Grype
diffusers conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-98h9-4798-4q5v, https://github.com/advisories/GHSA-7wx4-6vff-v64p, OSV; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-98h9-4798-4q5v \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7wx4-6vff-v64p \| Affected release range detected by OSV; product reachability requires review. Aliases: CVE-2026-44827, GHSA-j7w6-vpvq-j3gm	0.27.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	3	8.8	High	HIGH / HIGH	overdue by 158 days overdue by 96 days overdue by 158 days	Code Injection 1 CVE CVE-2026-44513 EUVD-2026-30334 CWE-94 CWE-358 EPSS 1.1% Grype Diffusers: TOCTOU Trust Remote Code Bypass 1 CVE CVE-2026-45804 EUVD-2026-44711 CWE-367 EPSS 0.4% Grype Other vulnerabilities 1 CVE CVE-2026-44827 OSV
fsspec conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-27vj-qcqg-25rc; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-27vj-qcqg-25rc	2023.10.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	8.8	High	HIGH / HIGH	overdue by 17 days	Code Injection 1 CVE CVE-2026-104851 EUVD-2026-91720 CWE-94 CWE-1336 EPSS 0.5% Grype
gstreamer conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2019-9928, https://nvd.nist.gov/vuln/detail/CVE-2021-3522, https://nvd.nist.gov/vuln/detail/CVE-2021-3498 (+35 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2019-9928 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-3522 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-3498	1.14.1	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later	38	8.8	High	HIGH / HIGH	overdue by 2735 days overdue by 1965 days overdue by 2009 days overdue by 900 days overdue by 217 days overdue by 2009 days overdue by 516 days overdue by 217 days overdue by 217 days overdue by 217 days	Out-of-Bounds Write 11 CVEs CVE-2019-9928 EUVD-2019-19283 CWE-787 EPSS 5.9% Grype CVE-2021-3498 EUVD-2021-26819 CWE-119 CWE-787 EPSS 1.8% Grype CVE-2023-50186 EUVD-2023-55008 CWE-121 CWE-787 EPSS 1.5% Grype CVE-2025-3887 EUVD-2025-16092 CWE-121 CWE-787 EPSS 0.9% Grype CVE-2026-3083 EUVD-2026-12125 CWE-129 CWE-787 EPSS 0.8% Grype CVE-2026-2923 EUVD-2026-12119 CWE-787 CWE-787 EPSS 0.8% Grype CVE-2022-1920 EUVD-2022-25192 CWE-122 CWE-190 +1 EPSS 0.5% Grype CVE-2022-2122 EUVD-2022-34408 CWE-122 CWE-190 +1 EPSS 0.5% Grype CVE-2026-2922 EUVD-2026-12117 CWE-787 CWE-787 EPSS 0.4% Grype CVE-2026-3086 EUVD-2026-12131 CWE-787 CWE-787 EPSS 0.4% Grype
intake conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-37g4-qqqv-7m99; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-37g4-qqqv-7m99	0.6.8	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	8.8	High	HIGH / HIGH	overdue by 209 days	OS Command Injection 1 CVE CVE-2026-33310 EUVD-2026-20087 CWE-78 CWE-94 EPSS 0.4% Grype
libjpeg-turbo conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2020-17541, https://nvd.nist.gov/vuln/detail/CVE-2021-46822; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2020-17541 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-46822	2.0.0	library	📦 libjpeg-turbo Source: existing	IJG	2	8.8	High	HIGH / HIGH	overdue by 1966 days overdue by 1584 days	Out-of-Bounds Write 2 CVEs CVE-2020-17541 EUVD-2020-9472 CWE-787 EPSS 2.7% Grype CVE-2021-46822 EUVD-2021-33478 CWE-787 EPSS 1.1% Grype
nbconvert conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-pjvx-prjx-h659, https://github.com/advisories/GHSA-7jqv-fw35-gmx9, https://github.com/advisories/GHSA-4c99-qj7h-p3vg (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-pjvx-prjx-h659 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7jqv-fw35-gmx9 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-4c99-qj7h-p3vg	7.10.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	4	8.8	High	HIGH / MEDIUM	1 days left overdue by 182 days overdue by 182 days overdue by 306 days	Path Traversal 3 CVEs CVE-2026-114140 EUVD-2026-107551 CWE-22 EPSS 0.5% Grype CVE-2026-39378 EUVD-2026-24025 CWE-22 CWE-73 EPSS 0.3% Grype CVE-2026-39377 EUVD-2026-24023 CWE-22 CWE-73 EPSS 0.3% Grype nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows 1 CVE CVE-2025-53000 EUVD-2025-203957 CWE-427 EPSS 0.3% Grype
notebook conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-mqcg-5x36-vfcg, https://github.com/advisories/GHSA-rch3-82jr-f9w9, https://github.com/advisories/GHSA-9q39-rmj3-p4r2; Match evidence: Installed component version is outside the affected range for this CVE (version-aware guard). \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-rch3-82jr-f9w9 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-9q39-rmj3-p4r2	7.0.8	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	3	8.8	High	HIGH / n/a	overdue by 159 days overdue by 166 days overdue by 782 days	Cross-Site Scripting 3 CVEs CVE-2026-42557 EUVD-2026-30000 CWE-79 CWE-79 EPSS 0.5% Grype CVE-2026-40171 EUVD-2026-28153 CWE-79 EPSS 0.5% Grype CVE-2024-43805 EUVD-2024-2550 CWE-79 CWE-79 EPSS 0.4% Grype
python-multipart conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-wp53-j4wj-2cfg, https://github.com/advisories/GHSA-pp6c-gr5w-3c5g, https://github.com/advisories/GHSA-59g5-xgcq-4qw3 (+5 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-wp53-j4wj-2cfg \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-pp6c-gr5w-3c5g \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-59g5-xgcq-4qw3	0.0.9	library	📦 Andrew Dunham Source: registry_cache:pypi_api	Apache-2.0 PYPI	8	8.7	High	HIGH / HIGH	overdue by 266 days overdue by 159 days overdue by 686 days overdue by 119 days overdue by 185 days overdue by 119 days overdue by 119 days overdue by 119 days	Path Traversal 1 CVE CVE-2026-24486 EUVD-2026-4754 CWE-22 CWE-22 EPSS 2.2% Grype python-multipart has Denial of Service via unbounded multipart part headers 1 CVE CVE-2026-42561 EUVD-2026-30159 CWE-770 CWE-606 EPSS 0.7% Grype Denial of service (DoS) via deformation `multipart/form-data` boundary 1 CVE CVE-2024-53981 EUVD-2024-3431 CWE-770 EPSS 0.6% Grype Uncontrolled Resource Consumption 2 CVEs CVE-2026-53539 EUVD-2026-38322 CWE-400 CWE-407 EPSS 0.5% Grype CVE-2026-40347 EUVD-2026-23615 CWE-400 CWE-834 EPSS 0.4% Grype python-multipart: Negative Content-Length in parse_form buffers the entire body in memory 1 CVE CVE-2026-53540 EUVD-2026-38325 CWE-1284 EPSS 0.3% Grype python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parameters 1 CVE CVE-2026-53537 EUVD-2026-38324 CWE-20 CWE-436 EPSS 0.3% Grype HTTP Request/Response Smuggling 1 CVE CVE-2026-53538 EUVD-2026-38323 CWE-436 CWE-444 EPSS 0.3% Grype
aiohttp conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-5m98-qgg9-wh84, https://github.com/advisories/GHSA-7gpw-8wmc-pm8g, https://github.com/advisories/GHSA-6mq8-rvhq-8wgg (+41 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5m98-qgg9-wh84 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7gpw-8wmc-pm8g \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-6mq8-rvhq-8wgg	3.9.3	library	📦 Conda (Anaconda) Source: existing	Apache 2 PYPI	44	8.7	High	HIGH / HIGH	overdue by 900 days overdue by 914 days overdue by 287 days overdue by 119 days overdue by 700 days overdue by 119 days overdue by 119 days overdue by 77 days overdue by 81 days overdue by 119 days	aiohttp vulnerable to Denial of Service when trying to parse malformed POST requests 1 CVE CVE-2024-30251 EUVD-2024-1442 CWE-835 EPSS 1.1% Grype Cross-Site Scripting 1 CVE CVE-2024-27306 EUVD-2024-1143 CWE-79 CWE-80 EPSS 0.7% Grype AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb 1 CVE CVE-2025-69223 EUVD-2025-206229 CWE-409 CWE-770 +1 EPSS 0.6% Grype aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines 1 CVE CVE-2026-54277 EUVD-2026-38314 CWE-770 EPSS 0.6% Grype HTTP Request/Response Smuggling 7 CVEs CVE-2024-52304 EUVD-2024-3218 CWE-444 EPSS 0.6% Grype CVE-2026-69243 EUVD-2026-52436 CWE-444 EPSS 0.4% Grype CVE-2026-111750 EUVD-2026-104486 CWE-444 EPSS 0.4% Grype CVE-2025-53643 EUVD-2025-21384 CWE-444 EPSS 0.4% Grype CVE-2026-34525 EUVD-2026-18048 CWE-20 CWE-444 EPSS 0.3% Grype CVE-2025-69225 EUVD-2026-1047 CWE-444 EPSS 0.3% Grype
cryptography conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-79v4-65xg-pq4g, https://github.com/advisories/GHSA-6vqw-3v5j-54x4, https://github.com/advisories/GHSA-r6ph-v2qm-q3c2 (+5 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-79v4-65xg-pq4g \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-6vqw-3v5j-54x4 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-r6ph-v2qm-q3c2	42.0.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 OR BSD-3-Clause PYPI	8	8.7	High	HIGH / HIGH	overdue by 615 days overdue by 971 days overdue by 251 days overdue by 77 days overdue by 203 days Deadline unavailable overdue by 77 days Deadline unavailable	Vulnerable OpenSSL included in cryptography wheels 2 CVEs CVE-2024-12797 EUVD-2024-51115 CWE-392 EPSS 2.5% Grype ⚠️GHSA-537C-GMF6-5CCF Grype Other vulnerabilities 1 CVE CVE-2024-26130 EUVD-2024-0031 CWE-476 CWE-476 EPSS 0.8% Grype cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves 1 CVE CVE-2026-26007 EUVD-2026-6238 CWE-345 CWE-354 EPSS 0.4% Grype Uncontrolled Resource Consumption 1 CVE CVE-2026-69249 EUVD-2026-52450 CWE-400 EPSS 0.3% Grype Improper Certificate Validation 1 CVE CVE-2026-34073 EUVD-2026-17284 CWE-295 EPSS 0.2% Grype python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees 1 CVE CVE-2026-69248 OSV pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels 1 CVE ⚠️GHSA-H4GH-QQ45-VH27 Grype
libprotobuf conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-7254, https://nvd.nist.gov/vuln/detail/CVE-2026-0994; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-7254 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-0994	3.20.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	2	8.7	High	HIGH / n/a	overdue by 761 days overdue by 269 days	Uncontrolled Resource Consumption 1 CVE CVE-2024-7254 EUVD-2024-2741 CWE-400 CWE-674 +1 EPSS 2.8% Grype A denial-of-service (DoS) 1 CVE CVE-2026-0994 EUVD-2026-4322 CWE-674 CWE-674 EPSS 0.7% Grype
libssh2 conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2023-48795, https://nvd.nist.gov/vuln/detail/CVE-2020-22218, https://nvd.nist.gov/vuln/detail/CVE-2026-55199 (+8 more); Match evidence: Installed component version is outside the affected range for this CVE (version-aware guard). \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2020-22218 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-55199	1.10.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	11	8.7	High	HIGH / HIGH	overdue by 1036 days overdue by 1154 days overdue by 124 days overdue by 123 days overdue by 87 days overdue by 87 days overdue by 171 days overdue by 87 days overdue by 114 days overdue by 87 days	Other vulnerabilities 3 CVEs CVE-2023-48795 EUVD-2023-3093 CWE-354 CWE-354 EPSS 93.5% Grype CVE-2026-58050 EUVD-2026-39970 CWE-190 EPSS 0.4% Grype CVE-2026-58051 EUVD-2026-39971 CWE-908 EPSS 0.3% Grype Out-of-Bounds Write 1 CVE CVE-2020-22218 EUVD-2020-14983 CWE-787 EPSS 1.2% Grype libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service 1 CVE CVE-2026-55199 EUVD-2026-37782 CWE-835 EPSS 0.9% Grype libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read 1 CVE CVE-2025-15661 EUVD-2025-210285 CWE-125 EPSS 0.6% Grype libssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow 1 CVE CVE-2026-66033 EUVD-2026-48720 CWE-125 CWE-191 EPSS 0.6% Grype libssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow 1 CVE CVE-2026-66035 EUVD-2026-48722 CWE-122 EPSS 0.5% Grype A security 1 CVE CVE-2026-7598 EUVD-2026-26722 CWE-189 CWE-190 +1 EPSS 0.5% Grype libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free 1 CVE CVE-2026-66032 EUVD-2026-48719 CWE-415 EPSS 0.4% Grype
mistune conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-ffq3-xpv3-j92q, https://github.com/advisories/GHSA-4j32-57v6-6g45, https://github.com/advisories/GHSA-c8j7-8cv4-2xmq (+12 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-ffq3-xpv3-j92q \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-4j32-57v6-6g45 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c8j7-8cv4-2xmq	2.0.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	16	8.7	High	HIGH / HIGH	overdue by 103 days overdue by 103 days overdue by 103 days overdue by 103 days overdue by 117 days overdue by 103 days 2 days left overdue by 103 days overdue by 103 days overdue by 103 days	Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions 1 CVE CVE-2026-59928 EUVD-2026-42338 CWE-407 CWE-1333 EPSS 0.7% Grype Mistune inline_parser: quadratic-time parsing on long runs of `x` and `*x*` emphasis pairs 1 CVE CVE-2026-59925 EUVD-2026-42335 CWE-407 CWE-1333 +1 EPSS 0.6% Grype Other vulnerabilities 4 CVEs CVE-2026-59922 EUVD-2026-42329 CWE-407 CWE-1333 +1 EPSS 0.6% Grype CVE-2026-59930 EUVD-2026-42330 CWE-345 CWE-1284 EPSS 0.2% Grype CVE-2026-44898 OSV CVE-2026-44899 OSV Mistune directives/include: mutual `.. 1 CVE CVE-2026-59927 EUVD-2026-42339 CWE-674 CWE-755 +1 EPSS 0.5% Grype Uncontrolled Resource Consumption 1 CVE CVE-2026-49851 EUVD-2026-39007 CWE-400 CWE-407 +2 EPSS 0.5% Grype Path Traversal 2 CVEs CVE-2026-59924 EUVD-2026-42337 CWE-22 EPSS 0.5% Grype CVE-2026-115355 EUVD-2026-108425 CWE-22 EPSS 0.5% Grype
tornado conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-8w49-h785-mj3c, https://github.com/advisories/GHSA-7cx3-6m66-7c5m, https://github.com/advisories/GHSA-mgf9-4vpg-hj56 (+19 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-8w49-h785-mj3c \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7cx3-6m66-7c5m \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-mgf9-4vpg-hj56	6.3.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	22	8.7	High	HIGH / HIGH	overdue by 696 days overdue by 522 days overdue by 97 days overdue by 312 days overdue by 312 days 6 days left overdue by 97 days overdue by 97 days overdue by 222 days 6 days left	Uncontrolled Resource Consumption 6 CVEs CVE-2024-52804 EUVD-2024-3349 CWE-400 CWE-770 EPSS 1.0% Grype CVE-2025-67725 EUVD-2025-203031 CWE-400 EPSS 0.6% Grype CVE-2025-67726 EUVD-2025-203029 CWE-400 CWE-834 EPSS 0.5% Grype CVE-2026-31958 EUVD-2026-11323 CWE-400 EPSS 0.4% Grype CVE-2026-115927 EUVD-2026-110077 CWE-400 CWE-770 EPSS 0.4% Grype CVE-2026-82397 EUVD-2026-68892 CWE-400 CWE-1284 EPSS 0.3% Grype Tornado vulnerable to excessive logging caused by malformed multipart form data 1 CVE CVE-2025-47287 EUVD-2025-15444 CWE-770 EPSS 0.7% Grype tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) 1 CVE CVE-2026-49855 EUVD-2026-44505 CWE-409 EPSS 0.6% Grype Tornado: Open redirect in RedirectHandler via protocol-relative URLs 1 CVE CVE-2026-116578 EUVD-2026-110319 CWE-601 EPSS 0.5% Grype Exposure of Sensitive Information 1 CVE CVE-2026-49853 EUVD-2026-44503 CWE-200 EPSS 0.4% Grype
twisted conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-cf56-g6w6-pqq2, https://github.com/advisories/GHSA-c8m8-j448-xjx7, https://github.com/advisories/GHSA-cwm5-jh59-mwxr (+8 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-cf56-g6w6-pqq2 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c8m8-j448-xjx7 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-cwm5-jh59-mwxr	23.10.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	11	8.7	High	HIGH / HIGH	overdue by 812 days overdue by 812 days 3 days left 3 days left 3 days left 3 days left overdue by 159 days overdue by 13 days 3 days left 3 days left	Cross-Site Scripting 1 CVE CVE-2024-41810 EUVD-2024-0167 CWE-79 CWE-80 +1 EPSS 1.2% Grype HTTP Request/Response Smuggling 2 CVEs CVE-2024-41671 EUVD-2024-2318 CWE-444 EPSS 0.9% Grype CVE-2026-115877 EUVD-2026-109153 CWE-444 EPSS 0.3% Grype Uncontrolled Resource Consumption 5 CVEs CVE-2026-115778 EUVD-2026-109151 CWE-400 CWE-770 EPSS 0.5% Grype CVE-2026-115774 EUVD-2026-109148 CWE-400 CWE-835 EPSS 0.5% Grype CVE-2026-115776 EUVD-2026-109150 CWE-400 CWE-770 EPSS 0.5% Grype CVE-2026-115775 EUVD-2026-109149 CWE-400 CWE-770 EPSS 0.4% Grype CVE-2026-42304 EUVD-2026-30158 CWE-400 CWE-407 EPSS 0.4% Grype Twisted: IMAP wildcardToRegexp() ReDoS 1 CVE CVE-2026-106454 EUVD-2026-93873 CWE-1333 EPSS 0.4% Grype Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation 1 CVE CVE-2026-83813 EUVD-2026-109152 CWE-346 EPSS 0.1% Grype
ujson conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-wgvc-ghv9-3pmm, https://github.com/advisories/GHSA-c8rr-9gxc-jprv, https://github.com/advisories/GHSA-c38f-wx89-p2xg (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-wgvc-ghv9-3pmm \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c8rr-9gxc-jprv \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c38f-wx89-p2xg	5.4.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	4	8.7	High	HIGH / HIGH	overdue by 214 days overdue by 214 days overdue by 145 days overdue by 119 days	UltraJSON has a Memory Leak parsing large integers allows DoS 1 CVE CVE-2026-32874 EUVD-2026-13443 CWE-401 CWE-772 EPSS 0.5% Grype Out-of-Bounds Write 1 CVE CVE-2026-32875 EUVD-2026-13444 CWE-190 CWE-787 +3 EPSS 0.5% Grype UltraJSON has a Memory Leak in ujson.dump() on Write Failure 1 CVE CVE-2026-44660 EUVD-2026-32663 CWE-401 EPSS 0.4% Grype UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps() 1 CVE CVE-2026-54911 EUVD-2026-38362 CWE-20 EPSS 0.4% Grype
zope conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-j5cc-3h6r-jqh4, https://github.com/advisories/GHSA-5pr9-v234-jw36, https://github.com/advisories/GHSA-rpcg-f9q6-2mq6 (+4 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-j5cc-3h6r-jqh4 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5pr9-v234-jw36 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-rpcg-f9q6-2mq6	1.0	library	📦 Conda (Anaconda) Source: existing	Unknown	7	8.7	High	HIGH / MEDIUM	Deadline unavailable overdue by 1977 days overdue by 1959 days overdue by 1124 days overdue by 1139 days Deadline unavailable overdue by 714 days	Zope DocumentTemplate package allows unauthenticated write 1 CVE CVE-2000-0483 EUVD-2022-4282 NVD-CWE-Other EPSS 3.0% Grype Path Traversal 2 CVEs CVE-2021-32633 EUVD-2021-0471 CWE-22 CWE-22 EPSS 1.9% Grype CVE-2021-32674 EUVD-2021-34765 CWE-22 CWE-22 EPSS 1.6% Grype Cross-Site Scripting 1 CVE CVE-2023-42458 EUVD-2023-2609 CWE-79 CWE-80 EPSS 0.7% Grype Exposure of Sensitive Information 1 CVE CVE-2023-41050 EUVD-2023-2467 CWE-200 EPSS 0.6% Grype Zope does not properly restrict access to the getRoles method 1 CVE CVE-2000-0725 EUVD-2022-1688 NVD-CWE-Other EPSS 0.5% Grype Access control vulnerable to user data deletion by anonynmous users 1 CVE CVE-2024-51734 EUVD-2024-3250 CWE-284 EPSS 0.4% Grype
openh264 conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2025-27091; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-27091	2.1.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	1	8.6	High	HIGH / n/a	overdue by 606 days	Out-of-Bounds Write 1 CVE CVE-2025-27091 EUVD-2025-5088 CWE-122 CWE-787 EPSS 0.7% Grype
sqlite conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2025-6965, https://nvd.nist.gov/vuln/detail/CVE-2023-7104, https://nvd.nist.gov/vuln/detail/CVE-2025-70873 (+2 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-6965 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-7104 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2025-70873	3.41.2	library	📦 Conda (Anaconda) Source: existing	blessing	5	8.5	High	HIGH / HIGH	overdue by 461 days overdue by 1025 days overdue by 221 days overdue by 132 days overdue by 132 days	There exists a 1 CVE CVE-2025-6965 EUVD-2025-21441 CWE-197 EPSS 73.5% Grype A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. 1 CVE CVE-2023-7104 EUVD-2023-59288 CWE-122 CWE-119 EPSS 1.5% Grype Exposure of Sensitive Information 1 CVE CVE-2025-70873 EUVD-2025-208623 CWE-244 EPSS 0.5% Grype SQLite before 3.53.2 contains an out-of-bounds read 1 CVE CVE-2026-11822 EUVD-2026-35794 CWE-125 EPSS 0.2% Grype SQLite before 3.53.2 contains a heap-based buffer overflow 1 CVE CVE-2026-11824 EUVD-2026-35801 CWE-122 EPSS 0.2% Grype
libpng conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-25646, https://nvd.nist.gov/vuln/detail/CVE-2026-33416, https://nvd.nist.gov/vuln/detail/CVE-2026-33636 (+8 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-25646 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-33416 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-33636	1.6.39	library	📦 PNG Development Group Source: existing	Libpng	11	8.3	High	HIGH / HIGH	overdue by 251 days overdue by 207 days overdue by 207 days overdue by 329 days overdue by 320 days overdue by 329 days overdue by 280 days overdue by 329 days overdue by 193 days overdue by 329 days	Other vulnerabilities 9 CVEs CVE-2026-25646 EUVD-2026-7050 CWE-122 CWE-126 +1 EPSS 1.1% Grype CVE-2026-33416 EUVD-2026-16258 CWE-416 EPSS 1.1% Grype CVE-2025-64720 EUVD-2025-199237 CWE-125 EPSS 0.4% Grype CVE-2025-66293 EUVD-2025-201132 CWE-125 EPSS 0.4% Grype CVE-2026-22695 EUVD-2026-2420 CWE-125 EPSS 0.2% Grype CVE-2025-64505 EUVD-2025-199239 CWE-125 EPSS 0.2% Grype CVE-2026-34757 EUVD-2026-20897 CWE-416 EPSS 0.2% Grype CVE-2025-64506 EUVD-2025-199238 CWE-125 EPSS 0.1% Grype CVE-2026-22801 EUVD-2026-2416 CWE-125 CWE-190 +1 EPSS 0.1% Grype Out-of-Bounds Write 2 CVEs CVE-2026-33636 EUVD-2026-16269 CWE-125 CWE-787 EPSS 0.8% Grype
libtiff conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2023-52356, https://nvd.nist.gov/vuln/detail/CVE-2023-52355, https://nvd.nist.gov/vuln/detail/CVE-2023-6277 (+13 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-52356 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-52355 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-6277	4.5.1	library	📦 libtiff contributors Source: existing	libtiff	16	7.8	High	HIGH / HIGH	overdue by 998 days overdue by 998 days overdue by 1060 days overdue by 798 days overdue by 1110 days overdue by 1110 days overdue by 209 days overdue by 1036 days overdue by 451 days overdue by 1082 days	Out-of-Bounds Write 4 CVEs CVE-2023-52356 EUVD-2023-57012 CWE-122 CWE-787 EPSS 2.5% Grype CVE-2023-52355 EUVD-2023-57011 CWE-787 CWE-787 EPSS 1.8% Grype CVE-2023-6228 EUVD-2023-58475 CWE-787 CWE-787 EPSS 0.4% Grype CVE-2023-3164 EUVD-2023-43847 CWE-120 CWE-787 EPSS 0.3% Grype Uncontrolled Resource Consumption 1 CVE CVE-2023-6277 EUVD-2023-58521 CWE-400 CWE-400 EPSS 1.8% Grype A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. 1 CVE CVE-2024-7006 EUVD-2024-48424 CWE-476 CWE-476 EPSS 1.5% Grype LibTIFF is vulnerable to an integer overflow. 1 CVE CVE-2023-40745 EUVD-2023-45298 CWE-190 CWE-190 EPSS 1.4% Grype A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. 1 CVE CVE-2023-41175 EUVD-2023-45692 CWE-190 CWE-190 EPSS 1.3% Grype A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow 1 CVE CVE-2026-4775 EUVD-2026-14901 CWE-190 CWE-190 EPSS 0.6% Grype A vulnerability was found in LibTIFF up to 4.7.0. 2 CVEs CVE-2025-8177 EUVD-2025-22770 CWE-119 CWE-120 EPSS 0.3% Grype
openjpeg conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2021-29338, https://nvd.nist.gov/vuln/detail/CVE-2021-3575, https://nvd.nist.gov/vuln/detail/CVE-2022-1122 (+3 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-29338 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2021-3575 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2022-1122	2.4.0	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	6	7.8	High	HIGH / HIGH	overdue by 2014 days overdue by 1690 days overdue by 1665 days overdue by 829 days overdue by 829 days overdue by 832 days	Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash the application, causing a Denial of Service (DoS). 1 CVE CVE-2021-29338 EUVD-2021-15974 CWE-190 EPSS 1.6% Grype Out-of-Bounds Write 1 CVE CVE-2021-3575 EUVD-2021-26884 CWE-787 CWE-787 EPSS 1.5% Grype Other vulnerabilities 1 CVE CVE-2022-1122 EUVD-2022-24465 CWE-665 CWE-665 +1 EPSS 1.1% Grype Uncontrolled Resource Consumption 3 CVEs CVE-2023-39329 EUVD-2023-43060 CWE-400 EPSS 0.6% Grype CVE-2023-39327 EUVD-2023-43058 CWE-400 EPSS 0.6% Grype CVE-2023-39328 EUVD-2023-43059 CWE-400 EPSS 0.2% Grype
pcre2 conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-89157, https://nvd.nist.gov/vuln/detail/CVE-2026-89156, https://nvd.nist.gov/vuln/detail/CVE-2026-89160 (+2 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-89157 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-89156 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-89160	10.42	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	5	7.8	High	HIGH / HIGH	overdue by 39 days overdue by 39 days overdue by 39 days overdue by 39 days overdue by 39 days	Out-of-Bounds Write 2 CVEs CVE-2026-89157 EUVD-2026-75943 CWE-190 EPSS 0.3% Grype CVE-2026-89158 EUVD-2026-75944 CWE-190 EPSS 0.2% Grype Other vulnerabilities 2 CVEs CVE-2026-89156 EUVD-2026-75942 CWE-125 EPSS 0.3% Grype CVE-2026-89160 EUVD-2026-75945 CWE-125 EPSS 0.3% Grype In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. 1 CVE CVE-2026-89161 EUVD-2026-75946 CWE-590 EPSS 0.1% Grype
unixodbc conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2024-1013; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-1013	2.3.11	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-only	1	7.8	High	HIGH / HIGH	overdue by 945 days	Other vulnerabilities 1 CVE CVE-2024-1013 EUVD-2024-16790 CWE-823 NVD-CWE-Other EPSS 0.3% Grype
fastapi conda Scanner: osv_crosscheck; Advisory source: OSV; Match evidence: Affected release range detected by OSV; product reachability requires review. Aliases: CVE-2024-24762, GHSA-2jv5-9r88-3w3p, GHSA-qf9m-vfgh-m389	0.88.0	library	📦 Sebastián Ramírez Source: registry_cache:pypi_api	MIT PYPI	1	7.5	High	HIGH / HIGH	overdue by 987 days	Other vulnerabilities 1 CVE CVE-2024-24762 OSV
c-ares conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-69184, https://nvd.nist.gov/vuln/detail/CVE-2026-69186, https://nvd.nist.gov/vuln/detail/CVE-2024-25629; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-69184 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-69186 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2024-25629	1.19.1	library	📦 Conda (Anaconda) Source: existing	MIT	3	7.5	High	HIGH / HIGH	overdue by 31 days overdue by 31 days overdue by 969 days	c-ares is an asynchronous resolver library. 1 CVE CVE-2026-69184 EUVD-2026-83213 CWE-407 EPSS 0.5% Grype Uncontrolled Resource Consumption 1 CVE CVE-2026-69186 EUVD-2026-83212 CWE-400 EPSS 0.5% Grype c-ares is a C library for asynchronous DNS requests. 1 CVE CVE-2024-25629 EUVD-2024-22949 CWE-127 CWE-125 EPSS 0.4% Grype
lxml conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-vfmq-68hx-4jfw; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-vfmq-68hx-4jfw	4.9.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	7.5	High	HIGH / HIGH	overdue by 178 days	XML External Entity Reference 1 CVE CVE-2026-41066 EUVD-2026-25572 CWE-611 EPSS 0.3% Grype
pyasn1 conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-jr27-m4p2-rc6r, https://github.com/advisories/GHSA-hm4w-wwcw-mr6r, https://github.com/advisories/GHSA-8ppf-4f7h-5ppj (+5 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-jr27-m4p2-rc6r \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-hm4w-wwcw-mr6r \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-8ppf-4f7h-5ppj	0.4.8	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	8	7.5	High	HIGH / HIGH	overdue by 216 days overdue by 97 days overdue by 97 days overdue by 97 days Deadline unavailable Deadline unavailable Deadline unavailable Deadline unavailable	Denial of Service in pyasn1 via Unbounded Recursion 1 CVE CVE-2026-30922 EUVD-2026-12747 CWE-674 CWE-835 EPSS 0.8% Grype Uncontrolled Resource Consumption 3 CVEs CVE-2026-59886 EUVD-2026-43738 CWE-400 CWE-770 EPSS 0.6% Grype CVE-2026-59885 EUVD-2026-43955 CWE-400 CWE-407 EPSS 0.6% Grype CVE-2026-59884 EUVD-2026-43956 CWE-400 EPSS 0.6% Grype pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding 1 CVE CVE-2026-119195 EUVD-2026-113351 CWE-407 EPSS 0.5% Grype pyasn1 has quadratic-complexity denial of service in binary REAL decoding 1 CVE CVE-2026-119197 EUVD-2026-113353 CWE-407 EPSS 0.4% Grype pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding 1 CVE CVE-2026-119196 EUVD-2026-113352 CWE-407 EPSS 0.4% Grype pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding 1 CVE CVE-2026-119194 EUVD-2026-113350 CWE-407 EPSS 0.4% Grype
scrapy conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-h7wm-ph43-c39p, https://github.com/advisories/GHSA-7j7m-v7m3-jqm7, https://github.com/advisories/GHSA-4qqq-9vqf-3h3f (+7 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-h7wm-ph43-c39p \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7j7m-v7m3-jqm7 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-4qqq-9vqf-3h3f	2.8.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	10	7.5	High	HIGH / HIGH	overdue by 3331 days overdue by 917 days overdue by 883 days overdue by 917 days overdue by 965 days overdue by 354 days overdue by 14 days overdue by 48 days Deadline unavailable Deadline unavailable	Uncontrolled Resource Consumption 2 CVEs CVE-2017-14158 EUVD-2017-0128 CWE-400 EPSS 2.6% Grype CVE-2025-6176 EUVD-2025-37237 CWE-400 EPSS 0.5% Grype Scrapy decompression bomb 1 CVE CVE-2024-3572 EUVD-2024-0557 CWE-409 EPSS 0.8% Grype Exposure of Sensitive Information 2 CVEs CVE-2024-1968 EUVD-2024-1419 CWE-200 EPSS 0.7% Grype CVE-2024-3574 EUVD-2024-0622 CWE-200 EPSS 0.6% Grype Scrapy vulnerable to ReDoS via XMLFeedSpider 1 CVE CVE-2024-1892 EUVD-2024-0162 CWE-1333 EPSS 0.6% Grype Scrapy: Arbitrary Module Import via Referrer-Policy Header in RefererMiddleware 1 CVE CVE-2026-105782 EUVD-2026-92869 CWE-470 EPSS 0.4% Grype Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default 1 CVE CVE-2026-84366 EUVD-2026-69647 CWE-319 EPSS 0.3% Grype Scrapy allows redirect following in protocols other than HTTP 1 CVE ⚠️GHSA-23J4-MW76-5V7H Grype Scrapy's redirects ignoring scheme-specific proxy settings 1 CVE ⚠️GHSA-JM3V-QXMH-HXWV Grype
soupsieve conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-2wc2-fm75-p42x, https://github.com/advisories/GHSA-836r-79rf-4m37, https://github.com/advisories/GHSA-gjv8-xp57-g29c (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-2wc2-fm75-p42x \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-836r-79rf-4m37 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-gjv8-xp57-g29c	2.5	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	4	7.5	High	HIGH / HIGH	overdue by 97 days overdue by 97 days overdue by 32 days overdue by 32 days	Uncontrolled Resource Consumption 4 CVEs CVE-2026-49476 EUVD-2026-44539 CWE-400 CWE-770 EPSS 0.6% Grype CVE-2026-49477 EUVD-2026-44538 CWE-400 CWE-1333 EPSS 0.6% Grype CVE-2026-86000 EUVD-2026-81689 CWE-400 CWE-1333 EPSS 0.6% Grype CVE-2026-85999 EUVD-2026-81690 CWE-400 CWE-1333 EPSS 0.6% Grype
werkzeug conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-2g68-c3qc-8985, https://github.com/advisories/GHSA-hrfv-mqp8-q5rw, https://github.com/advisories/GHSA-q34m-jh98-gwm2 (+5 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-2g68-c3qc-8985 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-hrfv-mqp8-q5rw \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-q34m-jh98-gwm2	2.2.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	8	7.5	High	HIGH / HIGH	overdue by 896 days overdue by 1090 days overdue by 724 days overdue by 724 days overdue by 241 days overdue by 325 days overdue by 284 days overdue by 20 days	Cross-Site Request Forgery 1 CVE CVE-2024-34069 EUVD-2024-1358 CWE-352 EPSS 3.4% Grype Uncontrolled Resource Consumption 2 CVEs CVE-2023-46136 EUVD-2023-0280 CWE-400 CWE-407 +1 EPSS 1.3% Grype CVE-2024-49767 EUVD-2024-3107 CWE-400 CWE-770 EPSS 1.1% Grype Path Traversal 1 CVE CVE-2024-49766 EUVD-2024-3031 CWE-22 EPSS 0.8% Grype Werkzeug safe_join() allows Windows special device names 3 CVEs CVE-2026-27199 EUVD-2026-7732 CWE-67 EPSS 0.6% Grype CVE-2025-66221 EUVD-2025-199893 CWE-67 EPSS 0.5% Grype CVE-2026-102598 EUVD-2026-88980 CWE-67 EPSS 0.4% Grype Werkzeug safe_join() allows Windows special device names with compound extensions 1 CVE CVE-2026-21860 EUVD-2026-1425 CWE-67 EPSS 0.5% Grype
jupyter-lsp conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-4qhp-652w-c22x; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-4qhp-652w-c22x	2.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	7.3	High	HIGH / HIGH	overdue by 1005 days	Path Traversal 1 CVE CVE-2024-22415 EUVD-2024-0253 CWE-23 CWE-284 +2 EPSS 0.5% Grype
jupyter-core conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-33p9-3p43-82vq; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-33p9-3p43-82vq	5.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	7.3	High	HIGH / HIGH	overdue by 503 days	Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation 1 CVE CVE-2025-30167 EUVD-2025-16771 CWE-427 EPSS 0.2% Grype
pyopenssl conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-5pwr-322w-8jr4, https://github.com/advisories/GHSA-vp96-hxj8-p424; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5pwr-322w-8jr4 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-vp96-hxj8-p424	24.0.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	2	7.2	High	HIGH / n/a	overdue by 216 days overdue by 216 days	pyOpenSSL DTLS cookie callback buffer overflow 1 CVE CVE-2026-27459 EUVD-2026-12677 CWE-120 CWE-120 EPSS 0.7% Grype pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback 1 CVE CVE-2026-27448 EUVD-2026-12675 CWE-636 EPSS 0.3% Grype
giflib conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2022-28506, https://nvd.nist.gov/vuln/detail/CVE-2023-48161, https://nvd.nist.gov/vuln/detail/CVE-2023-39742 (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2022-28506 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-48161 \| Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2023-39742	5.2.1	library	📦 Conda (Anaconda) Source: existing	MIT	4	7.1	High	HIGH / HIGH	overdue by 1638 days overdue by 1063 days overdue by 1151 days overdue by 223 days	Out-of-Bounds Write 2 CVEs CVE-2022-28506 EUVD-2022-32948 CWE-787 EPSS 1.3% Grype CVE-2023-48161 EUVD-2023-52241 CWE-787 EPSS 0.4% Grype giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c. 1 CVE CVE-2023-39742 EUVD-2023-43442 CWE-120 EPSS 0.3% Grype Giflib contains a double-free 1 CVE CVE-2026-23868 EUVD-2026-10794 CWE-415 CWE-825 EPSS 0.2% Grype
protego conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-wjmf-p669-5m5p; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-wjmf-p669-5m5p	0.1.16	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	7.1	High	HIGH / n/a	overdue by 52 days	Uncontrolled Resource Consumption 1 CVE CVE-2026-55520 EUVD-2026-67865 CWE-400 CWE-1333 EPSS 0.5% Grype
idna conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-jjg7-2v4v-x38h, https://github.com/advisories/GHSA-65pc-fj4g-8rjx; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-jjg7-2v4v-x38h \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-65pc-fj4g-8rjx	3.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	2	6.9	Medium	MEDIUM / n/a	overdue by 834 days overdue by 136 days	Other vulnerabilities 2 CVEs CVE-2024-3651 EUVD-2024-0077 CWE-1333 EPSS 1.4% Grype CVE-2026-45409 EUVD-2026-34921 CWE-1333 EPSS 0.4% Grype
zipp conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-jfmj-5v4g-7637; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-jfmj-5v4g-7637	3.17.0	library	📦 Conda (Anaconda) Source: existing	MIT	1	6.9	Medium	MEDIUM / n/a	overdue by 833 days	zipp Denial of Service 1 CVE CVE-2024-5569 EUVD-2024-2374 CWE-835 EPSS 0.2% Grype
python-dotenv conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-mf9w-mj56-hr94; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-mf9w-mj56-hr94	0.21.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	6.6	Medium	MEDIUM / MEDIUM	overdue by 182 days	python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback 1 CVE CVE-2026-28684 EUVD-2026-23901 CWE-59 CWE-61 EPSS 0.3% Grype
filelock conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-69hj-f68j-2879, https://github.com/advisories/GHSA-w853-jp5j-5j7f, https://github.com/advisories/GHSA-qmgc-5h2g-mvrw (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-69hj-f68j-2879 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-w853-jp5j-5j7f \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-qmgc-5h2g-mvrw	3.13.1	library	📦 Conda (Anaconda) Source: existing	The Unlicense (Unlicense) PYPI	4	6.3	Medium	MEDIUM / MEDIUM	0 days left overdue by 307 days overdue by 283 days Deadline unavailable	filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path 1 CVE CVE-2026-112909 EUVD-2026-105017 CWE-706 EPSS 0.2% Grype filelock has a TOCTOU race condition which allows symlink attacks during lock file creation 1 CVE CVE-2025-68146 EUVD-2025-203839 CWE-59 CWE-362 +2 EPSS 0.2% Grype filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink 1 CVE CVE-2026-22701 EUVD-2026-1870 CWE-59 CWE-362 +1 EPSS 0.1% Grype filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL 1 CVE CVE-2026-112910 Grype
bleach conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-gj48-438w-jh9v, https://github.com/advisories/GHSA-8rfp-98v4-mmr6; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-gj48-438w-jh9v \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-8rfp-98v4-mmr6	4.1.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	2	6.1	Medium	MEDIUM / MEDIUM	Deadline unavailable Deadline unavailable	Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributes 1 CVE ⚠️GHSA-GJ48-438W-JH9V Grype Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in output 1 CVE ⚠️GHSA-8RFP-98V4-MMR6 Grype
streamlit conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-rxff-vr5r-8cj5, https://github.com/advisories/GHSA-7p48-42j8-8846, https://github.com/advisories/GHSA-vqwp-45wm-r9r5; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-rxff-vr5r-8cj5 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-7p48-42j8-8846 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-vqwp-45wm-r9r5	1.30.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	3	6.0	Medium	MEDIUM / MEDIUM	overdue by 798 days overdue by 207 days overdue by 137 days	Path Traversal 1 CVE CVE-2024-42474 EUVD-2024-0164 CWE-22 CWE-22 EPSS 0.6% Grype Server-Side Request Forgery 1 CVE CVE-2026-33682 EUVD-2026-16444 CWE-918 EPSS 0.3% Grype Streamlit @st.cache_data hash collision via fixed sampling seed and PIL P-mode palette omission 1 CVE CVE-2026-10804 EUVD-2026-34246 CWE-327 CWE-328 EPSS 0.1% Grype
pydantic conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-mr82-8j83-vxmv; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-mr82-8j83-vxmv	1.10.12	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	1	5.9	Medium	MEDIUM / MEDIUM	overdue by 918 days	Pydantic regular expression denial of service 1 CVE CVE-2024-3772 EUVD-2024-1252 CWE-1333 EPSS 1.0% Grype
requests conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-9hjg-9r4m-mvj7, https://github.com/advisories/GHSA-9wx4-h78v-vm56, https://github.com/advisories/GHSA-gc5v-m9x4-r6x2; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-9hjg-9r4m-mvj7 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-9wx4-h78v-vm56 \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-gc5v-m9x4-r6x2	2.31.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	3	5.6	Medium	MEDIUM / MEDIUM	overdue by 497 days overdue by 882 days overdue by 208 days	Requests vulnerable to .netrc credentials leak via malicious URLs 1 CVE CVE-2024-47081 EUVD-2025-17564 CWE-522 EPSS 1.0% Grype Requests `Session` object does not verify requests after making first request with verify=False 1 CVE CVE-2024-35195 EUVD-2024-1565 CWE-670 EPSS 0.3% Grype Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function 1 CVE CVE-2026-25645 EUVD-2026-15754 CWE-377 EPSS 0.2% Grype
markdown conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-5wmx-573v-2qwq; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5wmx-573v-2qwq	3.4.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	5.5	Medium	MEDIUM / n/a	overdue by 228 days	Uncontrolled Resource Consumption 1 CVE CVE-2025-69534 EUVD-2025-208312 CWE-400 CWE-617 EPSS 0.7% Grype
zlib conda Scanner: grype; Advisory source: https://nvd.nist.gov/vuln/detail/CVE-2026-27171; Match evidence: Detected by Grype vulnerability scanner. Data source: https://nvd.nist.gov/vuln/detail/CVE-2026-27171	1.2.13	library	📦 zlib Source: existing	Zlib	1	5.5	Medium	MEDIUM / MEDIUM	overdue by 244 days	Other vulnerabilities 1 CVE CVE-2026-27171 EUVD-2026-8063 CWE-1284 EPSS 0.2% Grype
jinja2 conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-h75v-3vvj-5mfj, https://github.com/advisories/GHSA-q2x7-8rv6-6q7h, https://github.com/advisories/GHSA-cpwx-vrp4-4pq7 (+1 more); Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-h75v-3vvj-5mfj \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-q2x7-8rv6-6q7h \| Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-cpwx-vrp4-4pq7	3.1.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	4	5.4	Medium	MEDIUM / MEDIUM	overdue by 896 days overdue by 665 days overdue by 593 days overdue by 665 days	Cross-Site Scripting 1 CVE CVE-2024-34064 EUVD-2024-1641 CWE-79 EPSS 1.0% Grype Jinja has a sandbox breakout through indirect reference to format method 1 CVE CVE-2024-56326 EUVD-2024-3607 CWE-693 CWE-1336 EPSS 0.5% Grype Jinja2 vulnerable to sandbox breakout through attr filter selecting format method 1 CVE CVE-2025-27516 EUVD-2025-6152 CWE-1336 EPSS 0.5% Grype Jinja has a sandbox breakout through malicious filenames 1 CVE CVE-2024-56201 EUVD-2024-3585 CWE-150 EPSS 0.3% Grype
distributed conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-c336-7962-wfj2; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-c336-7962-wfj2	2023.11.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	5.3	Medium	MEDIUM / n/a	overdue by 276 days	Cross-Site Scripting 1 CVE CVE-2026-23528 EUVD-2026-2922 CWE-79 CWE-80 +1 EPSS 0.2% Grype
scikit-learn conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-jw8x-6495-233v; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-jw8x-6495-233v	1.2.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	5.3	Medium	MEDIUM / MEDIUM	overdue by 865 days	scikit-learn sensitive data leakage 1 CVE CVE-2024-5206 EUVD-2024-0161 CWE-921 CWE-922 EPSS 0.2% Grype
bokeh conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-793v-589g-574v; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-793v-589g-574v	3.3.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	1	4.5	Medium	MEDIUM / n/a	overdue by 285 days	Bokeh server applications have Incomplete Origin Validation in WebSockets 1 CVE CVE-2026-21883 EUVD-2026-1036 CWE-1385 EPSS 0.2% Grype
tqdm conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-g7vv-2v7x-gj9p; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-g7vv-2v7x-gj9p	4.65.0	library	📦 Conda (Anaconda) Source: existing	MIT	1	3.9	Low	LOW / LOW	overdue by 899 days	tqdm CLI arguments injection attack 1 CVE CVE-2024-34062 EUVD-2024-1621 CWE-74 EPSS 0.4% Grype
flask conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-68rp-wp8r-4726; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-68rp-wp8r-4726	2.2.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	1	2.3	Low	LOW / n/a	overdue by 241 days	Flask session does not add `Vary: Cookie` header when accessed in some ways 1 CVE CVE-2026-27205 EUVD-2026-7731 CWE-524 EPSS 0.4% Grype
pygments conda Scanner: grype; Advisory source: https://github.com/advisories/GHSA-5239-wwwm-4pmq; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-5239-wwwm-4pmq	2.15.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	1	1.9	Low	LOW / n/a	overdue by 212 days	Uncontrolled Resource Consumption 1 CVE CVE-2026-4539 EUVD-2026-14287 CWE-400 CWE-1333 EPSS 0.2% Grype
imagecodecs conda Scanner: grype, osv_crosscheck; Advisory source: https://github.com/advisories/GHSA-94vc-p8w7-5p49, OSV; Match evidence: Detected by Grype vulnerability scanner. Data source: https://github.com/advisories/GHSA-94vc-p8w7-5p49 \| Affected release range detected by OSV; product reachability requires review. Aliases:	2023.1.23	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	2	N/A	High	HIGH / n/a	Deadline unavailable Deadline unavailable	Bundled libwebp in imagecodecs vulnerable 1 CVE ⚠️GHSA-94VC-P8W7-5P49 Grype Other vulnerabilities 1 CVE PYSEC-2023-174 OSV
numpy conda	1.26.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	No CVEs	No findings	No findings	None
pyyaml conda	6.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
natsort conda	8.4.0	library	📦 Seth M. Morton Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
einops conda	0.3.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
timm conda	1.0.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
scipy conda	1.11.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	No CVEs	No findings	No findings	None
scikit-image conda	0.22.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
opencv-python-headless conda	4.9.0.80	library	📦 OpenCV Team Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
absl-py conda	2.1.0	library	📦 Google LLC Source: known_maintainer	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
annotated-types conda	0.6.0	library	📦 Adrian Garcia Badaracco Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
antlr4-python3-runtime conda	4.9.3	library	📦 Terence Parr, Sam Harwell Source: registry_cache:pypi_api	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
blessed conda	1.20.0	library	📦 "Jeff Quast, Erik Rose, Avram Lubkin" Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
boto3 conda	1.34.77	library	📦 Amazon Web Services Source: known_maintainer	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
botocore conda	1.34.77	library	📦 Amazon Web Services Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
croniter conda	1.3.15	library	📦 Matsumoto Taichi Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
dateutils conda	0.6.12	library	📦 Jeremy Cantrell Source: registry_cache:pypi_api	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
editor conda	1.6.6	library	📦 Tom Ritchford Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
grpcio conda	1.62.1	library	📦 Google LLC Source: known_maintainer	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
huggingface-hub conda	0.22.2	library	📦 Hugging Face, Inc. Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
inquirer conda	3.2.4	library	📦 Miguel Ángel García Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
largestinteriorrectangle conda	0.2.1	library	📦 Lukas Weber Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
lightning-cloud conda	0.5.65	library	📦 Grid.ai Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
lightning-utilities conda	0.11.2	library	📦 Lightning AI et al. Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
omegaconf conda	2.3.0	library	📦 Omry Yadan Source: registry_cache:pypi_api	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ordered-set conda	4.1.0	library	📦 Elia Robyn Lake Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
packaging conda	22.0	library	📦 Python Packaging Authority Source: known_maintainer	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
pydantic-core conda	2.18.2	library	📦 Samuel Colvin Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
readchar conda	4.0.6	library	📦 Miguel Ángel García Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
runs conda	1.2.2	library	📦 Tom Ritchford Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
s3transfer conda	0.10.1	library	📦 Amazon Web Services Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
starsessions conda	1.3.0	library	📦 alex.oleshkevich Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
taming-transformers conda	0.0.1	library	📦 Patrick Esser, Robin Rombach, Bjorn Ommer Source: registry_cache:pypi_api	Unknown	0	N/A	No CVEs	No findings	No findings	None
tensorboard conda	2.16.2	library	📦 Google Inc. Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
tensorboard-data-server conda	0.7.2	library	📦 Google Inc. Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
tokenizers conda	0.15.2	library	📦 Nicolas Patry Source: registry_cache:pypi_api	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
torchmetrics conda	1.3.2	library	📦 Lightning-AI et al. Source: registry_cache:pypi_api	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
uvicorn conda	0.29.0	library	📦 Tom Christie Source: registry_cache:pypi_api	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
websockets conda	11.0.3	library	📦 Aymeric Augustin Source: registry_cache:pypi_api	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
xmod conda	1.8.1	library	📦 Tom Ritchford Source: registry_cache:pypi_api	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
-anaconda-depends conda	2024.02	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
_libgcc_mutex conda	0.1	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
_openmp_mutex conda	5.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
abseil-cpp conda	20211102.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
aiobotocore conda	2.7.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
aioitertools conda	0.7.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
aiosignal conda	1.2.0	library	📦 Conda (Anaconda) Source: existing	Apache 2 PYPI	0	N/A	No CVEs	No findings	No findings	None
alabaster conda	0.7.12	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
altair conda	5.0.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
anaconda-catalogs conda	0.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
anaconda-cloud-auth conda	0.1.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
aom conda	3.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
appdirs conda	1.4.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
archspec conda	0.2.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 OR MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
argon2-cffi conda	21.3.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
argon2-cffi-bindings conda	21.2.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
arrow conda	1.2.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
arrow-cpp conda	14.0.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
astroid conda	2.14.2	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later PYPI	0	N/A	No CVEs	No findings	No findings	None
astropy conda	5.3.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
asttokens conda	2.0.5	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
async-lru conda	2.0.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
atomicwrites conda	1.4.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
attrs conda	23.1.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
automat conda	20.2.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
autopep8 conda	1.6.0	library	📦 Conda (Anaconda) Source: existing	Expat License PYPI	0	N/A	No CVEs	No findings	No findings	None
aws-sdk-cpp conda	1.10.55	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
backports conda	1.1	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
backports-functools-lru-cache conda	1.6.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
backports-tempfile conda	1.0	library	📦 Conda (Anaconda) Source: existing	PSF-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
backports-weakref conda	1.0.post1	library	📦 Conda (Anaconda) Source: existing	PSF-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
bcrypt conda	3.2.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
beautifulsoup4 conda	4.12.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
binaryornot conda	0.4.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
blas conda	1.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
blinker conda	1.6.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
blosc conda	1.21.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
boltons conda	23.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
boost-cpp conda	1.82.0	library	📦 Conda (Anaconda) Source: existing	BSL-1.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
bottleneck conda	1.3.7	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
brotli-bin conda	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
brotli conda	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
brunsli conda	0.1	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
bzip2 conda	1.0.8	library	📦 Conda (Anaconda) Source: existing	BSD-4-Clause-UC	0	N/A	No CVEs	No findings	No findings	None
c-blosc2 conda	2.12.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
ca-certificates conda	2025.12.2	library	📦 Conda (Anaconda) Source: existing	ISC	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cachetools conda	4.2.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
cffi conda	1.16.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
cfitsio conda	3.470	library	📦 Conda (Anaconda) Source: existing	LicenseRef-fitsio	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
chardet conda	4.0.0	library	📦 Conda (Anaconda) Source: existing	LGPL PYPI	0	N/A	No CVEs	No findings	No findings	None
charls conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
charset-normalizer conda	2.0.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
click conda	8.1.7	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
cloudpickle conda	2.2.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
clyent conda	1.2.2	library	📦 Conda (Anaconda) Source: existing	MIT NPM	0	N/A	No CVEs	No findings	No findings	None
colorama conda	0.4.6	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
colorcet conda	3.0.1	library	📦 Conda (Anaconda) Source: existing	CC-BY License PYPI	0	N/A	No CVEs	No findings	No findings	None
comm conda	0.1.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
conda-content-trust conda	0.2.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
conda-pack conda	0.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
conda-package-handling conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
conda-package-streaming conda	0.9.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
conda-verify conda	3.4.2	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
constantly conda	23.10.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
contourpy conda	1.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
cookiecutter conda	2.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
cssselect conda	1.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
cuda-cudart conda	12.1.105	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-cupti conda	12.1.105	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-libraries conda	12.1.0	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-nvrtc conda	12.1.105	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-nvtx conda	12.1.105	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-opencl conda	12.4.99	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cuda-runtime conda	12.1.0	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cycler conda	0.11.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
cyrus-sasl conda	2.1.28	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause-Attribution	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
cytoolz conda	0.12.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
dask conda	2023.11.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
dask-core conda	2023.11.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
dataclasses conda	0.8	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
datashader conda	0.16.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
dbus conda	1.13.18	library	📦 Conda (Anaconda) Source: existing	AFL-2.1 OR GPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
debugpy conda	1.6.7	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
decorator conda	5.1.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
defusedxml conda	0.7.1	library	📦 Conda (Anaconda) Source: existing	PSFL PYPI	0	N/A	No CVEs	No findings	No findings	None
diff-match-patch conda	20200713	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
dill conda	0.3.7	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
distro conda	1.8.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
docstring-to-markdown conda	0.11	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later PYPI	0	N/A	No CVEs	No findings	No findings	None
docutils conda	0.18.1	library	📦 Conda (Anaconda) Source: existing	public domain, Python, 2-Clause BSD, GPL 3 (see COPYING.txt) PYPI	0	N/A	No CVEs	No findings	No findings	None
entrypoints conda	0.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
et-xmlfile conda	1.1.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
executing conda	0.8.3	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
fmt conda	9.1.0	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
fontconfig conda	2.14.1	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
fonttools conda	4.25.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
frozenlist conda	1.4.0	library	📦 Conda (Anaconda) Source: existing	Apache 2 PYPI	0	N/A	No CVEs	No findings	No findings	None
future conda	0.18.3	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
gensim conda	4.3.0	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-only PYPI	0	N/A	No CVEs	No findings	No findings	None
gflags conda	2.2.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
gitdb conda	4.0.7	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
glib-tools conda	2.78.4	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
glog conda	0.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
gmp conda	6.2.1	library	📦 Conda (Anaconda) Source: existing	GPL-2.0-or-later OR LGPL-3.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
gmpy2 conda	2.1.2	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0+ PYPI	0	N/A	No CVEs	No findings	No findings	None
gnutls conda	3.6.13	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
greenlet conda	3.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
grpc-cpp conda	1.48.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
gst-plugins-base conda	1.14.1	library	📦 Conda (Anaconda) Source: existing	LGPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
h5py conda	3.9.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
heapdict conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
holoviews conda	1.18.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
hvplot conda	0.9.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
hyperlink conda	21.0.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
icu conda	73.1	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
imageio conda	2.33.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
imagesize conda	1.4.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
imbalanced-learn conda	0.11.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
importlib-metadata conda	7.0.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
importlib_metadata conda	7.0.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
incremental conda	22.10.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
inflection conda	0.5.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
iniconfig conda	1.1.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
intel-openmp conda	2023.1.0	library	📦 Conda (Anaconda) Source: existing	LicenseRef-IntelSimplifiedSoftwareOct2022	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
intervaltree conda	3.1.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
ipykernel conda	6.28.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ipython conda	8.20.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ipython-genutils conda	0.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ipywidgets conda	7.6.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
itemadapter conda	0.3.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
itemloaders conda	1.1.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
itsdangerous conda	2.0.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jaraco-classes conda	3.2.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jedi conda	0.18.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jeepney conda	0.7.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jellyfish conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jmespath conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
joblib conda	1.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jpeg conda	9e	library	📦 Conda (Anaconda) Source: existing	IJG	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
jq conda	1.6	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
json5 conda	0.9.6	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
jsonpatch conda	1.32	library	📦 Conda (Anaconda) Source: existing	Modified BSD License PYPI	0	N/A	No CVEs	No findings	No findings	None
jsonpointer conda	2.1	library	📦 Conda (Anaconda) Source: existing	Modified BSD License PYPI	0	N/A	No CVEs	No findings	No findings	None
jsonschema conda	4.19.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jsonschema-specifications conda	2023.7.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyter conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyter-client conda	8.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyter-console conda	6.6.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyter-events conda	0.8.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyter-server-terminals conda	0.4.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyterlab-variableinspector conda	3.1.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
jupyterlab-pygments conda	0.1.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyterlab-server conda	2.25.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jupyterlab-widgets conda	3.0.9	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
jxrlib conda	1.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
keyring conda	23.13.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
kiwisolver conda	1.4.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
krb5 conda	1.20.1	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
lame conda	3.100	library	📦 Conda (Anaconda) Source: existing	LGPL-2.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
lazy-object-proxy conda	1.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
lazy-loader conda	0.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
lcms2 conda	2.12	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
ld_impl_linux-64 conda	2.38	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
lerc conda	3.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libaec conda	1.0.4	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libavif conda	0.11.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libboost conda	1.82.0	library	📦 Conda (Anaconda) Source: existing	BSL-1.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libbrotlicommon conda	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libbrotlidec conda	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libbrotlienc conda	1.0.9	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libclang conda	14.0.6	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 WITH LLVM-exception	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libclang13 conda	14.0.6	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 WITH LLVM-exception	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcublas conda	12.1.0.26	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcufft conda	11.0.2.4	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcufile conda	1.9.0.20	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcups conda	2.4.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcurand conda	10.3.5.119	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcusolver conda	11.4.4.55	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libcusparse conda	12.0.2.55	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libdeflate conda	1.17	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libedit conda	3.1.20230828	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libev conda	4.33	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause OR GPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libffi conda	3.4.4	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
libgcc-ng conda	11.2.0	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only WITH GCC-exception-3.1	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libgfortran-ng conda	11.2.0	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only WITH GCC-exception-3.1	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libgfortran5 conda	11.2.0	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only WITH GCC-exception-3.1	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libgomp conda	11.2.0	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only WITH GCC-exception-3.1	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libiconv conda	1.16	library	📦 Conda (Anaconda) Source: existing	LGPL-2.1-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
liblief conda	0.12.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libllvm14 conda	14.0.6	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 WITH LLVM-exception	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libmamba conda	1.5.6	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libmambapy conda	1.5.6	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
libnghttp2 conda	1.57.0	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libnpp conda	12.0.2.50	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libnvjitlink conda	12.1.105	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libnvjpeg conda	12.1.1.14	library	📦 Conda (Anaconda) Source: existing	LicenseRef-NVIDIA-End-User-License-Agreement	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libpq conda Note: detected from `libpq.dll`, the PostgreSQL client library. CVEs are matched against the full PostgreSQL product family; server-only issues require manufacturer confirmation (see VEX).	12.17	library	📦 Conda (Anaconda) Source: existing	PostgreSQL	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libsodium conda	1.0.18	library	📦 Conda (Anaconda) Source: existing	ISC	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libsolv conda	0.7.24	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libspatialindex conda	1.9.3	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libstdcxx-ng conda	11.2.0	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only WITH GCC-exception-3.1	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libthrift conda	0.15.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libuuid conda	1.41.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libwebp-base conda	1.3.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libxcb conda	1.15	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libxkbcommon conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT AND MIT-open-group AND HPND AND HPND-sell-variant AND ISC	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libxslt conda	1.1.37	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
libzopfli conda	1.0.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
linkify-it-py conda	2.0.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
llvm-openmp conda	12.0.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 WITH LLVM-exception	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
llvmlite conda	0.42.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
locket conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
lz4 conda	4.3.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
lz4-c conda	1.9.4	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
lzo conda	2.10	library	📦 Conda (Anaconda) Source: existing	GPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
markdown-it-py conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
markupsafe conda	2.1.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
matplotlib conda	3.8.0	library	📦 Conda (Anaconda) Source: existing	PSF-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
matplotlib-base conda	3.8.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
matplotlib-inline conda	0.1.6	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
mccabe conda	0.7.0	library	📦 Conda (Anaconda) Source: existing	Expat license PYPI	0	N/A	No CVEs	No findings	No findings	None
mdit-py-plugins conda	0.3.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
mdurl conda	0.1.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
menuinst conda	2.0.2	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
mkl conda	2023.1.0	library	📦 Conda (Anaconda) Source: existing	LicenseRef-IntelSimplifiedSoftwareOct2022	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
mkl-service conda	2.4.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
mkl-fft conda	1.3.8	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
mkl-random conda	1.2.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
more-itertools conda	10.1.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
mpc conda	1.1.0	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
mpfr conda	4.0.2	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
mpi conda	1.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
mpi4py conda	4.0.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
mpich conda	4.1.1	library	📦 Conda (Anaconda) Source: existing	LicenseRef-MPICH	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
mpmath conda	1.3.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
msgpack-python conda	1.0.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
multidict conda	6.0.4	library	📦 Conda (Anaconda) Source: existing	Apache 2 PYPI	0	N/A	No CVEs	No findings	No findings	None
multipledispatch conda	0.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
munkres conda	1.1.4	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
mypy-extensions conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
mysql conda	5.7.24	library	📦 Conda (Anaconda) Source: existing	GPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
nbclient conda	0.8.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
nbformat conda	5.9.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ncurses conda	6.4	library	📦 Conda (Anaconda) Source: existing	X11 AND BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
nest-asyncio conda	1.6.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
nettle conda	3.6	library	📦 Conda (Anaconda) Source: existing	GPL-2.0-or-later OR LGPL-3.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
networkx conda	3.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
notebook-shim conda	0.2.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
nspr conda	4.35	library	📦 Conda (Anaconda) Source: existing	MPL-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
nss conda	3.89.1	library	📦 Conda (Anaconda) Source: existing	MPL-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
numba conda	0.59.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
numexpr conda	2.8.7	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
numpy-base conda	1.26.4	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
numpydoc conda	1.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
oniguruma conda	6.9.7.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
openpyxl conda	3.0.10	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
orc conda	1.7.4	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
overrides conda	7.4.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
pandas conda	2.1.4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pandocfilters conda	1.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
panel conda	1.3.8	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
param conda	2.0.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
parsel conda	1.8.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
parso conda	0.8.3	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
partd conda	1.4.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
patch conda	2.7.6	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
patchelf conda	0.17.2	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
pathlib conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pathspec conda	0.10.3	library	📦 Conda (Anaconda) Source: existing	MPL 2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
patsy conda	0.5.3	library	📦 Conda (Anaconda) Source: existing	2-clause BSD PYPI	0	N/A	No CVEs	No findings	No findings	None
pexpect conda	4.8.0	library	📦 Conda (Anaconda) Source: existing	ISC PYPI	0	N/A	No CVEs	No findings	No findings	None
pickleshare conda	0.7.5	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pkce conda	1.0.3	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pkginfo conda	1.9.6	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
platformdirs conda	3.10.0	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
plotly conda	5.9.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pluggy conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
ply conda	3.11	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
prometheus-client conda	0.14.1	library	📦 Conda (Anaconda) Source: existing	Apache Software License 2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
prompt-toolkit conda	3.0.43	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
prompt_toolkit conda	3.0.43	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
psutil conda	5.9.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
ptyprocess conda	0.7.0	library	📦 Conda (Anaconda) Source: existing	ISC	0	N/A	No CVEs	No findings	No findings	None
pure-eval conda	0.2.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
py-cpuinfo conda	9.0.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
py-lief conda	0.12.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
pyasn1-modules conda	0.2.8	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pybind11-abi conda	4	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
pycodestyle conda	2.10.0	library	📦 Conda (Anaconda) Source: existing	Expat license PYPI	0	N/A	No CVEs	No findings	No findings	None
pycosat conda	0.6.6	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pycparser conda	2.21	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pyct conda	0.5.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pycurl conda	7.45.2	library	📦 Conda (Anaconda) Source: existing	LGPL/MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pydeck conda	0.8.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
pydispatcher conda	2.0.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pydocstyle conda	6.3.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyerfa conda	2.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pyflakes conda	3.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pylint-venv conda	2.3.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyls-spyder conda	0.4.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyodbc conda	5.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyparsing conda	3.0.9	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyqt conda	5.15.10	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
pyqt5-sip conda	12.13.0	library	📦 Conda (Anaconda) Source: existing	SIP PYPI	0	N/A	No CVEs	No findings	No findings	None
pyqtwebengine conda	5.15.10	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
pysocks conda	1.7.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pytables conda	3.9.2	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
python-dateutil conda	2.8.2	library	📦 Conda (Anaconda) Source: existing	Dual License PYPI	0	N/A	No CVEs	No findings	No findings	None
python-fastjsonschema conda	2.16.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
python-json-logger conda	2.0.7	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
python-libarchive-c conda	2.9	library	📦 Conda (Anaconda) Source: existing	CC0 PYPI	0	N/A	No CVEs	No findings	No findings	None
python-lmdb conda	1.4.1	library	📦 Conda (Anaconda) Source: existing	OLDAP-2.8 PYPI	0	N/A	No CVEs	No findings	No findings	None
python-lsp-black conda	1.2.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
python-lsp-jsonrpc conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
python-lsp-server conda	1.7.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
python-slugify conda	5.0.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
python-snappy conda	0.6.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
python-tzdata conda	2023.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
pytoolconfig conda	1.2.6	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-or-later PYPI	0	N/A	No CVEs	No findings	No findings	None
pytorch-cuda conda	12.1	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
pytorch-mutex conda	1.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
pytz conda	2023.3.post1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyviz-comms conda	3.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
pywavelets conda	1.5.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
pyxdg conda	0.27	library	📦 Conda (Anaconda) Source: existing	GNU Lesser General Public License v2 (LGPLv2) PYPI	0	N/A	No CVEs	No findings	No findings	None
pyzmq conda	25.1.2	library	📦 Conda (Anaconda) Source: existing	LGPL+BSD PYPI	0	N/A	No CVEs	No findings	No findings	None
qdarkstyle conda	3.0.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
qstylizer conda	0.2.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
qt-main conda	5.15.2	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
qt-webengine conda	5.15.9	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
qtawesome conda	1.2.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
qtconsole conda	5.4.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
qtpy conda	2.4.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
queuelib conda	1.6.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
re2 conda	2022.04.01	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
readline conda	8.2	library	📦 Conda (Anaconda) Source: existing	GPL-3.0-only	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
referencing conda	0.30.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
regex conda	2023.10.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	No CVEs	No findings	No findings	None
reproc conda	14.2.4	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
reproc-cpp conda	14.2.4	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
requests-file conda	1.5.1	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
requests-toolbelt conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
rfc3339-validator conda	0.1.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
rfc3986-validator conda	0.1.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
rich conda	13.3.5	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
rope conda	1.7.0	library	📦 Conda (Anaconda) Source: existing	LGPL-3.0-or-later PYPI	0	N/A	No CVEs	No findings	No findings	None
rpds-py conda	0.10.6	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
rtree conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
ruamel-yaml conda	0.17.21	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
s3fs conda	2023.10.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
safetensors conda	0.4.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
seaborn conda	0.13.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
secretstorage conda	3.3.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
semver conda	2.13.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
send2trash conda	1.8.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
service-identity conda	18.1.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
sip conda	6.7.12	library	📦 Conda (Anaconda) Source: existing	SIP PYPI	0	N/A	No CVEs	No findings	No findings	None
six conda	1.16.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
smart-open conda	5.2.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
smmap conda	4.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
snappy conda	1.1.10	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	No CVEs	No findings	No findings	None
sniffio conda	1.3.0	library	📦 Conda (Anaconda) Source: existing	MIT OR Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
snowballstemmer conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sortedcontainers conda	2.4.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-applehelp conda	1.0.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-devhelp conda	1.0.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-htmlhelp conda	2.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-jsmath conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-qthelp conda	1.0.3	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-serializinghtml conda	1.1.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
spyder conda	5.4.3	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
spyder-kernels conda	2.4.4	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
sqlalchemy conda	2.0.25	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
stack-data conda	0.2.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
statsmodels conda	0.14.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
sympy conda	1.12	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
tabulate conda	0.9.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
tbb conda	2021.8.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
tblib conda	1.7.0	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
tenacity conda	8.2.2	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
terminado conda	0.17.1	library	📦 Conda (Anaconda) Source: existing	BSD-2-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
text-unidecode conda	1.3	library	📦 Conda (Anaconda) Source: existing	Artistic License PYPI	0	N/A	No CVEs	No findings	No findings	None
textdistance conda	4.2.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
threadpoolctl conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
three-merge conda	0.1.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
tifffile conda	2023.4.12	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
tinycss2 conda	1.2.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
tk conda	8.6.12	library	📦 Conda (Anaconda) Source: existing	TCL	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
tldextract conda	3.2.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
toml conda	0.10.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
tomlkit conda	0.11.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
toolz conda	0.12.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
torchaudio conda	2.2.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
torchtriton conda	2.2.0	library	📦 Conda (Anaconda) Source: existing	Unknown	0	N/A	No CVEs	No findings	No findings	None
torchvision conda	0.17.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
traitlets conda	5.7.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
truststore conda	0.8.0	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
typing-extensions conda	4.9.0	library	📦 Conda (Anaconda) Source: existing	PSF-2.0	0	N/A	No CVEs	No findings	No findings	None
tzdata conda	2023d	library	📦 Conda (Anaconda) Source: existing	LicenseRef-Public-Domain	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
tzlocal conda	2.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
uc-micro-py conda	1.0.1	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
unidecode conda	1.2.0	library	📦 Conda (Anaconda) Source: existing	GPL PYPI	0	N/A	No CVEs	No findings	No findings	None
utf8proc conda	2.6.1	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
validators conda	0.18.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
w3lib conda	2.1.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
watchdog conda	2.1.6	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
wcwidth conda	0.2.5	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
webencodings conda	0.5.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
websocket-client conda	0.58.0	library	📦 Conda (Anaconda) Source: existing	LGPL version 2.1 PYPI	0	N/A	No CVEs	No findings	No findings	None
whatthepatch conda	1.0.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
widgetsnbextension conda	3.5.2	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
wrapt conda	1.14.1	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
wurlitzer conda	3.0.2	library	📦 Conda (Anaconda) Source: existing	MIT PYPI	0	N/A	No CVEs	No findings	No findings	None
xarray conda	2023.6.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
xyzservices conda	2022.9.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
xz conda	5.4.5	library	📦 Conda (Anaconda) Source: existing	0BSD AND LGPL-2.1-or-later AND GPL-2.0-or-later	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
yaml conda	0.2.5	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
yaml-cpp conda	0.8.0	library	📦 Conda (Anaconda) Source: existing	MIT	0	N/A	No CVEs	No findings	No findings	None
yapf conda	0.31.0	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
yarl conda	1.9.3	library	📦 Conda (Anaconda) Source: existing	Apache-2.0 PYPI	0	N/A	No CVEs	No findings	No findings	None
zeromq conda	4.3.5	library	📦 Conda (Anaconda) Source: existing	MPL-2.0	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
zfp conda	1.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
zict conda	3.0.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
zlib-ng conda	2.0.7	library	📦 Conda (Anaconda) Source: existing	Zlib	0	N/A	Not analyzed	No findings	No findings	no ecosystem PURL, CPE, or tracked NVD product route
zope-interface conda	5.4.0	library	📦 Conda (Anaconda) Source: existing	ZPL 2.1 PYPI	0	N/A	No CVEs	No findings	No findings	None
zstandard conda	0.19.0	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause PYPI	0	N/A	No CVEs	No findings	No findings	None
zstd conda	1.5.5	library	📦 Conda (Anaconda) Source: existing	BSD-3-Clause	0	N/A	No CVEs	No findings	No findings	None
sphinxcontrib-jquery	4.1	library	📦 Adam Turner Source: registry_cache:pypi_api	BSD License	0	N/A	No CVEs	No findings	No findings	None
latexcodec	3.0.1	library	📦 Matthias C. M. Troffaes Source: registry_cache:pypi_api	MIT	0	N/A	No CVEs	No findings	No findings	None
aws-iot-device-sdk-cpp-v2	Unresolved No artifact version evidence	library	🏭 Amazon.com, Inc	Apache-2.0	0	N/A	Not evaluated (unversioned)	No findings	No findings	0 candidate CVE(s), applicability not evaluated
niqe_pris_params.npz	sha256:2a7c182a68c9e7f1	machine-learning-model	🏢 Unknown	Unknown	0	N/A	No CVEs	No findings	No findings	None

Report Generation Details

Technical Details

Generated: 2026-11-03 10:22:41

Source File: XFusion_20261102_fixed.json

Enhancement: Grype (online enrichment)

Report Type: Full (with CVE analysis)

Vulnerability Database

CISA KEV Integration: Active Exploitation Detection

Local CVE database: not recorded

CVE sources:

Grype: completed — database built 2026-11-02T06:26:52Z, schema v6.1.10, 26 providers

Response-window methodology: The response deadline is anchored to the earliest public CNA, NVD, OSV, or GHSA timestamp, or to the CISA KEV due date. It is not anchored only to NVD because publication backlogs can make NVD later than the first public disclosure.

FDA/NTIA Compliance

📋 Supplier Field Coverage: 553/554 components (99.8%)
FDA requires supplier identification for medical device SBOM submissions

Supply chain adoption

Publication age of the installed version. A package profile is not a malware verdict. Missing registry evidence is not evaluated, never clean.

Cooling versions

No evaluated versions cooling.

Package version	Version age	Profile	Publisher changed	Signals
`pkg:pypi/numpy@1.26.4`	24016.05 h	established	unknown
`pkg:pypi/pyyaml@6.0.1`	28887.90 h	established	unknown
`pkg:pypi/tqdm@4.65.0`	32154.56 h	established	unknown
`pkg:pypi/natsort@8.4.0`	29555.56 h	established	unknown
`pkg:pypi/einops@0.3.0`	53911.49 h	established	unknown
`pkg:pypi/timm@1.0.3`	21621.58 h	established	unknown
`pkg:pypi/scipy@1.11.4`	25914.83 h	established	unknown
`pkg:pypi/pillow@10.2.0`	24846.60 h	established	unknown
`pkg:pypi/scikit-image@0.22.0`	27018.26 h	established	unknown
`pkg:pypi/opencv-python-headless@4.9.0.80`	24890.27 h	established	unknown
`pkg:pypi/absl-py@2.1.0`	24497.61 h	established	unknown
`pkg:pypi/annotated-types@0.6.0`	26948.96 h	established	unknown
`pkg:pypi/antlr4-python3-runtime@4.9.3`	43725.98 h	established	unknown
`pkg:pypi/blessed@1.20.0`	32821.42 h	established	unknown
`pkg:pypi/boto3@1.34.77`	22628.51 h	established	unknown
`pkg:pypi/botocore@1.34.77`	22628.51 h	established	unknown
`pkg:pypi/croniter@1.3.15`	30169.91 h	established	unknown
`pkg:pypi/dateutils@0.6.12`	52832.69 h	established	unknown
`pkg:pypi/deepdiff@6.7.1`	26024.52 h	established	unknown
`pkg:pypi/editor@1.6.6`	24293.10 h	established	unknown
`pkg:pypi/fastapi@0.88.0`	34464.93 h	established	unknown
`pkg:pypi/grpcio@1.62.1`	23253.47 h	established	unknown
`pkg:pypi/h11@0.14.0`	35976.18 h	established	unknown
`pkg:pypi/huggingface-hub@0.22.2`	22755.88 h	established	unknown
`pkg:pypi/inquirer@3.2.4`	23655.31 h	established	unknown
`pkg:pypi/largestinteriorrectangle@0.2.1`	20698.11 h	established	unknown
`pkg:pypi/lightning@1.9.0`	33229.30 h	established	unknown
`pkg:pypi/lightning-cloud@0.5.65`	23061.60 h	established	unknown
`pkg:pypi/lightning-utilities@0.11.2`	22791.99 h	established	unknown
`pkg:pypi/omegaconf@2.3.0`	34194.86 h	established	unknown
`pkg:pypi/ordered-set@4.1.0`	41785.20 h	established	unknown
`pkg:pypi/packaging@22.0`	34216.55 h	established	unknown
`pkg:pypi/pydantic-core@2.18.2`	22172.78 h	established	unknown
`pkg:pypi/python-multipart@0.0.9`	23906.31 h	established	unknown
`pkg:pypi/pytorch-lightning@2.2.1`	23348.86 h	established	unknown
`pkg:pypi/readchar@4.0.6`	23086.84 h	established	unknown
`pkg:pypi/runs@1.2.2`	24289.11 h	established	unknown
`pkg:pypi/s3transfer@0.10.1`	23108.66 h	established	unknown
`pkg:pypi/starlette@0.22.0`	34713.33 h	established	unknown
`pkg:pypi/starsessions@1.3.0`	37145.78 h	established	unknown
`pkg:pypi/taming-transformers@0.0.1`	49513.15 h	established	unknown
`pkg:pypi/tensorboard@2.16.2`	23755.90 h	established	unknown
`pkg:pypi/tensorboard-data-server@0.7.2`	26538.46 h	established	unknown
`pkg:pypi/tokenizers@0.15.2`	23869.44 h	established	unknown
`pkg:pypi/torchmetrics@1.3.2`	23019.09 h	established	unknown
`pkg:pypi/transformers@4.39.3`	22662.25 h	established	unknown
`pkg:pypi/uvicorn@0.29.0`	22977.13 h	established	unknown
`pkg:pypi/websockets@11.0.3`	30601.46 h	established	unknown
`pkg:pypi/xmod@1.8.1`	24789.79 h	established	unknown
`pkg:pypi/-anaconda-depends@2024.02`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/aiobotocore@2.7.0`	26687.61 h	established	unknown
`pkg:pypi/aiohttp@3.9.3`	24187.19 h	established	unknown
`pkg:pypi/aioitertools@0.7.1`	52427.84 h	established	unknown
`pkg:pypi/aiosignal@1.2.0`	44231.86 h	established	unknown
`pkg:pypi/alabaster@0.7.12`	70862.19 h	established	unknown
`pkg:pypi/altair@5.0.1`	30138.31 h	established	unknown
`pkg:pypi/anaconda-catalogs@0.2.0`	32172.03 h	established	unknown
`pkg:pypi/anaconda-cloud-auth@0.1.4`	27020.66 h	established	unknown
`pkg:pypi/anyio@4.2.0`	25246.73 h	established	unknown
`pkg:pypi/appdirs@1.4.4`	56791.85 h	established	unknown
`pkg:pypi/archspec@0.2.1`	30484.69 h	established	unknown
`pkg:pypi/argon2-cffi@21.3.0`	42892.05 h	established	unknown
`pkg:pypi/argon2-cffi-bindings@21.2.0`	43134.97 h	established	unknown
`pkg:pypi/arrow@1.2.3`	36500.26 h	established	unknown
`pkg:pypi/astroid@2.14.2`	32614.58 h	established	unknown
`pkg:pypi/astropy@5.3.4`	26998.59 h	established	unknown
`pkg:pypi/asttokens@2.0.5`	48552.21 h	established	unknown
`pkg:pypi/async-lru@2.0.4`	28652.64 h	established	unknown
`pkg:pypi/atomicwrites@1.4.0`	37859.70 h	established	unknown
`pkg:pypi/attrs@23.1.0`	31109.04 h	established	unknown
`pkg:pypi/automat@20.2.0`	58820.16 h	established	unknown
`pkg:pypi/autopep8@1.6.0`	44049.05 h	established	unknown
`pkg:pypi/backports@1.1`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/backports-functools-lru-cache@1.6.4`	48740.32 h	established	unknown
`pkg:pypi/backports-tempfile@1.0`	79372.28 h	established	unknown
`pkg:pypi/backports-weakref@1.0.post1`	79986.88 h	established	unknown
`pkg:pypi/bcrypt@3.2.0`	54454.47 h	established	unknown
`pkg:pypi/beautifulsoup4@4.12.2`	31320.80 h	established	unknown
`pkg:pypi/binaryornot@0.4.4`	81071.92 h	established	unknown
`pkg:pypi/bleach@4.1.0`	45480.87 h	established	unknown
`pkg:pypi/blinker@1.6.2`	31194.09 h	established	unknown
`pkg:pypi/bokeh@3.3.4`	24285.09 h	established	unknown
`pkg:pypi/boltons@23.0.0`	32433.38 h	established	unknown
`pkg:pypi/bottleneck@1.3.7`	32036.17 h	established	unknown
`pkg:pypi/cachetools@4.2.2`	48354.52 h	established	unknown
`pkg:pypi/certifi@2026.01.04`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/cffi@1.16.0`	27141.84 h	established	unknown
`pkg:pypi/chardet@4.0.0`	51668.26 h	established	unknown
`pkg:pypi/charset-normalizer@2.0.4`	46098.32 h	established	unknown
`pkg:pypi/click@8.1.7`	28150.36 h	established	unknown
`pkg:pypi/cloudpickle@2.2.1`	33198.39 h	established	unknown
`pkg:pypi/clyent@1.2.2`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/colorama@0.4.6`	35269.24 h	established	unknown
`pkg:pypi/colorcet@3.0.1`	35784.35 h	established	unknown
`pkg:pypi/comm@0.1.2`	34203.40 h	established	unknown
`pkg:pypi/conda-content-trust@0.2.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/conda-pack@0.6.0`	48461.71 h	established	unknown
`pkg:pypi/conda-package-handling@2.2.0`	28533.88 h	established	unknown
`pkg:pypi/conda-package-streaming@0.9.0`	28536.78 h	established	unknown
`pkg:pypi/conda-verify@3.4.2`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/constantly@23.10.4`	26416.54 h	established	unknown
`pkg:pypi/contourpy@1.2.0`	26278.91 h	established	unknown
`pkg:pypi/cookiecutter@2.5.0`	25847.15 h	established	unknown
`pkg:pypi/cryptography@42.0.2`	24166.27 h	established	unknown
`pkg:pypi/cssselect@1.2.0`	35210.42 h	established	unknown
`pkg:pypi/cycler@0.11.0`	43932.17 h	established	unknown
`pkg:pypi/cytoolz@0.12.2`	28797.87 h	established	unknown
`pkg:pypi/dask@2023.11.0`	26106.25 h	established	unknown
`pkg:pypi/dask-core@2023.11.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/dataclasses@0.8`	52321.17 h	established	unknown
`pkg:pypi/datashader@0.16.0`	26472.96 h	established	unknown
`pkg:pypi/debugpy@1.6.7`	31362.94 h	established	unknown
`pkg:pypi/decorator@5.1.1`	42247.51 h	established	unknown
`pkg:pypi/defusedxml@0.7.1`	49564.86 h	established	unknown
`pkg:pypi/diff-match-patch@20200713`	55269.65 h	established	unknown
`pkg:pypi/diffusers@0.27.2`	22981.94 h	established	unknown
`pkg:pypi/dill@0.3.7`	28769.54 h	established	unknown
`pkg:pypi/distributed@2023.11.0`	26106.25 h	established	unknown
`pkg:pypi/distro@1.8.0`	35616.34 h	established	unknown
`pkg:pypi/docstring-to-markdown@0.11`	34358.68 h	established	unknown
`pkg:pypi/docutils@0.18.1`	43318.02 h	established	unknown
`pkg:pypi/entrypoints@0.4`	41610.34 h	established	unknown
`pkg:pypi/et-xmlfile@1.1.0`	48386.41 h	established	unknown
`pkg:pypi/executing@0.8.3`	41009.09 h	established	unknown
`pkg:pypi/filelock@3.13.1`	26373.35 h	established	unknown
`pkg:pypi/flask@2.2.5`	30721.14 h	established	unknown
`pkg:pypi/fonttools@4.25.0`	46702.65 h	established	unknown
`pkg:pypi/frozenlist@1.4.0`	29011.09 h	established	unknown
`pkg:pypi/fsspec@2023.10.0`	26590.23 h	established	unknown
`pkg:pypi/future@0.18.3`	33348.59 h	established	unknown
`pkg:pypi/gensim@4.3.0`	33903.53 h	established	unknown
`pkg:pypi/gitdb@4.0.7`	49129.41 h	established	unknown
`pkg:pypi/gitpython@3.1.37`	27296.21 h	established	unknown
`pkg:pypi/gmpy2@2.1.2`	42274.00 h	established	unknown
`pkg:pypi/greenlet@3.0.1`	26500.01 h	established	unknown
`pkg:pypi/h5py@3.9.0`	29550.57 h	established	unknown
`pkg:pypi/heapdict@1.0.1`	62660.90 h	established	unknown
`pkg:pypi/holoviews@1.18.3`	23857.38 h	established	unknown
`pkg:pypi/hvplot@0.9.2`	24191.42 h	established	unknown
`pkg:pypi/hyperlink@21.0.0`	50985.99 h	established	unknown
`pkg:pypi/idna@3.4`	36255.44 h	established	unknown
`pkg:pypi/imagecodecs@2023.1.23`	33103.27 h	established	unknown
`pkg:pypi/imageio@2.33.1`	25381.40 h	established	unknown
`pkg:pypi/imagesize@1.4.1`	38043.50 h	established	unknown
`pkg:pypi/imbalanced-learn@0.11.0`	29106.00 h	established	unknown
`pkg:pypi/importlib-metadata@7.0.1`	25102.56 h	established	unknown
`pkg:pypi/incremental@22.10.0`	35504.15 h	established	unknown
`pkg:pypi/inflection@0.5.1`	54319.57 h	established	unknown
`pkg:pypi/iniconfig@1.1.1`	53045.51 h	established	unknown
`pkg:pypi/intake@0.6.8`	31962.49 h	established	unknown
`pkg:pypi/intervaltree@3.1.0`	54775.83 h	established	unknown
`pkg:pypi/ipykernel@6.28.0`	25008.83 h	established	unknown
`pkg:pypi/ipython@8.20.0`	24701.65 h	established	unknown
`pkg:pypi/ipython-genutils@0.2.0`	84497.64 h	established	unknown
`pkg:pypi/ipywidgets@7.6.5`	45016.16 h	established	unknown
`pkg:pypi/itemadapter@0.3.0`	46466.01 h	established	unknown
`pkg:pypi/itemloaders@1.1.0`	30990.85 h	established	unknown
`pkg:pypi/itsdangerous@2.0.1`	47856.69 h	established	unknown
`pkg:pypi/jaraco-classes@3.2.1`	49917.07 h	established	unknown
`pkg:pypi/jedi@0.18.1`	43479.05 h	established	unknown
`pkg:pypi/jeepney@0.7.1`	46149.56 h	established	unknown
`pkg:pypi/jellyfish@1.0.1`	27376.61 h	established	unknown
`pkg:pypi/jinja2@3.1.3`	24640.64 h	established	unknown
`pkg:pypi/jmespath@1.0.1`	38373.85 h	established	unknown
`pkg:pypi/joblib@1.2.0`	36197.83 h	established	unknown
`pkg:pypi/json5@0.9.6`	47031.42 h	established	unknown
`pkg:pypi/jsonpatch@1.32`	49436.57 h	established	unknown
`pkg:pypi/jsonpointer@2.1`	49436.91 h	established	unknown
`pkg:pypi/jsonschema@4.19.2`	26378.28 h	established	unknown
`pkg:pypi/jsonschema-specifications@2023.7.1`	28872.42 h	established	unknown
`pkg:pypi/jupyter@1.0.0`	98415.13 h	established	unknown
`pkg:pypi/jupyter-lsp@2.2.0`	30096.37 h	established	unknown
`pkg:pypi/jupyter-client@8.6.0`	26210.93 h	established	unknown
`pkg:pypi/jupyter-console@6.6.3`	32089.62 h	established	unknown
`pkg:pypi/jupyter-core@5.5.0`	26380.41 h	established	unknown
`pkg:pypi/jupyter-events@0.8.0`	26717.40 h	established	unknown
`pkg:pypi/jupyter-server@2.10.0`	26210.08 h	established	unknown
`pkg:pypi/jupyter-server-terminals@0.4.4`	33434.98 h	established	unknown
`pkg:pypi/jupyterlab@4.0.11`	24433.72 h	established	unknown
`pkg:pypi/jupyterlab-variableinspector@3.1.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/jupyterlab-pygments@0.1.2`	53406.85 h	established	unknown
`pkg:pypi/jupyterlab-server@2.25.1`	26163.01 h	established	unknown
`pkg:pypi/jupyterlab-widgets@3.0.9`	27511.81 h	established	unknown
`pkg:pypi/keyring@23.13.1`	33955.44 h	established	unknown
`pkg:pypi/kiwisolver@1.4.4`	37699.23 h	established	unknown
`pkg:pypi/lazy-object-proxy@1.6.0`	49218.96 h	established	unknown
`pkg:pypi/lazy-loader@0.3`	29298.63 h	established	unknown
`pkg:pypi/libmambapy@1.5.6`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/linkify-it-py@2.0.0`	39368.84 h	established	unknown
`pkg:pypi/llvmlite@0.42.0`	24136.86 h	established	unknown
`pkg:pypi/locket@1.0.0`	39761.77 h	established	unknown
`pkg:pypi/lxml@4.9.3`	29188.04 h	established	unknown
`pkg:pypi/lz4@4.3.2`	33664.79 h	established	unknown
`pkg:pypi/markdown@3.4.1`	37700.59 h	established	unknown
`pkg:pypi/markdown-it-py@2.2.0`	32385.94 h	established	unknown
`pkg:pypi/markupsafe@2.1.3`	29970.14 h	established	unknown
`pkg:pypi/matplotlib@3.8.0`	27467.03 h	established	unknown
`pkg:pypi/matplotlib-base@3.8.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/matplotlib-inline@0.1.6`	36900.04 h	established	unknown
`pkg:pypi/mccabe@0.7.0`	41846.60 h	established	unknown
`pkg:pypi/mdit-py-plugins@0.3.0`	43087.68 h	established	unknown
`pkg:pypi/mdurl@0.1.0`	45670.70 h	established	unknown
`pkg:pypi/menuinst@2.0.2`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/mistune@2.0.4`	37720.36 h	established	unknown
`pkg:pypi/mkl-service@2.4.0`	47641.29 h	established	unknown
`pkg:pypi/mkl-fft@1.3.8`	22817.29 h	established	unknown
`pkg:pypi/mkl-random@1.2.4`	22817.29 h	established	unknown
`pkg:pypi/more-itertools@10.1.0`	28487.24 h	established	unknown
`pkg:pypi/mpi4py@4.0.3`	15045.25 h	established	unknown
`pkg:pypi/mpmath@1.3.0`	32063.06 h	established	unknown
`pkg:pypi/msgpack-python@1.0.3`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/multidict@6.0.4`	33829.36 h	established	unknown
`pkg:pypi/multipledispatch@0.6.0`	72189.83 h	established	unknown
`pkg:pypi/munkres@1.1.4`	53736.64 h	established	unknown
`pkg:pypi/mypy-extensions@1.0.0`	32811.66 h	established	unknown
`pkg:pypi/nbclient@0.8.0`	30240.78 h	established	unknown
`pkg:pypi/nbconvert@7.10.0`	26379.27 h	established	unknown
`pkg:pypi/nbformat@5.9.2`	28565.26 h	established	unknown
`pkg:pypi/nest-asyncio@1.6.0`	24385.43 h	established	unknown
`pkg:pypi/networkx@3.1`	31387.72 h	established	unknown
`pkg:pypi/nltk@3.8.1`	33600.23 h	established	unknown
`pkg:pypi/notebook@7.0.8`	23926.14 h	established	unknown
`pkg:pypi/notebook-shim@0.2.3`	30910.74 h	established	unknown
`pkg:pypi/numba@0.59.0`	24136.79 h	established	unknown
`pkg:pypi/numexpr@2.8.7`	27198.93 h	established	unknown
`pkg:pypi/numpy-base@1.26.4`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/numpydoc@1.5.0`	35665.67 h	established	unknown
`pkg:pypi/openpyxl@3.0.10`	39072.13 h	established	unknown
`pkg:pypi/overrides@7.4.0`	28418.08 h	established	unknown
`pkg:pypi/pandas@2.1.4`	25440.23 h	established	unknown
`pkg:pypi/pandocfilters@1.5.0`	45012.22 h	established	unknown
`pkg:pypi/panel@1.3.8`	24310.16 h	established	unknown
`pkg:pypi/param@2.0.2`	24480.97 h	established	unknown
`pkg:pypi/parsel@1.8.1`	31058.17 h	established	unknown
`pkg:pypi/parso@0.8.3`	43146.75 h	established	unknown
`pkg:pypi/partd@1.4.1`	27213.32 h	established	unknown
`pkg:pypi/pathlib@1.0.1`	106632.15 h	established	unknown
`pkg:pypi/pathspec@0.10.3`	34163.03 h	established	unknown
`pkg:pypi/patsy@0.5.3`	35635.39 h	established	unknown
`pkg:pypi/pexpect@4.8.0`	59447.23 h	established	unknown
`pkg:pypi/pickleshare@0.7.5`	71036.55 h	established	unknown
`pkg:pypi/pkce@1.0.3`	50229.36 h	established	unknown
`pkg:pypi/pkginfo@1.9.6`	33455.04 h	established	unknown
`pkg:pypi/platformdirs@3.10.0`	28608.77 h	established	unknown
`pkg:pypi/plotly@5.9.0`	38222.72 h	established	unknown
`pkg:pypi/pluggy@1.0.0`	45479.41 h	established	unknown
`pkg:pypi/ply@3.11`	76364.82 h	established	unknown
`pkg:pypi/prometheus-client@0.14.1`	40055.73 h	established	unknown
`pkg:pypi/prompt-toolkit@3.0.43`	25327.11 h	established	unknown
`pkg:pypi/protego@0.1.16`	60483.68 h	established	unknown
`pkg:pypi/psutil@5.9.0`	42450.41 h	established	unknown
`pkg:pypi/ptyprocess@0.7.0`	51240.59 h	established	unknown
`pkg:pypi/pure-eval@0.2.2`	41880.16 h	established	unknown
`pkg:pypi/py-cpuinfo@9.0.0`	35251.21 h	established	unknown
`pkg:pypi/py-lief@0.12.3`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/pyarrow@14.0.2`	25200.18 h	established	unknown
`pkg:pypi/pyasn1@0.4.8`	61030.40 h	established	unknown
`pkg:pypi/pyasn1-modules@0.2.8`	59734.45 h	established	unknown
`pkg:pypi/pycodestyle@2.10.0`	34557.39 h	established	unknown
`pkg:pypi/pycosat@0.6.6`	27024.08 h	established	unknown
`pkg:pypi/pycparser@2.21`	43731.04 h	established	unknown
`pkg:pypi/pyct@0.5.0`	32932.66 h	established	unknown
`pkg:pypi/pycurl@7.45.2`	34004.11 h	established	unknown
`pkg:pypi/pydantic@1.10.12`	28722.12 h	established	unknown
`pkg:pypi/pydeck@0.8.0`	35017.46 h	established	unknown
`pkg:pypi/pydispatcher@2.0.5`	103427.53 h	established	unknown
`pkg:pypi/pydocstyle@6.3.0`	33235.36 h	established	unknown
`pkg:pypi/pyerfa@2.0.0`	47880.23 h	established	unknown
`pkg:pypi/pyflakes@3.0.1`	34534.95 h	established	unknown
`pkg:pypi/pygments@2.15.1`	31053.03 h	established	unknown
`pkg:pypi/pyjwt@2.4.0`	39236.88 h	established	unknown
`pkg:pypi/pylint-venv@2.3.0`	38207.70 h	established	unknown
`pkg:pypi/pyls-spyder@0.4.0`	48307.61 h	established	unknown
`pkg:pypi/pyodbc@5.0.1`	26782.72 h	established	unknown
`pkg:pypi/pyopenssl@24.0.0`	24350.12 h	established	unknown
`pkg:pypi/pyparsing@3.0.9`	39280.41 h	established	unknown
`pkg:pypi/pyqt@5.15.10`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/pyqt5-sip@12.13.0`	26765.50 h	established	unknown
`pkg:pypi/pyqtwebengine@5.15.10`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/pysocks@1.7.1`	62413.74 h	established	unknown
`pkg:pypi/pytables@3.9.2`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/python-dateutil@2.8.2`	46495.53 h	established	unknown
`pkg:pypi/python-dotenv@0.21.0`	36504.58 h	established	unknown
`pkg:pypi/python-fastjsonschema@2.16.2`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/python-json-logger@2.0.7`	32398.18 h	established	unknown
`pkg:pypi/python-libarchive-c@2.9`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/python-lmdb@1.4.1`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/python-lsp-black@1.2.1`	39963.64 h	established	unknown
`pkg:pypi/python-lsp-jsonrpc@1.0.0`	48666.53 h	established	unknown
`pkg:pypi/python-lsp-server@1.7.2`	31430.48 h	established	unknown
`pkg:pypi/python-slugify@5.0.2`	48160.19 h	established	unknown
`pkg:pypi/python-snappy@0.6.1`	41135.97 h	established	unknown
`pkg:pypi/python-tzdata@2023.3`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/pytoolconfig@1.2.6`	26753.84 h	established	unknown
`pkg:pypi/torch@2.2.1`	23612.61 h	established	unknown
`pkg:pypi/pytz@2023.3.post1`	27709.90 h	established	unknown
`pkg:pypi/pyviz-comms@3.0.0`	28174.50 h	established	unknown
`pkg:pypi/pywavelets@1.5.0`	25937.00 h	established	unknown
`pkg:pypi/pyxdg@0.27`	52944.94 h	established	unknown
`pkg:pypi/pyzmq@25.1.2`	25520.27 h	established	unknown
`pkg:pypi/qdarkstyle@3.0.2`	48984.22 h	established	unknown
`pkg:pypi/qstylizer@0.2.2`	36503.64 h	established	unknown
`pkg:pypi/qtawesome@1.2.2`	33736.58 h	established	unknown
`pkg:pypi/qtconsole@5.4.2`	31434.53 h	established	unknown
`pkg:pypi/qtpy@2.4.1`	26535.96 h	established	unknown
`pkg:pypi/queuelib@1.6.2`	45458.15 h	established	unknown
`pkg:pypi/referencing@0.30.2`	28447.65 h	established	unknown
`pkg:pypi/regex@2023.10.3`	27023.29 h	established	unknown
`pkg:pypi/requests@2.31.0`	30240.64 h	established	unknown
`pkg:pypi/requests-file@1.5.1`	57169.89 h	established	unknown
`pkg:pypi/requests-toolbelt@1.0.0`	30755.66 h	established	unknown
`pkg:pypi/rfc3339-validator@0.1.4`	47999.22 h	established	unknown
`pkg:pypi/rfc3986-validator@0.1.1`	61487.84 h	established	unknown
`pkg:pypi/rich@13.3.5`	30841.57 h	established	unknown
`pkg:pypi/rope@1.7.0`	33253.22 h	established	unknown
`pkg:pypi/rpds-py@0.10.6`	26830.49 h	established	unknown
`pkg:pypi/rtree@1.0.1`	35588.36 h	established	unknown
`pkg:pypi/ruamel-yaml@0.17.21`	41382.95 h	established	unknown
`pkg:pypi/s3fs@2023.10.0`	26589.93 h	established	unknown
`pkg:pypi/safetensors@0.4.2`	24342.70 h	established	unknown
`pkg:pypi/scikit-learn@1.2.2`	32021.90 h	established	unknown
`pkg:pypi/scrapy@2.8.0`	32866.93 h	established	unknown
`pkg:pypi/seaborn@0.13.2`	24290.48 h	established	unknown
`pkg:pypi/secretstorage@3.3.1`	50211.80 h	established	unknown
`pkg:pypi/semver@2.13.0`	52891.57 h	established	unknown
`pkg:pypi/send2trash@1.8.2`	30850.32 h	established	unknown
`pkg:pypi/service-identity@18.1.0`	69339.00 h	established	unknown
`pkg:pypi/sip@6.7.12`	26765.39 h	established	unknown
`pkg:pypi/six@1.16.0`	48169.54 h	established	unknown
`pkg:pypi/smart-open@5.2.1`	45412.74 h	established	unknown
`pkg:pypi/smmap@4.0.0`	50547.97 h	established	unknown
`pkg:pypi/sniffio@1.3.0`	36555.32 h	established	unknown
`pkg:pypi/snowballstemmer@2.2.0`	43485.21 h	established	unknown
`pkg:pypi/sortedcontainers@2.4.0`	47897.79 h	established	unknown
`pkg:pypi/soupsieve@2.5`	27771.04 h	established	unknown
`pkg:pypi/sphinxcontrib-applehelp@1.0.2`	58523.63 h	established	unknown
`pkg:pypi/sphinxcontrib-devhelp@1.0.2`	58523.60 h	established	unknown
`pkg:pypi/sphinxcontrib-htmlhelp@2.0.0`	47759.81 h	established	unknown
`pkg:pypi/sphinxcontrib-jsmath@1.0.1`	68207.68 h	established	unknown
`pkg:pypi/sphinxcontrib-qthelp@1.0.3`	58523.53 h	established	unknown
`pkg:pypi/sphinxcontrib-serializinghtml@1.1.5`	47759.72 h	established	unknown
`pkg:pypi/spyder@5.4.3`	31381.22 h	established	unknown
`pkg:pypi/spyder-kernels@2.4.4`	29328.58 h	established	unknown
`pkg:pypi/sqlalchemy@2.0.25`	24829.48 h	established	unknown
`pkg:pypi/stack-data@0.2.0`	41324.98 h	established	unknown
`pkg:pypi/statsmodels@0.14.0`	30652.25 h	established	unknown
`pkg:pypi/streamlit@1.30.0`	24621.00 h	established	unknown
`pkg:pypi/sympy@1.12`	30525.48 h	established	unknown
`pkg:pypi/tabulate@0.9.0`	35710.49 h	established	unknown
`pkg:pypi/tblib@1.7.0`	55024.55 h	established	unknown
`pkg:pypi/tenacity@8.2.2`	32233.48 h	established	unknown
`pkg:pypi/terminado@0.17.1`	34276.44 h	established	unknown
`pkg:pypi/text-unidecode@1.3`	62898.24 h	established	unknown
`pkg:pypi/textdistance@4.2.1`	50478.79 h	established	unknown
`pkg:pypi/threadpoolctl@2.2.0`	46608.64 h	established	unknown
`pkg:pypi/three-merge@0.1.1`	55048.15 h	established	unknown
`pkg:pypi/tifffile@2023.4.12`	31191.63 h	established	unknown
`pkg:pypi/tinycss2@1.2.1`	35432.77 h	established	unknown
`pkg:pypi/tldextract@3.2.0`	41174.35 h	established	unknown
`pkg:pypi/toml@0.10.2`	52622.18 h	established	unknown
`pkg:pypi/tomlkit@0.11.1`	37909.07 h	established	unknown
`pkg:pypi/toolz@0.12.0`	37835.35 h	established	unknown
`pkg:pypi/torchaudio@2.2.1`	23612.51 h	established	unknown
`pkg:pypi/torchtriton@2.2.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/torchvision@0.17.1`	23612.53 h	established	unknown
`pkg:pypi/tornado@6.3.3`	28296.48 h	established	unknown
`pkg:pypi/traitlets@5.7.1`	34103.50 h	established	unknown
`pkg:pypi/truststore@0.8.0`	27635.63 h	established	unknown
`pkg:pypi/twisted@23.10.0`	26359.67 h	established	unknown
`pkg:pypi/typing-extensions@4.9.0`	25406.61 h	established	unknown
`pkg:pypi/tzlocal@2.1`	56865.80 h	established	unknown
`pkg:pypi/uc-micro-py@1.0.1`	51555.91 h	established	unknown
`pkg:pypi/ujson@5.4.0`	38026.38 h	established	unknown
`pkg:pypi/unidecode@1.2.0`	50307.99 h	established	unknown
`pkg:pypi/urllib3@2.0.7`	26686.07 h	established	unknown
`pkg:pypi/validators@0.18.2`	51485.39 h	established	unknown
`pkg:pypi/w3lib@2.1.2`	28495.05 h	established	unknown
`pkg:pypi/watchdog@2.1.6`	44588.32 h	established	unknown
`pkg:pypi/wcwidth@0.2.5`	55751.67 h	established	unknown
`pkg:pypi/webencodings@0.5.1`	83947.49 h	established	unknown
`pkg:pypi/websocket-client@0.58.0`	49693.31 h	established	unknown
`pkg:pypi/werkzeug@2.2.3`	32566.54 h	established	unknown
`pkg:pypi/whatthepatch@1.0.2`	50292.83 h	established	unknown
`pkg:pypi/widgetsnbextension@3.5.2`	43939.13 h	established	unknown
`pkg:pypi/wrapt@1.14.1`	39490.41 h	established	unknown
`pkg:pypi/wurlitzer@3.0.2`	45487.86 h	established	unknown
`pkg:pypi/xarray@2023.6.0`	29466.52 h	established	unknown
`pkg:pypi/xyzservices@2022.9.0`	36120.65 h	established	unknown
`pkg:pypi/yapf@0.31.0`	49458.09 h	established	unknown
`pkg:pypi/yarl@1.9.3`	25865.83 h	established	unknown
`pkg:pypi/zict@3.0.0`	31074.16 h	established	unknown
`pkg:pypi/zipp@3.17.0`	27384.54 h	established	unknown
`pkg:pypi/zope@1.0`	Not evaluated	unknown	unknown	Info: not_evaluated: Registry publication evidence not evaluated
`pkg:pypi/zope-interface@5.4.0`	48653.95 h	established	unknown
`pkg:pypi/zstandard@0.19.0`	35150.64 h	established	unknown
`pkg:pypi/sphinxcontrib-jquery@4.1`	31896.83 h	established	unknown
`pkg:pypi/latexcodec@3.0.1`	12069.06 h	established	unknown

Mythos readiness

99.1%
Fix available

196
Fix age over 180 days

262
Dormant

853
Response window overdue

5
Severity disagreement

88
Fix status unknown

Fix Backlog

99.1% of 947 open findings have a fix. Unknown: 88. No fix available: 8.

0-30
63

31-90
56

91-180
107

180+
196

Top 10 oldest fixable findings

CVE	Component	Recommended	Major bump	Age bucket	Age days	Risk
`CVE-2021-32674`	`pkg:pypi/zope@1.0`	4.6.1	Yes	180+	1974	100
`CVE-2023-30798`	`pkg:pypi/starlette@0.22.0`	0.25.0	No	180+	1357	100
`CVE-2024-5452`	`pkg:pypi/lightning@1.9.0`	2.3.3	Yes	180+	847	100
`CVE-2024-5980`	`pkg:pypi/lightning@1.9.0`	2.3.3	Yes	180+	847	100
`CVE-2024-52338`	`pkg:pypi/pyarrow@14.0.2`	17.0.0	Yes	180+	839	100
`CVE-2024-8019`	`pkg:pypi/pytorch-lightning@2.2.1`	2.4.0	No	180+	817	100
`CVE-2024-43805`	`pkg:pypi/jupyterlab@4.0.11`	4.2.5	No	180+	798	100
`CVE-2024-43805`	`pkg:pypi/notebook@7.0.8`	7.2.2	No	180+	797	100
`CVE-2024-47874`	`pkg:pypi/starlette@0.22.0`	0.40.0	No	180+	749	100
`CVE-2024-48063`	`pkg:pypi/torch@2.2.1`	2.5.0	No	180+	746	100

One upgrade fixes N findings

Component	Recommended version	Findings fixed
`pkg:generic/hdf5@1.12.1`	1.14.4	35
`pkg:pypi/pillow@10.2.0`	13.0.0	35
`pkg:generic/python@3.11.7`	3.11.16	23
`pkg:pypi/nltk@3.8.1`	3.10.0	15
`pkg:pypi/nltk@3.8.1`	3.10.3	15
`pkg:generic/curl@8.5.0`	8.14.3	13
`pkg:github/libexpat/libexpat@2.5.0`	2.8.2	13
`pkg:pypi/pillow@10.2.0`	12.3.0	12
`pkg:github/gstreamer/gstreamer@1.14.1`	1.28.1	11
`pkg:pypi/mistune@2.0.4`	3.3.0	11
`pkg:generic/openssl@3.0.18`	3.0.21	10
`pkg:pypi/aiohttp@3.9.3`	3.13.4	10
`pkg:generic/curl@8.5.0`	8.21.0	9
`pkg:generic/python@3.11.7`	3.11.15	9
`pkg:generic/ffmpeg@4.3`	4.3.9	8
`pkg:generic/libevent@2.1.12`	2.1.13	8
`pkg:generic/libxml2@2.10.4`	2.15.4	8
`pkg:generic/openssl@3.0.18`	3.0.19	8
`pkg:generic/python@3.11.7`	3.11.10	8
`pkg:generic/python@3.11.7`	3.11.17	8
`pkg:pypi/aiohttp@3.9.3`	3.13.3	8
`pkg:pypi/aiohttp@3.9.3`	3.14.1	8
`pkg:pypi/aiohttp@3.9.3`	3.14.4	8
`pkg:generic/curl@8.5.0`	8.20.0	7
`pkg:github/gstreamer/gstreamer@1.14.1`	1.20.3	7
`pkg:pypi/pyjwt@2.4.0`	2.14.0	7
`pkg:pypi/twisted@23.10.0`	26.10.0rc1	7
`pkg:generic/curl@8.5.0`	8.14.2	6
`pkg:generic/openssl@3.0.18`	3.0.20	6
`pkg:generic/openssl@3.0.18`	3.0.23	6
`pkg:generic/python@3.11.7`	3.11.13	6
`pkg:pypi/gitpython@3.1.37`	3.1.58	6
`pkg:pypi/gitpython@3.1.37`	3.2.0	6
`pkg:pypi/nltk@3.8.1`	3.9.3	6
`pkg:pypi/nltk@3.8.1`	3.9.4	6
`pkg:generic/curl@8.5.0`	8.18.0	5
`pkg:generic/ffmpeg@4.3`	4.3.7	5
`pkg:generic/libarchive@3.6.2`	3.8.0	5
`pkg:generic/openssl@3.0.18`	3.0.22	5
`pkg:generic/pcre2@10.42`	10.48	5
`pkg:github/gstreamer/gstreamer@1.14.1`	1.28.5	5
`pkg:pypi/gitpython@3.1.37`	3.1.59	5
`pkg:pypi/mistune@2.0.4`	3.2.1	5
`pkg:generic/ffmpeg@4.3`	9	4
`pkg:generic/ffmpeg@4.3`	9.0	4
`pkg:generic/hdf5@1.12.1`	2.0.0	4
`pkg:generic/libpng@1.6.39`	1.6.51	4
`pkg:generic/libtiff@4.5.1`	4.6.0	4
`pkg:generic/libxml2@2.10.4`	2.15.2	4
`pkg:github/gstreamer/gstreamer@1.14.1`	1.26.2	4
`pkg:pypi/jupyter-server@2.10.0`	2.18.0	4
`pkg:pypi/pyasn1@0.4.8`	0.6.5	4
`pkg:pypi/torch@2.2.1`	2.7.1	4
`pkg:pypi/transformers@4.39.3`	4.48.0	4
`pkg:pypi/transformers@4.39.3`	4.53.0	4
`pkg:generic/curl@8.5.0`	8.19.0	3
`pkg:generic/curl@8.5.0`	8.7.0	3
`pkg:generic/ffmpeg@4.3`	8.1.3	3
`pkg:generic/libarchive@3.6.2`	3.8.7	3
`pkg:generic/libglib@2.78.4`	2.86.3	3
`pkg:generic/libglib@2.78.4`	2.86.5	3
`pkg:generic/libglib@2.78.4`	2.88.1	3
`pkg:generic/libtiff@4.5.1`	4.7.0	3
`pkg:generic/libtiff@4.5.1`	4.7.1	3
`pkg:generic/libxml2@2.10.4`	2.12.10	3
`pkg:generic/libxml2@2.10.4`	2.13.9	3
`pkg:generic/python@3.11.7`	3.11.14	3
`pkg:generic/python@3.11.7`	3.11.18	3
`pkg:github/gstreamer/gstreamer@1.14.1`	1.18.4	3
`pkg:github/libexpat/libexpat@2.5.0`	2.6.3	3
`pkg:github/libexpat/libexpat@2.5.0`	2.7.5	3
`pkg:pypi/aiohttp@3.9.3`	3.14.0	3
`pkg:pypi/diffusers@0.27.2`	0.38.0	3
`pkg:pypi/gitpython@3.1.37`	3.1.54	3
`pkg:pypi/jupyterlab@4.0.11`	4.5.10	3
`pkg:pypi/jupyterlab@4.0.11`	4.5.7	3
`pkg:pypi/pyasn1@0.4.8`	0.6.4	3
`pkg:pypi/pyjwt@2.4.0`	2.13.0	3
`pkg:pypi/python-multipart@0.0.9`	0.0.30	3
`pkg:pypi/scrapy@2.8.0`	2.11.1	3
`pkg:pypi/scrapy@2.8.0`	2.11.2	3
`pkg:pypi/torch@2.2.1`	2.9.0	3
`pkg:pypi/tornado@6.3.3`	6.5.3	3
`pkg:pypi/tornado@6.3.3`	6.5.5	3
`pkg:pypi/tornado@6.3.3`	6.5.6	3
`pkg:pypi/tornado@6.3.3`	6.5.9	3
`pkg:pypi/tornado@6.3.3`	6.6	3
`pkg:generic/c-ares@1.19.1`	1.34.7	2
`pkg:generic/curl@8.5.0`	8.12.0	2
`pkg:generic/curl@8.5.0`	8.16.0	2
`pkg:generic/ffmpeg@4.3`	5.0.3	2
`pkg:generic/ffmpeg@4.3`	7.1.2	2
`pkg:generic/ffmpeg@4.3`	8.0	2
`pkg:generic/ffmpeg@4.3`	8.1	2
`pkg:generic/hdf5@1.12.1`	2.2.0	2
`pkg:generic/libarchive@3.6.2`	3.7.4	2
`pkg:generic/libarchive@3.6.2`	3.7.5	2
`pkg:generic/libpng@1.6.39`	1.6.54	2
`pkg:generic/libpng@1.6.39`	1.6.56	2
`pkg:generic/libxml2@2.10.4`	2.13.8	2
`pkg:generic/python@3.11.7`	3.11.11	2
`pkg:generic/python@3.11.7`	3.11.8	2
`pkg:generic/python@3.11.7`	3.11.9	2
`pkg:generic/python@3.11.7`	3.13.13	2
`pkg:generic/sqlite@3.41.2`	3.53.2	2
`pkg:github/libexpat/libexpat@2.5.0`	2.7.4	2
`pkg:github/libexpat/libexpat@2.5.0`	2.8.4	2
`pkg:pypi/aiohttp@3.9.3`	3.14.2	2
`pkg:pypi/aiohttp@3.9.3`	3.9.4	2
`pkg:pypi/anyio@4.2.0`	4.14.2	2
`pkg:pypi/bleach@4.1.0`	6.4.0	2
`pkg:pypi/cryptography@42.0.2`	49.0.0	2
`pkg:pypi/filelock@3.13.1`	4.2.1	2
`pkg:pypi/gitpython@3.1.37`	3.1.47	2
`pkg:pypi/gitpython@3.1.37`	3.1.51	2
`pkg:pypi/gitpython@3.1.37`	3.1.57	2
`pkg:pypi/gitpython@3.1.37`	3.1.60	2
`pkg:pypi/imagecodecs@2023.1.23`	2023.9.18	2
`pkg:pypi/jinja2@3.1.3`	3.1.5	2
`pkg:pypi/jupyterlab@4.0.11`	4.5.11	2
`pkg:pypi/lightning@1.9.0`	2.3.3	2
`pkg:pypi/nbconvert@7.10.0`	7.17.1	2
`pkg:pypi/notebook@7.0.8`	7.5.6	2
`pkg:pypi/pillow@10.2.0`	12.2.0	2
`pkg:pypi/pyjwt@2.4.0`	2.15.0	2
`pkg:pypi/pyopenssl@24.0.0`	26.0.0	2
`pkg:pypi/soupsieve@2.5`	2.8.4	2
`pkg:pypi/soupsieve@2.5`	2.9.0	2
`pkg:pypi/starlette@0.22.0`	1.1.0	2
`pkg:pypi/torch@2.2.1`	2.10.0	2
`pkg:pypi/tornado@6.3.3`	6.4.1	2
`pkg:pypi/tornado@6.3.3`	6.5.8	2
`pkg:pypi/transformers@4.39.3`	4.51.0	2
`pkg:pypi/transformers@4.39.3`	4.52.1	2
`pkg:pypi/twisted@23.10.0`	24.7.0rc1	2
`pkg:pypi/ujson@5.4.0`	5.12.0	2
`pkg:pypi/urllib3@2.0.7`	2.6.0	2
`pkg:pypi/urllib3@2.0.7`	2.8.0	2
`pkg:pypi/werkzeug@2.2.3`	3.0.6	2
`pkg:generic/brotli@1.0.9`	1.0.10	1
`pkg:generic/c-ares@1.19.1`	1.27.0	1
`pkg:generic/curl@8.5.0`	8.10.0	1
`pkg:generic/curl@8.5.0`	8.11.0	1
`pkg:generic/curl@8.5.0`	8.11.1	1
`pkg:generic/curl@8.5.0`	8.14.0	1
`pkg:generic/curl@8.5.0`	8.6.0	1
`pkg:generic/curl@8.5.0`	8.9.1	1
`pkg:generic/dav1d@1.2.1`	1.4.0	1
`pkg:generic/ffmpeg@4.3`	4.3.1	1
`pkg:generic/ffmpeg@4.3`	4.3.3	1
`pkg:generic/ffmpeg@4.3`	4.3.8	1
`pkg:generic/ffmpeg@4.3`	4.4.2	1
`pkg:generic/ffmpeg@4.3`	5.0	1
`pkg:generic/ffmpeg@4.3`	5.1.2	1
`pkg:generic/ffmpeg@4.3`	5.1.6	1
`pkg:generic/ffmpeg@4.3`	7.1.4	1
`pkg:generic/ffmpeg@4.3`	8.1.2	1
`pkg:generic/hdf5@1.12.1`	1.14.4.2	1
`pkg:generic/hdf5@1.12.1`	1.14.6	1
`pkg:generic/hdf5@1.12.1`	2.1.1	1
`pkg:generic/libevent@2.1.12`	2.2.2-alpha	1
`pkg:generic/libglib@2.78.4`	2.78.5	1
`pkg:generic/libglib@2.78.4`	2.82.1	1
`pkg:generic/libglib@2.78.4`	2.82.5	1
`pkg:generic/libglib@2.78.4`	2.84.1	1
`pkg:generic/libglib@2.78.4`	2.84.3	1
`pkg:generic/libglib@2.78.4`	2.89.0	1
`pkg:generic/libjpeg-turbo@2.0.0`	2.0.4	1
`pkg:generic/libpng@1.6.39`	1.6.52	1
`pkg:generic/libpng@1.6.39`	1.6.55	1
`pkg:generic/libpng@1.6.39`	1.6.57	1
`pkg:generic/libprotobuf@3.20.3`	3.25.5	1
`pkg:generic/libprotobuf@3.20.3`	5.29.6	1
`pkg:generic/libssh2@1.10.0`	1.11.1	1
`pkg:generic/libtiff@4.5.1`	4.7.2	1
`pkg:generic/libxml2@2.10.4`	2.11.0	1
`pkg:generic/libxml2@2.10.4`	2.11.7	1
`pkg:generic/libxml2@2.10.4`	2.11.8	1
`pkg:generic/libxml2@2.10.4`	2.14.4	1
`pkg:generic/libxml2@2.10.4`	2.14.5	1
`pkg:generic/libxml2@2.10.4`	2.14.6	1
`pkg:generic/openh264@2.1.1`	2.6.0	1
`pkg:generic/python@3.11.7`	3.11.12	1
`pkg:generic/python@3.11.7`	3.12.15	1
`pkg:generic/python@3.11.7`	3.13.10	1
`pkg:generic/python@3.11.7`	3.13.14	1
`pkg:generic/python@3.11.7`	3.13.15	1
`pkg:generic/python@3.11.7`	3.15.0a6	1
`pkg:generic/python@3.11.7`	3.16.0	1
`pkg:generic/sqlite@3.41.2`	3.50.2	1
`pkg:generic/sqlite@3.41.2`	3.51.1	1
`pkg:generic/unixodbc@2.3.11`	2.3.13	1
`pkg:generic/zlib@1.2.13`	1.3.2	1
`pkg:github/gstreamer/gstreamer@1.14.1`	1.16.0	1
`pkg:github/gstreamer/gstreamer@1.14.1`	1.22.8	1
`pkg:github/gstreamer/gstreamer@1.14.1`	1.25.1	1
`pkg:github/gstreamer/gstreamer@1.14.1`	1.26.1	1
`pkg:github/gstreamer/gstreamer@1.14.1`	1.28.6	1
`pkg:github/libexpat/libexpat@2.5.0`	2.6.2	1
`pkg:github/libexpat/libexpat@2.5.0`	2.6.4	1
`pkg:github/libexpat/libexpat@2.5.0`	2.7.0	1
`pkg:github/libexpat/libexpat@2.5.0`	2.7.2	1
`pkg:github/libexpat/libexpat@2.5.0`	2.8.0	1
`pkg:github/libexpat/libexpat@2.5.0`	2.8.1	1
`pkg:github/libexpat/libexpat@2.5.0`	2.8.5	1
`pkg:github/libexpat/libexpat@2.5.0`	2.9.0	1
`pkg:github/libexpat/libexpat@2.5.0`	621cb2c78b253ee023a86bc91d6ddb048481c04c	1
`pkg:github/libexpat/libexpat@2.5.0`	7b0d50e4b1d16fafd55876260701e04279a7489d	1
`pkg:github/libexpat/libexpat@2.5.0`	92810461043fce37e70079b37ab1f04490a8f039	1
`pkg:pypi/aiohttp@3.9.3`	3.10.11	1
`pkg:pypi/aiohttp@3.9.3`	3.12.14	1
`pkg:pypi/aiohttp@3.9.3`	3.14.3	1
`pkg:pypi/bokeh@3.3.4`	3.8.2	1
`pkg:pypi/certifi@2026.01.04`	2026.10.18	1
`pkg:pypi/cryptography@42.0.2`	42.0.4	1
`pkg:pypi/cryptography@42.0.2`	43.0.1	1
`pkg:pypi/cryptography@42.0.2`	44.0.1	1
`pkg:pypi/cryptography@42.0.2`	46.0.5	1
`pkg:pypi/cryptography@42.0.2`	46.0.6	1
`pkg:pypi/cryptography@42.0.2`	48.0.1	1
`pkg:pypi/deepdiff@6.7.1`	8.6.1	1
`pkg:pypi/deepdiff@6.7.1`	8.6.2	1
`pkg:pypi/distributed@2023.11.0`	2026.1.0	1
`pkg:pypi/fastapi@0.88.0`	0.109.1	1
`pkg:pypi/filelock@3.13.1`	3.20.1	1
`pkg:pypi/filelock@3.13.1`	3.20.3	1
`pkg:pypi/flask@2.2.5`	3.1.3	1
`pkg:pypi/fsspec@2023.10.0`	2026.6.0	1
`pkg:pypi/gitpython@3.1.37`	3.1.41	1
`pkg:pypi/gitpython@3.1.37`	3.1.48	1
`pkg:pypi/gitpython@3.1.37`	3.1.49	1
`pkg:pypi/gitpython@3.1.37`	3.1.50	1
`pkg:pypi/gitpython@3.1.37`	3.1.52	1
`pkg:pypi/gitpython@3.1.37`	3.1.53	1
`pkg:pypi/gitpython@3.1.37`	3.1.55	1
`pkg:pypi/gitpython@3.1.37`	3.1.56	1
`pkg:pypi/gitpython@3.1.37`	3.1.62	1
`pkg:pypi/gitpython@3.1.37`	3.2.1	1
`pkg:pypi/h11@0.14.0`	0.16.0	1
`pkg:pypi/idna@3.4`	3.15	1
`pkg:pypi/idna@3.4`	3.7	1
`pkg:pypi/intake@0.6.8`	2.0.9	1
`pkg:pypi/jinja2@3.1.3`	3.1.4	1
`pkg:pypi/jinja2@3.1.3`	3.1.6	1
`pkg:pypi/jupyter-core@5.5.0`	5.8.1	1
`pkg:pypi/jupyter-lsp@2.2.0`	2.2.2	1
`pkg:pypi/jupyter-server@2.10.0`	2.11.2	1
`pkg:pypi/jupyter-server@2.10.0`	2.14.1	1
`pkg:pypi/jupyter-server@2.10.0`	2.18.2	1
`pkg:pypi/jupyter-server@2.10.0`	2.20.0	1
`pkg:pypi/jupyter-server@2.10.0`	2.21.0	1
`pkg:pypi/jupyterlab@4.0.11`	4.2.5	1
`pkg:pypi/jupyterlab@4.0.11`	4.3.0	1
`pkg:pypi/jupyterlab@4.0.11`	4.4.8	1
`pkg:pypi/jupyterlab@4.0.11`	4.5.9	1
`pkg:pypi/lightning@1.9.0`	2.6.6	1
`pkg:pypi/lxml@4.9.3`	6.1.0	1
`pkg:pypi/markdown@3.4.1`	3.8.1	1
`pkg:pypi/nbconvert@7.10.0`	7.17.0	1
`pkg:pypi/nbconvert@7.10.0`	7.17.2	1
`pkg:pypi/nltk@3.8.1`	3.10.1	1
`pkg:pypi/nltk@3.8.1`	3.10.4	1
`pkg:pypi/nltk@3.8.1`	3.9	1
`pkg:pypi/notebook@7.0.8`	7.2.2	1
`pkg:pypi/pillow@10.2.0`	10.3.0	1
`pkg:pypi/protego@0.1.16`	0.6.2	1
`pkg:pypi/pyarrow@14.0.2`	17.0.0	1
`pkg:pypi/pyasn1@0.4.8`	0.6.3	1
`pkg:pypi/pydantic@1.10.12`	1.10.13	1
`pkg:pypi/pygments@2.15.1`	2.20.0	1
`pkg:pypi/pyjwt@2.4.0`	2.12.0	1
`pkg:pypi/python-dotenv@0.21.0`	1.2.2	1
`pkg:pypi/python-multipart@0.0.9`	0.0.18	1
`pkg:pypi/python-multipart@0.0.9`	0.0.22	1
`pkg:pypi/python-multipart@0.0.9`	0.0.26	1
`pkg:pypi/python-multipart@0.0.9`	0.0.27	1
`pkg:pypi/python-multipart@0.0.9`	0.0.31	1
`pkg:pypi/pytorch-lightning@2.2.1`	2.4.0	1
`pkg:pypi/requests@2.31.0`	2.32.2	1
`pkg:pypi/requests@2.31.0`	2.32.4	1
`pkg:pypi/requests@2.31.0`	2.33.0	1
`pkg:pypi/scikit-learn@1.2.2`	1.5.0	1
`pkg:pypi/scrapy@2.8.0`	2.13.4	1
`pkg:pypi/scrapy@2.8.0`	2.14.2	1
`pkg:pypi/scrapy@2.8.0`	2.17	1
`pkg:pypi/starlette@0.22.0`	0.25.0	1
`pkg:pypi/starlette@0.22.0`	0.27.0	1
`pkg:pypi/starlette@0.22.0`	0.40.0	1
`pkg:pypi/starlette@0.22.0`	0.47.2	1
`pkg:pypi/starlette@0.22.0`	1.0.1	1
`pkg:pypi/starlette@0.22.0`	1.3.0	1
`pkg:pypi/starlette@0.22.0`	1.3.1	1
`pkg:pypi/streamlit@1.30.0`	1.37.0	1
`pkg:pypi/streamlit@1.30.0`	1.53.1	1
`pkg:pypi/streamlit@1.30.0`	1.54.0	1
`pkg:pypi/torch@2.2.1`	2.13.0	1
`pkg:pypi/torch@2.2.1`	2.5.0	1
`pkg:pypi/torch@2.2.1`	2.6.0	1
`pkg:pypi/torch@2.2.1`	2.7.0	1
`pkg:pypi/torch@2.2.1`	2.7.1-rc1	1
`pkg:pypi/torch@2.2.1`	2.8.0	1
`pkg:pypi/torch@2.2.1`	2.9.1	1
`pkg:pypi/tornado@6.3.3`	6.4.2	1
`pkg:pypi/tornado@6.3.3`	6.5	1
`pkg:pypi/tornado@6.3.3`	6.5.7	1
`pkg:pypi/tqdm@4.65.0`	4.66.3	1
`pkg:pypi/transformers@4.39.3`	4.49.0	1
`pkg:pypi/transformers@4.39.3`	4.50.0	1
`pkg:pypi/transformers@4.39.3`	5.0.0rc3	1
`pkg:pypi/transformers@4.39.3`	5.10.1	1
`pkg:pypi/transformers@4.39.3`	5.3.0	1
`pkg:pypi/transformers@4.39.3`	5.5.0	1
`pkg:pypi/twisted@23.10.0`	26.4.0rc2	1
`pkg:pypi/ujson@5.4.0`	5.12.1	1
`pkg:pypi/ujson@5.4.0`	5.13.0	1
`pkg:pypi/urllib3@2.0.7`	2.2.2	1
`pkg:pypi/urllib3@2.0.7`	2.5.0	1
`pkg:pypi/urllib3@2.0.7`	2.6.3	1
`pkg:pypi/urllib3@2.0.7`	2.7.0	1
`pkg:pypi/werkzeug@2.2.3`	2.3.8	1
`pkg:pypi/werkzeug@2.2.3`	3.0.3	1
`pkg:pypi/werkzeug@2.2.3`	3.1.4	1
`pkg:pypi/werkzeug@2.2.3`	3.1.5	1
`pkg:pypi/werkzeug@2.2.3`	3.1.6	1
`pkg:pypi/werkzeug@2.2.3`	3.1.9	1
`pkg:pypi/zipp@3.17.0`	3.19.1	1
`pkg:pypi/zope@1.0`	1f8456bf1f908ea46012537d52bd7e752a532c91	1
`pkg:pypi/zope@1.0`	2.2.1	1
`pkg:pypi/zope@1.0`	4.4	1
`pkg:pypi/zope@1.0`	4.6.1	1
`pkg:pypi/zope@1.0`	4.8.10	1
`pkg:pypi/zope@1.0`	5.11.1	1

Open findings by CVE year

2000

2017

2019

2020

2021

2022

2023

2024

131

2025

168

2026

539

Dormant findings

Top 10 by risk score. Dormant means more than 365 days since earliest public disclosure, a known fix, and an open state.

CVE	Component	Year	Age days	Risk	Factors
`CVE-2021-32674`	`pkg:pypi/zope@1.0`	2021	1973	100	CVSS baseline High \| Fix available for more than 180 days (+5) \| dormant (+8) \| Reachability unknown
`CVE-2023-30798`	`pkg:pypi/starlette@0.22.0`	2023	1291	100	CVSS baseline High \| Fix available for more than 180 days (+5) \| dormant (+8) \| Reachability unknown
`CVE-2024-11393`	`pkg:pypi/transformers@4.39.3`	2024	710	100	CVSS baseline High \| Fix available for more than 180 days (+5) \| dormant (+8) \| Reachability unknown
`CVE-2024-11394`	`pkg:pypi/transformers@4.39.3`	2024	710	100	CVSS baseline High \| Fix available for more than 180 days (+5) \| dormant (+8) \| Reachability unknown
`CVE-2024-2398`	`pkg:generic/curl@8.5.0`	2024	951	100	CVSS baseline High \| EPSS 36% \| dormant (+8) \| Reachability not assessed
`CVE-2024-26256`	`pkg:generic/libarchive@3.6.2`	2024	937	100	CVSS baseline High \| EPSS 88% (high exploit probability) \| dormant (+8) \| Reachability not assessed
`CVE-2024-29157`	`pkg:generic/hdf5@1.12.1`	2024	902	100	CVSS baseline Critical \| dormant (+8) \| Reachability not assessed
`CVE-2024-29159`	`pkg:generic/hdf5@1.12.1`	2024	902	100	CVSS baseline Critical \| dormant (+8) \| Reachability not assessed
`CVE-2024-29164`	`pkg:generic/hdf5@1.12.1`	2024	902	100	CVSS baseline Critical \| dormant (+8) \| Reachability not assessed
`CVE-2024-32608`	`pkg:generic/hdf5@1.12.1`	2024	755	100	CVSS baseline Critical \| dormant (+8) \| Reachability not assessed

🎯 Top Actionable Risks

Unified 0-100 risk score = CVSS severity × exploit likelihood (KEV/EPSS) × applicability (reachability, VEX state, deployment scope). A trusted fix older than 180 days adds 5, dormant adds 8, and Medium with EPSS at least 0.10 adds 6. Open findings that are dormant or have EPSS at least 0.10 get a final floor of 40 (floor_medium); not affected or unreachable findings are never floored. Ranks the findings most worth acting on first.

Prioritize reachable code paths (push unknown/unreachable findings down)

Risk	Priority	CVE	Component	Why it ranks here
100	Critical	`CVE-2021-32674`	`pypi/zope@1.0`	CVSS baseline High · Fix available for more than 180 days (+5) · dormant (+8) · Reachability unknown
100	Critical	`CVE-2023-30798`	`pypi/starlette@0.22.0`	CVSS baseline High · Fix available for more than 180 days (+5) · dormant (+8) · Reachability unknown
100	Critical	`CVE-2024-11393`	`pypi/transformers@4.39.3`	CVSS baseline High · Fix available for more than 180 days (+5) · dormant (+8) · Reachability unknown
100	Critical	`CVE-2024-11394`	`pypi/transformers@4.39.3`	CVSS baseline High · Fix available for more than 180 days (+5) · dormant (+8) · Reachability unknown
100	Critical	`CVE-2024-2398`	`generic/curl@8.5.0`	CVSS baseline High · EPSS 36% · dormant (+8) · Reachability not assessed
100	Critical	`CVE-2024-26256`	`generic/libarchive@3.6.2`	CVSS baseline High · EPSS 88% (high exploit probability) · dormant (+8) · Reachability not assessed
100	Critical	`CVE-2024-29157`	`generic/hdf5@1.12.1`	CVSS baseline Critical · dormant (+8) · Reachability not assessed
100	Critical	`CVE-2024-29159`	`generic/hdf5@1.12.1`	CVSS baseline Critical · dormant (+8) · Reachability not assessed
100	Critical	`CVE-2024-29164`	`generic/hdf5@1.12.1`	CVSS baseline Critical · dormant (+8) · Reachability not assessed
100	Critical	`CVE-2024-32608`	`generic/hdf5@1.12.1`	CVSS baseline Critical · dormant (+8) · Reachability not assessed

Showing top 10 of 944 scored findings. Toggle above re-selects the top 10 by reachability.

🏥 VEX - Vulnerability Exploitability Assessment

FDA metadata incomplete: Product manufacturer is missing. Patient-harm and mitigation assessments are included for review, but this report is not completed manufacturer-backed Section 524B documentation. Supply the product manufacturer before regulatory use.

947

Component/CVE Assessments

83

Affected (Require Action)

864

Under Investigation

0

Not Affected

0

Unreachable (Not Imported)

Disposition reconciliation: 83 Affected + 0 Not Affected + 864 Under Investigation = 947 Total. Unreachable = present in the dependency set but not imported/used by first-party source code (entry-point reachability analysis); it is a subset of Not Affected.

VEX Assessments:

CVE-2026-111497 ⚠️ AFFECTED

HIGH PRIORITY: brotli is actively exploited in the wild (CISA KEV). Severity: CRITICAL (CVSS 9.2). Update recommended within 48 hours.

Reachability: Not assessed (unsupported ecosystem or analyzer unavailable)
Patient Harm: Unknown
Mitigation Target: 2026-12-03

CVE-2025-27363 ⚠️ AFFECTED

HIGH PRIORITY: FreeType is actively exploited in the wild (CISA KEV). Severity: HIGH (CVSS 8.1). Update recommended within 48 hours.

Reachability: Not assessed (unsupported ecosystem or analyzer unavailable)
Patient Harm: Unknown
Mitigation Target: 2026-12-03

CVE-2025-15467 🔍 UNDER INVESTIGATION

Runtime component OpenSSL has a CRITICAL vulnerability (CVSS 9.8); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

Reachability: Not assessed (unsupported ecosystem or analyzer unavailable)
Patient Harm: Unknown
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected

CVE-2024-26256 🔍 UNDER INVESTIGATION

Runtime component libarchive has a HIGH vulnerability (CVSS 7.8); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

CVE-2026-48710 ⚠️ AFFECTED

HIGH PRIORITY: starlette is actively exploited in the wild (CISA KEV). Severity: MEDIUM (CVSS 6.5). Update recommended within 48 hours.

Reachability: Unknown (analysis ran without sufficient evidence)
Patient Harm: Unknown
Mitigation Target: 2026-12-03

CVE-2025-6965 🔍 UNDER INVESTIGATION

Runtime component sqlite has a HIGH vulnerability (CVSS 7.2); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

CVE-2024-20697 🔍 UNDER INVESTIGATION

Runtime component libarchive has a HIGH vulnerability (CVSS 7.3); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

CVE-2023-48795 🔍 UNDER INVESTIGATION

Runtime component libssh2 has a MEDIUM vulnerability (CVSS 5.9); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

CVE-2024-2398 🔍 UNDER INVESTIGATION

Runtime component curl has a HIGH vulnerability (CVSS 8.6); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

CVE-2024-5452 🔍 UNDER INVESTIGATION

Runtime component lightning has a CRITICAL vulnerability (CVSS 9.8); identified but not proven exploitable (no KEV match and reachability not confirmed). Product-specific triage is required before an affected / not_affected determination.

Reachability: Unknown (analysis ran without sufficient evidence)
Patient Harm: Unknown
Controls:
• Manual VEX Triage Required: Confirm reachability and device exposure before classifying affected or not_affected

Complete VEX document: XFusion_20261102_fixed_VEX.json

Dependency Analysis

555
Graph nodes

554
Direct dependencies

0
Transitive dependencies

1
Maximum depth

0
Multiple parents

84
Vulnerable paths

Vulnerable dependency paths

XFusion → starlette
XFusion → python
XFusion → transformers
XFusion → libpng
XFusion → lightning
XFusion → hdf5
XFusion → gstreamer
XFusion → curl
XFusion → bleach
XFusion → FreeType
XFusion → werkzeug
XFusion → libjpeg-turbo
XFusion → urllib3
XFusion → jinja2
XFusion → fastapi
XFusion → jupyterlab
XFusion → libevent
XFusion → python-multipart
XFusion → aiohttp
XFusion → libprotobuf
XFusion → lxml
XFusion → python-dotenv
XFusion → deepdiff
XFusion → libxml2
XFusion → pydantic

Interactive SBOM Dependency Graph

Interactive SBOM Dependency Graph (static fallback)

Interactive graph unavailable. Nodes:

XFusion (application)
numpy (library)
pyyaml (library)
tqdm (library)
natsort (library)
einops (library)
timm (library)
scipy (library)
pillow (library)
scikit-image (library)
opencv-python-headless (library)
absl-py (library)
annotated-types (library)
antlr4-python3-runtime (library)
blessed (library)
boto3 (library)
botocore (library)
croniter (library)
dateutils (library)
deepdiff (library)
editor (library)
fastapi (library)
grpcio (library)
h11 (library)
huggingface-hub (library)
inquirer (library)
largestinteriorrectangle (library)
lightning (library)
lightning-cloud (library)
lightning-utilities (library)
omegaconf (library)
ordered-set (library)
packaging (library)
pydantic-core (library)
python-multipart (library)
pytorch-lightning (library)
readchar (library)
runs (library)
s3transfer (library)
starlette (library)
starsessions (library)
taming-transformers (library)
tensorboard (library)
tensorboard-data-server (library)
tokenizers (library)
torchmetrics (library)
transformers (library)
uvicorn (library)
websockets (library)
xmod (library)
-anaconda-depends (library)
_libgcc_mutex (library)
_openmp_mutex (library)
abseil-cpp (library)
aiobotocore (library)
aiohttp (library)
aioitertools (library)
aiosignal (library)
alabaster (library)
altair (library)
anaconda-catalogs (library)
anaconda-cloud-auth (library)
anyio (library)
aom (library)
appdirs (library)
archspec (library)
argon2-cffi (library)
argon2-cffi-bindings (library)
arrow (library)
arrow-cpp (library)
astroid (library)
astropy (library)
asttokens (library)
async-lru (library)
atomicwrites (library)
attrs (library)
automat (library)
autopep8 (library)
aws-sdk-cpp (library)
backports (library)
backports-functools-lru-cache (library)
backports-tempfile (library)
backports-weakref (library)
bcrypt (library)
beautifulsoup4 (library)
binaryornot (library)
blas (library)
bleach (library)
blinker (library)
blosc (library)
bokeh (library)
boltons (library)
boost-cpp (library)
bottleneck (library)
brotli (library)
brotli-bin (library)
brotli (library)
brunsli (library)
bzip2 (library)
c-ares (library)
c-blosc2 (library)
ca-certificates (library)
cachetools (library)
certifi (library)
cffi (library)
cfitsio (library)
chardet (library)
charls (library)
charset-normalizer (library)
click (library)
cloudpickle (library)
clyent (library)
colorama (library)
colorcet (library)
comm (library)
conda-content-trust (library)
conda-pack (library)
conda-package-handling (library)
conda-package-streaming (library)
conda-verify (library)
constantly (library)
contourpy (library)
cookiecutter (library)
cryptography (library)
cssselect (library)
cuda-cudart (library)
cuda-cupti (library)
cuda-libraries (library)
cuda-nvrtc (library)
cuda-nvtx (library)
cuda-opencl (library)
cuda-runtime (library)
curl (library)
cycler (library)
cyrus-sasl (library)
cytoolz (library)
dask (library)
dask-core (library)
dataclasses (library)
datashader (library)
dav1d (library)
dbus (library)
debugpy (library)
decorator (library)
defusedxml (library)
diff-match-patch (library)
diffusers (library)
dill (library)
distributed (library)
distro (library)
docstring-to-markdown (library)
docutils (library)
entrypoints (library)
et-xmlfile (library)
executing (library)
expat (library)
FFmpeg (library)
filelock (library)
flask (library)
fmt (library)
fontconfig (library)
fonttools (library)
FreeType (library)
frozenlist (library)
fsspec (library)
future (library)
gensim (library)
gflags (library)
giflib (library)
gitdb (library)
gitpython (library)
glib-tools (library)
glog (library)
gmp (library)
gmpy2 (library)
gnutls (library)
greenlet (library)
grpc-cpp (library)
gst-plugins-base (library)
gstreamer (library)

#ig-sbom-dependency-graph-dbd34290 .ig-head,#ig-sbom-dependency-graph-dbd34290 .ig-stage,#ig-sbom-dependency-graph-dbd34290 .ig-status{display:none}#ig-sbom-dependency-graph-dbd34290 .ig-static{display:block}

ESL SBOMator

Professional SBOM Solution

Engineering Software Lab

Security & Compliance Tools

Contact Information

www.eswlab.com
sales@eswlab.com

Report generated by ESL SBOMator v1.4.11.05

Classification	Count
build_components	13
runtime_components	557
unknown_components	0

ESL SBOMator

About This Report: XFusion Supply-Chain Scan

⚠️ SBOM DATA QUALITY WARNING: DO NOT SUBMIT TO REGULATORS ⚠️

554

84

943

0

15.2%

🤖 AI/ML SBOM Profile

🛡️ Model Artifact Security

0

3

868

72

0

🏢 Vendor/Manufacturer Distribution

Unique CVE/Advisory Severity Distribution

SBOM Version and License Quality Gate

Component Vulnerability Analysis

Report Generation Details

Technical Details

Vulnerability Database

FDA/NTIA Compliance

Supply chain adoption

Cooling versions

Mythos readiness

Fix Backlog

Top 10 oldest fixable findings

One upgrade fixes N findings

Open findings by CVE year

Dormant findings

🎯 Top Actionable Risks

🏥 VEX - Vulnerability Exploitability Assessment

947

83

864

0

0

VEX Assessments:

CVE-2026-111497 ⚠️ AFFECTED

CVE-2025-27363 ⚠️ AFFECTED

CVE-2025-15467 🔍 UNDER INVESTIGATION

CVE-2024-26256 🔍 UNDER INVESTIGATION

CVE-2026-48710 ⚠️ AFFECTED

CVE-2025-6965 🔍 UNDER INVESTIGATION

CVE-2024-20697 🔍 UNDER INVESTIGATION

CVE-2023-48795 🔍 UNDER INVESTIGATION

CVE-2024-2398 🔍 UNDER INVESTIGATION

CVE-2024-5452 🔍 UNDER INVESTIGATION

CVE-2024-7264 🔍 UNDER INVESTIGATION

CVE-2024-11392 🔍 UNDER INVESTIGATION

CVE-2026-42266 🔍 UNDER INVESTIGATION

CVE-2019-9928 🔍 UNDER INVESTIGATION

CVE-2026-45447 🔍 UNDER INVESTIGATION

CVE-2021-3522 🔍 UNDER INVESTIGATION

CVE-2024-11393 🔍 UNDER INVESTIGATION

CVE-2024-34069 🔍 UNDER INVESTIGATION

CVE-2026-21441 ⚠️ AFFECTED

CVE-2024-11394 🔍 UNDER INVESTIGATION

CVE-2025-32434 ⚠️ AFFECTED

CVE-2024-7254 🔍 UNDER INVESTIGATION

CVE-2020-17541 🔍 UNDER INVESTIGATION

CVE-2017-14158 🔍 UNDER INVESTIGATION

CVE-2023-52356 🔍 UNDER INVESTIGATION

CVE-2021-38291 🔍 UNDER INVESTIGATION

CVE-2026-67325 🔍 UNDER INVESTIGATION

CVE-2026-24486 🔍 UNDER INVESTIGATION

CVE-2024-7592 🔍 UNDER INVESTIGATION

CVE-2024-6232 🔍 UNDER INVESTIGATION

CVE-2023-52425 🔍 UNDER INVESTIGATION

CVE-2024-28757 🔍 UNDER INVESTIGATION

CVE-2000-0483 🔍 UNDER INVESTIGATION

CVE-2024-52533 🔍 UNDER INVESTIGATION

CVE-2025-49796 🔍 UNDER INVESTIGATION

CVE-2023-52355 🔍 UNDER INVESTIGATION

CVE-2021-32633 🔍 UNDER INVESTIGATION

CVE-2024-1580 🔍 UNDER INVESTIGATION

CVE-2025-4517 🔍 UNDER INVESTIGATION

CVE-2024-45490 🔍 UNDER INVESTIGATION

CVE-2024-34459 🔍 UNDER INVESTIGATION