{ "graphs": [ {"nodes": [ {"system": "NPM", "name": "express", "version": "4.18.2", "relation": "SELF"}, {"system": "NPM", "name": "accepts", "version": "1.3.8", "relation": "DIRECT"}, {"system": "NPM", "name": "array-flatten", "version": "1.1.1", "relation": "DIRECT"}, {"system": "NPM", "name": "async-function", "version": "1.0.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "async-generator-function", "version": "1.0.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "body-parser", "version": "1.20.1", "relation": "DIRECT"}, {"system": "NPM", "name": "bytes", "version": "3.1.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "call-bind-apply-helpers", "version": "1.0.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "call-bound", "version": "1.0.4", "relation": "INDIRECT"}, {"system": "NPM", "name": "content-disposition", "version": "0.5.4", "relation": "DIRECT"}, {"system": "NPM", "name": "content-type", "version": "1.0.5", "relation": "DIRECT"}, {"system": "NPM", "name": "cookie", "version": "0.5.0", "relation": "DIRECT"}, {"system": "NPM", "name": "cookie-signature", "version": "1.0.6", "relation": "DIRECT"}, {"system": "NPM", "name": "debug", "version": "2.6.9", "relation": "DIRECT"}, {"system": "NPM", "name": "depd", "version": "2.0.0", "relation": "DIRECT"}, {"system": "NPM", "name": "destroy", "version": "1.2.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "dunder-proto", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "ee-first", "version": "1.1.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "encodeurl", "version": "1.0.2", "relation": "DIRECT"}, {"system": "NPM", "name": "es-define-property", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "es-errors", "version": "1.3.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "es-object-atoms", "version": "1.1.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "escape-html", "version": "1.0.3", "relation": "DIRECT"}, {"system": "NPM", "name": "etag", "version": "1.8.1", "relation": "DIRECT"}, {"system": "NPM", "name": "finalhandler", "version": "1.2.0", "relation": "DIRECT"}, {"system": "NPM", "name": "forwarded", "version": "0.2.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "fresh", "version": "0.5.2", "relation": "DIRECT"}, {"system": "NPM", "name": "function-bind", "version": "1.1.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "generator-function", "version": "2.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "get-intrinsic", "version": "1.3.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "get-proto", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "gopd", "version": "1.2.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "has-symbols", "version": "1.1.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "hasown", "version": "2.0.4", "relation": "INDIRECT"}, {"system": "NPM", "name": "http-errors", "version": "2.0.0", "relation": "DIRECT"}, {"system": "NPM", "name": "iconv-lite", "version": "0.4.24", "relation": "INDIRECT"}, {"system": "NPM", "name": "inherits", "version": "2.0.4", "relation": "INDIRECT"}, {"system": "NPM", "name": "ipaddr.js", "version": "1.9.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "math-intrinsics", "version": "1.1.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "media-typer", "version": "0.3.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "merge-descriptors", "version": "1.0.1", "relation": "DIRECT"}, {"system": "NPM", "name": "methods", "version": "1.1.2", "relation": "DIRECT"}, {"system": "NPM", "name": "mime", "version": "1.6.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "mime-db", "version": "1.52.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "mime-types", "version": "2.1.35", "relation": "INDIRECT"}, {"system": "NPM", "name": "ms", "version": "2.0.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "ms", "version": "2.1.3", "relation": "INDIRECT"}, {"system": "NPM", "name": "negotiator", "version": "0.6.3", "relation": "INDIRECT"}, {"system": "NPM", "name": "object-inspect", "version": "1.13.4", "relation": "INDIRECT"}, {"system": "NPM", "name": "on-finished", "version": "2.4.1", "relation": "DIRECT"}, {"system": "NPM", "name": "parseurl", "version": "1.3.3", "relation": "DIRECT"}, {"system": "NPM", "name": "path-to-regexp", "version": "0.1.7", "relation": "DIRECT"}, {"system": "NPM", "name": "proxy-addr", "version": "2.0.8", "relation": "DIRECT"}, {"system": "NPM", "name": "qs", "version": "6.11.0", "relation": "DIRECT"}, {"system": "NPM", "name": "range-parser", "version": "1.2.1", "relation": "DIRECT"}, {"system": "NPM", "name": "raw-body", "version": "2.5.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "safe-buffer", "version": "5.2.1", "relation": "DIRECT"}, {"system": "NPM", "name": "safer-buffer", "version": "2.1.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "send", "version": "0.18.0", "relation": "DIRECT"}, {"system": "NPM", "name": "serve-static", "version": "1.15.0", "relation": "DIRECT"}, {"system": "NPM", "name": "setprototypeof", "version": "1.2.0", "relation": "DIRECT"}, {"system": "NPM", "name": "side-channel", "version": "1.1.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "side-channel-list", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "side-channel-map", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "side-channel-weakmap", "version": "1.0.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "statuses", "version": "2.0.1", "relation": "DIRECT"}, {"system": "NPM", "name": "toidentifier", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "type-is", "version": "1.6.18", "relation": "DIRECT"}, {"system": "NPM", "name": "unpipe", "version": "1.0.0", "relation": "INDIRECT"}, {"system": "NPM", "name": "utils-merge", "version": "1.0.1", "relation": "DIRECT"}, {"system": "NPM", "name": "vary", "version": "1.1.2", "relation": "DIRECT"} ], "edges": [ {"fromNode": 0, "toNode": 1, "requirement": "~1.3.8"}, {"fromNode": 0, "toNode": 2, "requirement": "1.1.1"}, {"fromNode": 0, "toNode": 5, "requirement": "1.20.1"}, {"fromNode": 0, "toNode": 9, "requirement": "0.5.4"}, {"fromNode": 0, "toNode": 10, "requirement": "~1.0.4"}, {"fromNode": 0, "toNode": 11, "requirement": "0.5.0"}, {"fromNode": 0, "toNode": 12, "requirement": "1.0.6"}, {"fromNode": 0, "toNode": 13, "requirement": "2.6.9"}, {"fromNode": 0, "toNode": 14, "requirement": "2.0.0"}, {"fromNode": 0, "toNode": 18, "requirement": "~1.0.2"}, {"fromNode": 0, "toNode": 22, "requirement": "~1.0.3"}, {"fromNode": 0, "toNode": 23, "requirement": "~1.8.1"}, {"fromNode": 0, "toNode": 24, "requirement": "1.2.0"}, {"fromNode": 0, "toNode": 26, "requirement": "0.5.2"}, {"fromNode": 0, "toNode": 34, "requirement": "2.0.0"}, {"fromNode": 0, "toNode": 40, "requirement": "1.0.1"}, {"fromNode": 0, "toNode": 41, "requirement": "~1.1.2"}, {"fromNode": 0, "toNode": 49, "requirement": "2.4.1"}, {"fromNode": 0, "toNode": 50, "requirement": "~1.3.3"}, {"fromNode": 0, "toNode": 51, "requirement": "0.1.7"}, {"fromNode": 0, "toNode": 52, "requirement": "~2.0.7"}, {"fromNode": 0, "toNode": 53, "requirement": "6.11.0"}, {"fromNode": 0, "toNode": 54, "requirement": "~1.2.1"}, {"fromNode": 0, "toNode": 56, "requirement": "5.2.1"}, {"fromNode": 0, "toNode": 58, "requirement": "0.18.0"}, {"fromNode": 0, "toNode": 59, "requirement": "1.15.0"}, {"fromNode": 0, "toNode": 60, "requirement": "1.2.0"}, {"fromNode": 0, "toNode": 65, "requirement": "2.0.1"}, {"fromNode": 0, "toNode": 67, "requirement": "~1.6.18"}, {"fromNode": 0, "toNode": 69, "requirement": "1.0.1"}, {"fromNode": 0, "toNode": 70, "requirement": "~1.1.2"}, {"fromNode": 1, "toNode": 44, "requirement": "~2.1.34"}, {"fromNode": 1, "toNode": 47, "requirement": "0.6.3"}, {"fromNode": 5, "toNode": 6, "requirement": "3.1.2"}, {"fromNode": 5, "toNode": 10, "requirement": "~1.0.4"}, {"fromNode": 5, "toNode": 13, "requirement": "2.6.9"}, {"fromNode": 5, "toNode": 14, "requirement": "2.0.0"}, {"fromNode": 5, "toNode": 15, "requirement": "1.2.0"}, {"fromNode": 5, "toNode": 34, "requirement": "2.0.0"}, {"fromNode": 5, "toNode": 35, "requirement": "0.4.24"}, {"fromNode": 5, "toNode": 49, "requirement": "2.4.1"}, {"fromNode": 5, "toNode": 53, "requirement": "6.11.0"}, {"fromNode": 5, "toNode": 55, "requirement": "2.5.1"}, {"fromNode": 5, "toNode": 67, "requirement": "~1.6.18"}, {"fromNode": 5, "toNode": 68, "requirement": "1.0.0"}, {"fromNode": 7, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 7, "toNode": 27, "requirement": "^1.1.2"}, {"fromNode": 8, "toNode": 7, "requirement": "^1.0.2"}, {"fromNode": 8, "toNode": 29, "requirement": "^1.3.0"}, {"fromNode": 9, "toNode": 56, "requirement": "5.2.1"}, {"fromNode": 13, "toNode": 45, "requirement": "2.0.0"}, {"fromNode": 16, "toNode": 7, "requirement": "^1.0.1"}, {"fromNode": 16, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 16, "toNode": 31, "requirement": "^1.2.0"}, {"fromNode": 21, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 24, "toNode": 13, "requirement": "2.6.9"}, {"fromNode": 24, "toNode": 18, "requirement": "~1.0.2"}, {"fromNode": 24, "toNode": 22, "requirement": "~1.0.3"}, {"fromNode": 24, "toNode": 49, "requirement": "2.4.1"}, {"fromNode": 24, "toNode": 50, "requirement": "~1.3.3"}, {"fromNode": 24, "toNode": 65, "requirement": "2.0.1"}, {"fromNode": 24, "toNode": 68, "requirement": "~1.0.0"}, {"fromNode": 29, "toNode": 3, "requirement": "^1.0.0"}, {"fromNode": 29, "toNode": 4, "requirement": "^1.0.0"}, {"fromNode": 29, "toNode": 7, "requirement": "^1.0.2"}, {"fromNode": 29, "toNode": 19, "requirement": "^1.0.1"}, {"fromNode": 29, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 29, "toNode": 21, "requirement": "^1.1.1"}, {"fromNode": 29, "toNode": 27, "requirement": "^1.1.2"}, {"fromNode": 29, "toNode": 28, "requirement": "^2.0.0"}, {"fromNode": 29, "toNode": 30, "requirement": "^1.0.1"}, {"fromNode": 29, "toNode": 31, "requirement": "^1.2.0"}, {"fromNode": 29, "toNode": 32, "requirement": "^1.1.0"}, {"fromNode": 29, "toNode": 33, "requirement": "^2.0.2"}, {"fromNode": 29, "toNode": 38, "requirement": "^1.1.0"}, {"fromNode": 30, "toNode": 16, "requirement": "^1.0.1"}, {"fromNode": 30, "toNode": 21, "requirement": "^1.0.0"}, {"fromNode": 33, "toNode": 27, "requirement": "^1.1.2"}, {"fromNode": 34, "toNode": 14, "requirement": "2.0.0"}, {"fromNode": 34, "toNode": 36, "requirement": "2.0.4"}, {"fromNode": 34, "toNode": 60, "requirement": "1.2.0"}, {"fromNode": 34, "toNode": 65, "requirement": "2.0.1"}, {"fromNode": 34, "toNode": 66, "requirement": "1.0.1"}, {"fromNode": 35, "toNode": 57, "requirement": ">= 2.1.2 < 3"}, {"fromNode": 44, "toNode": 43, "requirement": "1.52.0"}, {"fromNode": 49, "toNode": 17, "requirement": "1.1.1"}, {"fromNode": 52, "toNode": 25, "requirement": "0.2.0"}, {"fromNode": 52, "toNode": 37, "requirement": "1.9.1"}, {"fromNode": 53, "toNode": 61, "requirement": "^1.0.4"}, {"fromNode": 55, "toNode": 6, "requirement": "3.1.2"}, {"fromNode": 55, "toNode": 34, "requirement": "2.0.0"}, {"fromNode": 55, "toNode": 35, "requirement": "0.4.24"}, {"fromNode": 55, "toNode": 68, "requirement": "1.0.0"}, {"fromNode": 58, "toNode": 13, "requirement": "2.6.9"}, {"fromNode": 58, "toNode": 14, "requirement": "2.0.0"}, {"fromNode": 58, "toNode": 15, "requirement": "1.2.0"}, {"fromNode": 58, "toNode": 18, "requirement": "~1.0.2"}, {"fromNode": 58, "toNode": 22, "requirement": "~1.0.3"}, {"fromNode": 58, "toNode": 23, "requirement": "~1.8.1"}, {"fromNode": 58, "toNode": 26, "requirement": "0.5.2"}, {"fromNode": 58, "toNode": 34, "requirement": "2.0.0"}, {"fromNode": 58, "toNode": 42, "requirement": "1.6.0"}, {"fromNode": 58, "toNode": 46, "requirement": "2.1.3"}, {"fromNode": 58, "toNode": 49, "requirement": "2.4.1"}, {"fromNode": 58, "toNode": 54, "requirement": "~1.2.1"}, {"fromNode": 58, "toNode": 65, "requirement": "2.0.1"}, {"fromNode": 59, "toNode": 18, "requirement": "~1.0.2"}, {"fromNode": 59, "toNode": 22, "requirement": "~1.0.3"}, {"fromNode": 59, "toNode": 50, "requirement": "~1.3.3"}, {"fromNode": 59, "toNode": 58, "requirement": "0.18.0"}, {"fromNode": 61, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 61, "toNode": 48, "requirement": "^1.13.4"}, {"fromNode": 61, "toNode": 62, "requirement": "^1.0.1"}, {"fromNode": 61, "toNode": 63, "requirement": "^1.0.1"}, {"fromNode": 61, "toNode": 64, "requirement": "^1.0.2"}, {"fromNode": 62, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 62, "toNode": 48, "requirement": "^1.13.4"}, {"fromNode": 63, "toNode": 8, "requirement": "^1.0.2"}, {"fromNode": 63, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 63, "toNode": 29, "requirement": "^1.2.5"}, {"fromNode": 63, "toNode": 48, "requirement": "^1.13.3"}, {"fromNode": 64, "toNode": 8, "requirement": "^1.0.2"}, {"fromNode": 64, "toNode": 20, "requirement": "^1.3.0"}, {"fromNode": 64, "toNode": 29, "requirement": "^1.2.5"}, {"fromNode": 64, "toNode": 48, "requirement": "^1.13.3"}, {"fromNode": 64, "toNode": 63, "requirement": "^1.0.1"}, {"fromNode": 67, "toNode": 39, "requirement": "0.3.0"}, {"fromNode": 67, "toNode": 44, "requirement": "~2.1.24"} ] }, {"nodes": [ {"system": "NPM", "name": "jsonwebtoken", "version": "8.5.1", "relation": "SELF"}, {"system": "NPM", "name": "buffer-equal-constant-time", "version": "1.0.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "ecdsa-sig-formatter", "version": "1.0.11", "relation": "INDIRECT"}, {"system": "NPM", "name": "jwa", "version": "1.4.2", "relation": "INDIRECT"}, {"system": "NPM", "name": "jws", "version": "3.2.3", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.includes", "version": "4.3.0", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.isboolean", "version": "3.0.3", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.isinteger", "version": "4.0.4", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.isnumber", "version": "3.0.3", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.isplainobject", "version": "4.0.6", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.isstring", "version": "4.0.1", "relation": "DIRECT"}, {"system": "NPM", "name": "lodash.once", "version": "4.1.1", "relation": "DIRECT"}, {"system": "NPM", "name": "ms", "version": "2.1.3", "relation": "DIRECT"}, {"system": "NPM", "name": "safe-buffer", "version": "5.2.1", "relation": "INDIRECT"}, {"system": "NPM", "name": "semver", "version": "5.7.2", "relation": "DIRECT"} ], "edges": [ {"fromNode": 0, "toNode": 4, "requirement": "^3.2.2"}, {"fromNode": 0, "toNode": 5, "requirement": "^4.3.0"}, {"fromNode": 0, "toNode": 6, "requirement": "^3.0.3"}, {"fromNode": 0, "toNode": 7, "requirement": "^4.0.4"}, {"fromNode": 0, "toNode": 8, "requirement": "^3.0.3"}, {"fromNode": 0, "toNode": 9, "requirement": "^4.0.6"}, {"fromNode": 0, "toNode": 10, "requirement": "^4.0.1"}, {"fromNode": 0, "toNode": 11, "requirement": "^4.0.0"}, {"fromNode": 0, "toNode": 12, "requirement": "^2.1.1"}, {"fromNode": 0, "toNode": 14, "requirement": "^5.6.0"}, {"fromNode": 2, "toNode": 13, "requirement": "^5.0.1"}, {"fromNode": 3, "toNode": 1, "requirement": "^1.0.1"}, {"fromNode": 3, "toNode": 2, "requirement": "1.0.11"}, {"fromNode": 3, "toNode": 13, "requirement": "^5.0.1"}, {"fromNode": 4, "toNode": 3, "requirement": "^1.4.2"}, {"fromNode": 4, "toNode": 13, "requirement": "^5.0.1"} ] }, {"nodes": [ {"system": "PYPI", "name": "requests", "version": "2.25.0", "relation": "SELF"}, {"system": "PYPI", "name": "certifi", "version": "2026.7.22", "relation": "DIRECT"}, {"system": "PYPI", "name": "chardet", "version": "3.0.4", "relation": "DIRECT"}, {"system": "PYPI", "name": "idna", "version": "2.10.0", "relation": "DIRECT"}, {"system": "PYPI", "name": "urllib3", "version": "1.26.20", "relation": "DIRECT"} ], "edges": [ {"fromNode": 0, "toNode": 1, "requirement": ">=2017.4.17"}, {"fromNode": 0, "toNode": 2, "requirement": "<4,>=3.0.2"}, {"fromNode": 0, "toNode": 3, "requirement": "<3,>=2.5"}, {"fromNode": 0, "toNode": 4, "requirement": "<1.27,>=1.21.1"} ] } ], "advisoryKeys": [ {"version": "NPM/body-parser@1.20.1", "advisories": ["GHSA-qwcr-r2fm-qrc7", "GHSA-v422-hmwv-36x6"]}, {"version": "NPM/cookie@0.5.0", "advisories": ["GHSA-pxg6-pf52-xh8x"]}, {"version": "NPM/express@4.18.2", "advisories": ["GHSA-qw6h-vgh9-j6wx", "GHSA-rv95-896h-c2vc"]}, {"version": "NPM/jsonwebtoken@8.5.1", "advisories": ["GHSA-8cf7-32gw-wr33", "GHSA-hjrf-2m68-5959", "GHSA-qwph-4952-7xr6"]}, {"version": "NPM/path-to-regexp@0.1.7", "advisories": ["GHSA-37ch-88jc-xwx2", "GHSA-9wv6-86v2-598j", "GHSA-rhx6-c78j-4q9w"]}, {"version": "NPM/qs@6.11.0", "advisories": ["GHSA-4mjr-xmp4-gh2g", "GHSA-6rw7-vpxm-498p", "GHSA-w7fw-mjwx-w883"]}, {"version": "NPM/send@0.18.0", "advisories": ["GHSA-m6fv-jmcg-4jfg"]}, {"version": "NPM/serve-static@1.15.0", "advisories": ["GHSA-cm22-4g7w-348p"]}, {"version": "PYPI/idna@2.10.0", "advisories": ["GHSA-65pc-fj4g-8rjx", "GHSA-jjg7-2v4v-x38h", "PYSEC-2024-60", "PYSEC-2026-215"]}, {"version": "PYPI/requests@2.25.0", "advisories": ["GHSA-9hjg-9r4m-mvj7", "GHSA-9wx4-h78v-vm56", "GHSA-gc5v-m9x4-r6x2", "GHSA-j8r2-6x86-q33q", "PYSEC-2023-74", "PYSEC-2026-1872", "PYSEC-2026-1873", "PYSEC-2026-2275"]}, {"version": "PYPI/urllib3@1.26.20", "advisories": ["GHSA-2xpw-w6gg-jr37", "GHSA-38jv-5279-wg99", "GHSA-gm62-xv2j-4w53", "GHSA-pq67-6m6q-mj2v", "GHSA-qccp-gfcp-xxvc", "PYSEC-2026-141", "PYSEC-2026-1994", "PYSEC-2026-1996", "PYSEC-2026-1998", "PYSEC-2026-1999"]} ], "advisories": [ {"id": "GHSA-2xpw-w6gg-jr37", "cvss3": 0.0, "title": "urllib3 streaming API improperly handles highly compressed data"}, {"id": "GHSA-37ch-88jc-xwx2", "cvss3": 7.5, "title": "path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters"}, {"id": "GHSA-38jv-5279-wg99", "cvss3": 7.5, "title": "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"}, {"id": "GHSA-4mjr-xmp4-gh2g", "cvss3": 5.3, "title": "qs: Denial of Service via Attacker Controlled isBuffer"}, {"id": "GHSA-65pc-fj4g-8rjx", "cvss3": 5.3, "title": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix"}, {"id": "GHSA-6rw7-vpxm-498p", "cvss3": 3.7, "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion"}, {"id": "GHSA-8cf7-32gw-wr33", "cvss3": 8.1, "title": "jsonwebtoken unrestricted key type could lead to legacy keys usage"}, {"id": "GHSA-9hjg-9r4m-mvj7", "cvss3": 5.3, "title": "Requests vulnerable to .netrc credentials leak via malicious URLs"}, {"id": "GHSA-9wv6-86v2-598j", "cvss3": 7.5, "title": "path-to-regexp outputs backtracking regular expressions"}, {"id": "GHSA-9wx4-h78v-vm56", "cvss3": 5.6, "title": "Requests `Session` object does not verify requests after making first request with verify=False"}, {"id": "GHSA-cm22-4g7w-348p", "cvss3": 5.0, "title": "serve-static vulnerable to template injection that can lead to XSS"}, {"id": "GHSA-gc5v-m9x4-r6x2", "cvss3": 4.4, "title": "Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function"}, {"id": "GHSA-gm62-xv2j-4w53", "cvss3": 0.0, "title": "urllib3 allows an unbounded number of links in the decompression chain"}, {"id": "GHSA-hjrf-2m68-5959", "cvss3": 5.0, "title": "jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC"}, {"id": "GHSA-j8r2-6x86-q33q", "cvss3": 6.1, "title": "Unintended leak of Proxy-Authorization header in requests"}, {"id": "GHSA-jjg7-2v4v-x38h", "cvss3": 6.2, "title": "Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode"}, {"id": "GHSA-m6fv-jmcg-4jfg", "cvss3": 5.0, "title": "send vulnerable to template injection that can lead to XSS"}, {"id": "GHSA-pq67-6m6q-mj2v", "cvss3": 5.3, "title": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"}, {"id": "GHSA-pxg6-pf52-xh8x", "cvss3": 0.0, "title": "cookie accepts cookie name, path, and domain with out of bounds characters"}, {"id": "GHSA-qccp-gfcp-xxvc", "cvss3": 5.3, "title": "urllib3: Sensitive headers forwarded across origins in proxied low-level redirects"}, {"id": "GHSA-qw6h-vgh9-j6wx", "cvss3": 5.0, "title": "express vulnerable to XSS via response.redirect()"}, {"id": "GHSA-qwcr-r2fm-qrc7", "cvss3": 7.5, "title": "body-parser vulnerable to denial of service when url encoding is enabled"}, {"id": "GHSA-qwph-4952-7xr6", "cvss3": 6.4, "title": "jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()"}, {"id": "GHSA-rhx6-c78j-4q9w", "cvss3": 7.5, "title": "path-to-regexp contains a ReDoS"}, {"id": "GHSA-rv95-896h-c2vc", "cvss3": 6.1, "title": "Express.js Open Redirect in malformed URLs"}, {"id": "GHSA-v422-hmwv-36x6", "cvss3": 3.7, "title": "body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement"}, {"id": "GHSA-w7fw-mjwx-w883", "cvss3": 3.7, "title": "qs's arrayLimit bypass in comma parsing allows denial of service"}, {"id": "PYSEC-2023-74", "cvss3": 0.0, "title": "PYSEC-2023-74"}, {"id": "PYSEC-2024-60", "cvss3": 7.5, "title": "PYSEC-2024-60"}, {"id": "PYSEC-2026-141", "cvss3": 5.3, "title": "PYSEC-2026-141"}, {"id": "PYSEC-2026-1872", "cvss3": 5.3, "title": "Requests vulnerable to .netrc credentials leak via malicious URLs"}, {"id": "PYSEC-2026-1873", "cvss3": 5.6, "title": "Requests `Session` object does not verify requests after making first request with verify=False"}, {"id": "PYSEC-2026-1994", "cvss3": 0.0, "title": "urllib3 streaming API improperly handles highly compressed data"}, {"id": "PYSEC-2026-1996", "cvss3": 7.5, "title": "Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)"}, {"id": "PYSEC-2026-1998", "cvss3": 0.0, "title": "urllib3 allows an unbounded number of links in the decompression chain"}, {"id": "PYSEC-2026-1999", "cvss3": 5.3, "title": "urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation"}, {"id": "PYSEC-2026-215", "cvss3": 5.3, "title": "PYSEC-2026-215"}, {"id": "PYSEC-2026-2275", "cvss3": 5.5, "title": "PYSEC-2026-2275"} ] }