diff --git a/vulns/airflow/PYSEC-0000-airflow-GHSA-q3p4-gw7r-wqjc.yaml b/vulns/airflow/PYSEC-0000-airflow-GHSA-q3p4-gw7r-wqjc.yaml
new file mode 100644
index 000000000..4af2f035e
--- /dev/null
+++ b/vulns/airflow/PYSEC-0000-airflow-GHSA-q3p4-gw7r-wqjc.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-airflow-GHSA-q3p4-gw7r-wqjc
+modified: '2026-07-02T14:13:09.589522Z'
+published: '2026-07-02T14:13:09.589522Z'
+aliases:
+- CVE-2019-12417
+- GHSA-q3p4-gw7r-wqjc
+summary: Apache Airflow vulnerable to XSS and local file disclosure
+details: A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: airflow
+    purl: pkg:pypi/airflow
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.10.6
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-12417
+- type: WEB
+  url: https://github.com/apache/airflow/commit/caf1f264b845153b9a61b00b1a57acb7c320e743
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-q3p4-gw7r-wqjc
+- type: PACKAGE
+  url: https://github.com/apache/airflow
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-216.yaml
+- type: WEB
+  url: https://lists.apache.org/thread.html/f3aa5ff9c7cdb5424b6463c9013f6cf5db83d26c66ea77130cbbe1bc@%3Cusers.airflow.apache.org%3E
+- type: PACKAGE
+  url: https://pypi.org/project/airflow
diff --git a/vulns/ansible/PYSEC-0000-ansible-GHSA-fh5v-5f35-2rv2.yaml b/vulns/ansible/PYSEC-0000-ansible-GHSA-fh5v-5f35-2rv2.yaml
new file mode 100644
index 000000000..ebc2eae7d
--- /dev/null
+++ b/vulns/ansible/PYSEC-0000-ansible-GHSA-fh5v-5f35-2rv2.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-ansible-GHSA-fh5v-5f35-2rv2
+modified: '2026-07-02T14:13:16.795525Z'
+published: '2026-07-02T14:13:16.795525Z'
+aliases:
+- CVE-2021-20180
+- GHSA-fh5v-5f35-2rv2
+summary: Insertion of Sensitive Information into Log File in ansible
+details: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: ansible
+    purl: pkg:pypi/ansible
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.8.0a1
+    - fixed: 2.8.19
+    - introduced: 2.9.0b1
+    - fixed: 2.9.18
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-20180
+- type: WEB
+  url: https://github.com/ansible/ansible/pull/73242
+- type: WEB
+  url: https://github.com/ansible/ansible/pull/73243
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1915808
+- type: PACKAGE
+  url: https://github.com/ansible/ansible
+- type: WEB
+  url: https://github.com/ansible/ansible/blob/v2.8.19/changelogs/CHANGELOG-v2.8.rst
+- type: WEB
+  url: https://github.com/ansible/ansible/blob/v2.9.18/changelogs/CHANGELOG-v2.9.rst
+- type: WEB
+  url: https://github.com/ansible/ansible/tree/v2.7.18/lib/ansible/modules/source_control
+- type: WEB
+  url: https://github.com/ansible/ansible/tree/v2.8.0a1/lib/ansible/modules/source_control
+- type: PACKAGE
+  url: https://pypi.org/project/ansible
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fh5v-5f35-2rv2
diff --git a/vulns/aodh/PYSEC-0000-aodh-GHSA-86cv-9gpx-6hwj.yaml b/vulns/aodh/PYSEC-0000-aodh-GHSA-86cv-9gpx-6hwj.yaml
new file mode 100644
index 000000000..6d086213a
--- /dev/null
+++ b/vulns/aodh/PYSEC-0000-aodh-GHSA-86cv-9gpx-6hwj.yaml
@@ -0,0 +1,48 @@
+id: PYSEC-0000-aodh-GHSA-86cv-9gpx-6hwj
+modified: '2026-07-02T14:13:24.418168Z'
+published: '2026-07-02T14:13:24.418168Z'
+aliases:
+- CVE-2017-12440
+- GHSA-86cv-9gpx-6hwj
+summary: Openstack Aodh can be used to launder Keystone trusts
+details: Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: aodh
+    purl: pkg:pypi/aodh
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 6.0.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12440
+- type: WEB
+  url: https://github.com/openstack/aodh/commit/149d3ad2193b4d17df801f82a0a6be62dba564db
+- type: WEB
+  url: https://github.com/openstack/aodh/commit/92182de328d1f088c5f5a68326d2b207b21e06ea
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:3227
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:0315
+- type: WEB
+  url: https://bugs.launchpad.net/ossn/+bug/1649333
+- type: WEB
+  url: https://review.openstack.org/#/c/493823
+- type: WEB
+  url: https://review.openstack.org/#/c/493824
+- type: WEB
+  url: https://review.openstack.org/#/c/493826
+- type: WEB
+  url: http://www.debian.org/security/2017/dsa-3953
+- type: WEB
+  url: http://www.securityfocus.com/bid/100455
+- type: PACKAGE
+  url: https://pypi.org/project/aodh
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-86cv-9gpx-6hwj
diff --git a/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wrp6-9w7f-3wxg.yaml b/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wrp6-9w7f-3wxg.yaml
new file mode 100644
index 000000000..45240053f
--- /dev/null
+++ b/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wrp6-9w7f-3wxg.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-calibreweb-GHSA-wrp6-9w7f-3wxg
+modified: '2026-07-02T14:13:14.959672Z'
+published: '2026-07-02T14:13:14.959672Z'
+aliases:
+- CVE-2021-4170
+- GHSA-wrp6-9w7f-3wxg
+summary: calibre-web is vulnerable to Cross-site Scripting
+details: calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: calibreweb
+    purl: pkg:pypi/calibreweb
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.6.15
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-4170
+- type: WEB
+  url: https://github.com/janeczku/calibre-web/commit/7ad419dc8c12180e842a82118f4866ac3d074bc5
+- type: WEB
+  url: https://github.com/janeczku/calibre-web
+- type: WEB
+  url: https://huntr.dev/bounties/ff395101-e392-401d-ab4f-579c63fbf6a0
+- type: PACKAGE
+  url: https://pypi.org/project/calibreweb
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wrp6-9w7f-3wxg
diff --git a/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wxr6-29pv-ch68.yaml b/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wxr6-29pv-ch68.yaml
new file mode 100644
index 000000000..768ce7462
--- /dev/null
+++ b/vulns/calibreweb/PYSEC-0000-calibreweb-GHSA-wxr6-29pv-ch68.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-calibreweb-GHSA-wxr6-29pv-ch68
+modified: '2026-07-02T14:13:14.881686Z'
+published: '2026-07-02T14:13:14.881686Z'
+aliases:
+- CVE-2021-4164
+- GHSA-wxr6-29pv-ch68
+summary: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
+details: calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: calibreweb
+    purl: pkg:pypi/calibreweb
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.6.15
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-4164
+- type: WEB
+  url: https://github.com/janeczku/calibre-web/commit/785726deee13b4d56f6c3503dd57c1e3eb7d6f30
+- type: PACKAGE
+  url: https://github.com/janeczku/calibre-web
+- type: WEB
+  url: https://huntr.dev/bounties/2debace1-a0f3-45c1-95fa-9d0512680758
+- type: PACKAGE
+  url: https://pypi.org/project/calibreweb
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wxr6-29pv-ch68
diff --git a/vulns/cheetah/PYSEC-0000-cheetah-GHSA-vxf2-7rc3-pxmx.yaml b/vulns/cheetah/PYSEC-0000-cheetah-GHSA-vxf2-7rc3-pxmx.yaml
new file mode 100644
index 000000000..95a16041d
--- /dev/null
+++ b/vulns/cheetah/PYSEC-0000-cheetah-GHSA-vxf2-7rc3-pxmx.yaml
@@ -0,0 +1,30 @@
+id: PYSEC-0000-cheetah-GHSA-vxf2-7rc3-pxmx
+modified: '2026-07-02T14:13:19.492605Z'
+published: '2026-07-02T14:13:19.492605Z'
+aliases:
+- CVE-2005-1632
+- GHSA-vxf2-7rc3-pxmx
+summary: Cheetah Path Search Order Hijacking
+details: Cheetah 0.9.15 and 0.9.16 searches the `/tmp` directory for modules before using the paths in the `PYTHONPATH` variable, which allows local users to execute arbitrary code via a malicious module in `/tmp/`.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: cheetah
+    purl: pkg:pypi/cheetah
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 0.9.15
+    - last_affected: 0.9.16
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2005-1632
+- type: PACKAGE
+  url: https://github.com/cheetahtemplate/cheetah
+- type: WEB
+  url: https://web.archive.org/web/20050430021153/http://sourceforge.net/mailarchive/forum.php?thread_id=7070332&forum_id=1542
+- type: PACKAGE
+  url: https://pypi.org/project/cheetah
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vxf2-7rc3-pxmx
diff --git a/vulns/cobbler/PYSEC-0000-cobbler-GHSA-4vc9-4xpq-77vm.yaml b/vulns/cobbler/PYSEC-0000-cobbler-GHSA-4vc9-4xpq-77vm.yaml
new file mode 100644
index 000000000..39cd7d7d2
--- /dev/null
+++ b/vulns/cobbler/PYSEC-0000-cobbler-GHSA-4vc9-4xpq-77vm.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-cobbler-GHSA-4vc9-4xpq-77vm
+modified: '2026-07-02T14:13:24.191314Z'
+published: '2026-07-02T14:13:24.191314Z'
+aliases:
+- CVE-2016-9605
+- GHSA-4vc9-4xpq-77vm
+summary: Cobbler Arbitrary File Read
+details: A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: cobbler
+    purl: pkg:pypi/cobbler
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 2.6.11-1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-9605
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9605
+- type: PACKAGE
+  url: https://github.com/cobbler/cobbler
+- type: PACKAGE
+  url: https://pypi.org/project/cobbler
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-4vc9-4xpq-77vm
diff --git a/vulns/cobbler/PYSEC-0000-cobbler-GHSA-9fqr-pqc9-f7pj.yaml b/vulns/cobbler/PYSEC-0000-cobbler-GHSA-9fqr-pqc9-f7pj.yaml
new file mode 100644
index 000000000..d14060fe2
--- /dev/null
+++ b/vulns/cobbler/PYSEC-0000-cobbler-GHSA-9fqr-pqc9-f7pj.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-cobbler-GHSA-9fqr-pqc9-f7pj
+modified: '2026-07-02T14:13:17.843067Z'
+published: '2026-07-02T14:13:17.843067Z'
+aliases:
+- CVE-2011-4952
+- GHSA-9fqr-pqc9-f7pj
+summary: Cobbler Web Interface Lacks CSRF Protection
+details: 'cobbler: Web interface lacks CSRF protection when using Django framework'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: cobbler
+    purl: pkg:pypi/cobbler
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.6.0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-4952
+- type: WEB
+  url: https://github.com/cobbler/cobbler/commit/18eb1c06779b37d89dfb2962a08236dd1bab24a6
+- type: WEB
+  url: https://github.com/cobbler/cobbler/commit/4bee30b4086a8d845bea5d39d6f2cba1f4a396aa
+- type: WEB
+  url: https://access.redhat.com/security/cve/cve-2011-4952
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4952
+- type: PACKAGE
+  url: https://github.com/cobbler/cobbler
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2011-4952
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2012/04/12/10
+- type: PACKAGE
+  url: https://pypi.org/project/cobbler
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9fqr-pqc9-f7pj
diff --git a/vulns/codechecker/PYSEC-0000-codechecker-GHSA-fxmx-pfm2-85m2.yaml b/vulns/codechecker/PYSEC-0000-codechecker-GHSA-fxmx-pfm2-85m2.yaml
new file mode 100644
index 000000000..950aa833b
--- /dev/null
+++ b/vulns/codechecker/PYSEC-0000-codechecker-GHSA-fxmx-pfm2-85m2.yaml
@@ -0,0 +1,44 @@
+id: PYSEC-0000-codechecker-GHSA-fxmx-pfm2-85m2
+modified: '2026-07-02T14:13:14.739420Z'
+published: '2026-07-02T14:13:14.739420Z'
+aliases:
+- CVE-2021-44217
+- GHSA-fxmx-pfm2-85m2
+summary: Cross-site Scripting in Ericsson CodeChecker
+details: In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: codechecker
+    purl: pkg:pypi/codechecker
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 6.18.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-44217
+- type: WEB
+  url: https://github.com/Ericsson/codechecker/pull/3549
+- type: WEB
+  url: https://github.com/Ericsson/codechecker/commit/72ee51158e6d81150320223b85410c179b9ee2b1
+- type: WEB
+  url: https://codechecker-demo.eastus.cloudapp.azure.com
+- type: PACKAGE
+  url: https://github.com/Ericsson/codechecker
+- type: WEB
+  url: https://github.com/Ericsson/codechecker/releases
+- type: WEB
+  url: https://github.com/Ericsson/codechecker/releases/tag/v6.18.2
+- type: WEB
+  url: https://github.com/Hyperkopite/CVE-2021-44217/blob/main/README.md
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/codechecker-api/PYSEC-2022-43181.yaml
+- type: WEB
+  url: https://user-images.githubusercontent.com/9525971/142965091-e118b012-a7fc-4c2f-ad0c-80aeed6f7ec9.png
+- type: PACKAGE
+  url: https://pypi.org/project/codechecker
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fxmx-pfm2-85m2
diff --git a/vulns/contentful/PYSEC-0000-contentful-GHSA-g5j6-r3x9-gf2m.yaml b/vulns/contentful/PYSEC-0000-contentful-GHSA-g5j6-r3x9-gf2m.yaml
new file mode 100644
index 000000000..2fa6731d8
--- /dev/null
+++ b/vulns/contentful/PYSEC-0000-contentful-GHSA-g5j6-r3x9-gf2m.yaml
@@ -0,0 +1,30 @@
+id: PYSEC-0000-contentful-GHSA-g5j6-r3x9-gf2m
+modified: '2026-07-02T14:13:10.258627Z'
+published: '2026-07-02T14:13:10.258627Z'
+aliases:
+- CVE-2020-13258
+- GHSA-g5j6-r3x9-gf2m
+summary: Cross-site scripting in Contentful
+details: Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: contentful
+    purl: pkg:pypi/contentful
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.12.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-13258
+- type: WEB
+  url: https://github.com/contentful/the-example-app.py/issues/44
+- type: PACKAGE
+  url: https://pypi.org/project/contentful
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-g5j6-r3x9-gf2m
diff --git a/vulns/cvrf2csaf/PYSEC-0000-cvrf2csaf-GHSA-m8gq-83gh-v42v.yaml b/vulns/cvrf2csaf/PYSEC-0000-cvrf2csaf-GHSA-m8gq-83gh-v42v.yaml
new file mode 100644
index 000000000..4b8b541d7
--- /dev/null
+++ b/vulns/cvrf2csaf/PYSEC-0000-cvrf2csaf-GHSA-m8gq-83gh-v42v.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-cvrf2csaf-GHSA-m8gq-83gh-v42v
+modified: '2026-07-02T14:13:16.551613Z'
+published: '2026-07-02T14:13:16.551613Z'
+aliases:
+- CVE-2022-27193
+- GHSA-m8gq-83gh-v42v
+summary: XML External Entities Vulnerability in CVRF-CSAF-Converter
+details: CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
+affected:
+- package:
+    ecosystem: PyPI
+    name: cvrf2csaf
+    purl: pkg:pypi/cvrf2csaf
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.0.0rc2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-27193
+- type: PACKAGE
+  url: https://github.com/csaf-tools/CVRF-CSAF-Converter
+- type: WEB
+  url: https://github.com/csaf-tools/CVRF-CSAF-Converter/releases/tag/1.0.0-rc2
+- type: PACKAGE
+  url: https://pypi.org/project/cvrf2csaf
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-m8gq-83gh-v42v
diff --git a/vulns/django-spirit/PYSEC-0000-django-spirit-GHSA-5p9j-w2wx-qx4c.yaml b/vulns/django-spirit/PYSEC-0000-django-spirit-GHSA-5p9j-w2wx-qx4c.yaml
new file mode 100644
index 000000000..8105e352b
--- /dev/null
+++ b/vulns/django-spirit/PYSEC-0000-django-spirit-GHSA-5p9j-w2wx-qx4c.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-django-spirit-GHSA-5p9j-w2wx-qx4c
+modified: '2026-07-02T14:13:15.599008Z'
+published: '2026-07-02T14:13:15.599008Z'
+aliases:
+- CVE-2022-0869
+- GHSA-5p9j-w2wx-qx4c
+summary: Open Redirect in django-spirit
+details: django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: django-spirit
+    purl: pkg:pypi/django-spirit
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.12.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-0869
+- type: WEB
+  url: https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef
+- type: PACKAGE
+  url: https://github.com/nitely/spirit
+- type: WEB
+  url: https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342
+- type: PACKAGE
+  url: https://pypi.org/project/django-spirit
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-5p9j-w2wx-qx4c
diff --git a/vulns/django-tinymce/PYSEC-0000-django-tinymce-GHSA-r8hm-w5f7-wj39.yaml b/vulns/django-tinymce/PYSEC-0000-django-tinymce-GHSA-r8hm-w5f7-wj39.yaml
new file mode 100644
index 000000000..85889e55d
--- /dev/null
+++ b/vulns/django-tinymce/PYSEC-0000-django-tinymce-GHSA-r8hm-w5f7-wj39.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-django-tinymce-GHSA-r8hm-w5f7-wj39
+modified: '2026-07-02T14:13:13.735617Z'
+published: '2026-07-02T14:13:13.735617Z'
+aliases:
+- CVE-2024-21910
+- GHSA-r8hm-w5f7-wj39
+summary: Cross-site scripting vulnerability in TinyMCE plugins
+details: "### Impact\nA cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.\n\n### Patches\nThis vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.\n\n### Workarounds\nTo work around this vulnerability, either:\n- Upgrade to TinyMCE 5.10.0 or higher\n- Disable the `image` and `link` plugins\n\n### Acknowledgements\nTiny Technologies would like to thank Yakir6 for discovering this vulnerability.\n\n### References\nhttps://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)\n* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)"
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: django-tinymce
+    purl: pkg:pypi/django-tinymce
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.0
+references:
+- type: WEB
+  url: https://github.com/tinymce/tinymce/security/advisories/GHSA-r8hm-w5f7-wj39
+- type: WEB
+  url: https://github.com/jazzband/django-tinymce/issues/366
+- type: WEB
+  url: https://github.com/jazzband/django-tinymce/releases/tag/3.4.0
+- type: PACKAGE
+  url: https://github.com/tinymce/tinymce
+- type: WEB
+  url: https://pypi.org/project/django-tinymce/3.4.0
+- type: PACKAGE
+  url: https://pypi.org/project/django-tinymce
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-r8hm-w5f7-wj39
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2024-21910
diff --git a/vulns/django/PYSEC-0000-django-GHSA-6c3j-c64m-qhgq.yaml b/vulns/django/PYSEC-0000-django-GHSA-6c3j-c64m-qhgq.yaml
new file mode 100644
index 000000000..ea6de3937
--- /dev/null
+++ b/vulns/django/PYSEC-0000-django-GHSA-6c3j-c64m-qhgq.yaml
@@ -0,0 +1,248 @@
+id: PYSEC-0000-django-GHSA-6c3j-c64m-qhgq
+modified: '2026-07-02T14:13:09.430399Z'
+published: '2026-07-02T14:13:09.430399Z'
+aliases:
+- CVE-2019-11358
+- GHSA-6c3j-c64m-qhgq
+summary: XSS in jQuery as used in Drupal, Backdrop CMS, and other products
+details: jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: django
+    purl: pkg:pypi/django
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.0a1
+    - fixed: 2.1.9
+    - introduced: 2.2a1
+    - fixed: 2.2.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-11358
+- type: WEB
+  url: https://github.com/maximebf/php-debugbar/issues/447
+- type: WEB
+  url: https://github.com/jquery/jquery/pull/4333
+- type: WEB
+  url: https://github.com/maximebf/php-debugbar/commit/847216e60544258c881f2733d699bbcfeefac0fc
+- type: WEB
+  url: https://github.com/django/django/commit/34ec52269ade54af31a021b12969913129571a3f
+- type: WEB
+  url: https://github.com/django/django/commit/95649bc08547a878cebfa1d019edec8cb1b80829
+- type: WEB
+  url: https://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad
+- type: WEB
+  url: https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5
+- type: WEB
+  url: https://seclists.org/bugtraq/2019/Apr/32
+- type: WEB
+  url: https://seclists.org/bugtraq/2019/Jun/12
+- type: WEB
+  url: https://seclists.org/bugtraq/2019/May/18
+- type: WEB
+  url: https://www.tenable.com/security/tns-2020-02
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2020/02/msg00024.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2019/05/msg00006.html
+- type: WEB
+  url: https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d@%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://www.tenable.com/security/tns-2019-08
+- type: WEB
+  url: https://www.synology.com/security/advisory/Synology_SA_19_19
+- type: WEB
+  url: https://www.privacy-wise.com/mitigating-cve-2019-11358-in-old-versions-of-jquery
+- type: WEB
+  url: https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
+- type: WEB
+  url: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuoct2021.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuoct2020.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpujul2020.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpujan2022.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpujan2021.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpujan2020.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuapr2020.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuApr2021.html
+- type: WEB
+  url: https://www.oracle.com//security-alerts/cpujul2021.html
+- type: WEB
+  url: https://www.drupal.org/sa-core-2019-006
+- type: WEB
+  url: https://www.djangoproject.com/weblog/2019/jun/03/security-releases
+- type: WEB
+  url: https://www.debian.org/security/2019/dsa-4460
+- type: WEB
+  url: https://www.debian.org/security/2019/dsa-4434
+- type: WEB
+  url: https://web.archive.org/web/20190824065237/http://www.securityfocus.com/bid/108023
+- type: WEB
+  url: https://supportportal.juniper.net/s/article/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1
+- type: WEB
+  url: https://snyk.io/vuln/SNYK-JS-JQUERY-174006
+- type: WEB
+  url: https://security.snyk.io/vuln/SNYK-DOTNET-JQUERY-450226
+- type: WEB
+  url: https://security.netapp.com/advisory/ntap-20190919-0001
+- type: WEB
+  url: https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7@%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f@%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844@%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601
+- type: WEB
+  url: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/jquery-rails/CVE-2019-11358.yml
+- type: WEB
+  url: https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434
+- type: PACKAGE
+  url: https://github.com/jquery/jquery
+- type: WEB
+  url: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released
+- type: WEB
+  url: https://backdropcms.org/security/backdrop-sa-core-2019-009
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2019:3024
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2019:3023
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2019:2587
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2019:1456
+- type: WEB
+  url: https://access.redhat.com/errata/RHBA-2019:1570
+- type: WEB
+  url: https://lists.apache.org/thread.html/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73@%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734@%3Cdev.storm.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355@%3Cdev.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08@%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766@%3Cdev.syncope.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa@%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9@%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6@%3Ccommits.roller.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205@%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: https://lists.apache.org/thread.html/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html
+- type: WEB
+  url: http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html
+- type: WEB
+  url: http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html
+- type: WEB
+  url: http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html
+- type: WEB
+  url: http://seclists.org/fulldisclosure/2019/May/10
+- type: WEB
+  url: http://seclists.org/fulldisclosure/2019/May/11
+- type: WEB
+  url: http://seclists.org/fulldisclosure/2019/May/13
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2019/06/03/2
+- type: WEB
+  url: http://www.securityfocus.com/bid/108023
+- type: PACKAGE
+  url: https://pypi.org/project/django
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-6c3j-c64m-qhgq
diff --git a/vulns/django/PYSEC-0000-django-GHSA-mwv2-398h-v489.yaml b/vulns/django/PYSEC-0000-django-GHSA-mwv2-398h-v489.yaml
new file mode 100644
index 000000000..45c68344d
--- /dev/null
+++ b/vulns/django/PYSEC-0000-django-GHSA-mwv2-398h-v489.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-django-GHSA-mwv2-398h-v489
+modified: '2026-07-02T14:13:19.912742Z'
+published: '2026-07-02T14:13:19.912742Z'
+aliases:
+- CVE-2007-0405
+- GHSA-mwv2-398h-v489
+summary: Django Improper Access Control
+details: The LazyUser class in the AuthenticationMiddleware for Django 0.95 does not properly cache the user name across requests, which allows remote authenticated users to gain the privileges of a different user.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: django
+    purl: pkg:pypi/django
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0.95'
+    - fixed: '1.0'
+  versions:
+  - '0.95'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0405
+- type: WEB
+  url: https://github.com/django/django/commit/3c5782287e
+- type: WEB
+  url: https://github.com/django/django/commit/e89f0a65581f82a5740bfe989136cea75d09cd67
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/31628
+- type: PACKAGE
+  url: https://github.com/django/django
+- type: WEB
+  url: http://code.djangoproject.com/changeset/3754
+- type: PACKAGE
+  url: https://pypi.org/project/django
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-mwv2-398h-v489
diff --git a/vulns/django/PYSEC-0000-django-GHSA-qc99-g3wm-hgxr.yaml b/vulns/django/PYSEC-0000-django-GHSA-qc99-g3wm-hgxr.yaml
new file mode 100644
index 000000000..b339ad8f8
--- /dev/null
+++ b/vulns/django/PYSEC-0000-django-GHSA-qc99-g3wm-hgxr.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-django-GHSA-qc99-g3wm-hgxr
+modified: '2026-07-02T14:13:20.006998Z'
+published: '2026-07-02T14:13:20.006998Z'
+aliases:
+- CVE-2007-0404
+- GHSA-qc99-g3wm-hgxr
+summary: Django Arbitrary Code Execution
+details: '`bin/compile-messages.py` in Django 0.95 does not quote argument strings before invoking the msgfmt program through the os.system function, which allows attackers to execute arbitrary commands via shell metacharacters in a (1) .po or (2) .mo file.'
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: django
+    purl: pkg:pypi/django
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0.95'
+    - fixed: '1.0'
+  versions:
+  - '0.95'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0404
+- type: WEB
+  url: https://github.com/django/django/commit/518d406e53
+- type: WEB
+  url: https://github.com/django/django/commit/a132d411c6986418ee6c0edc331080aa792fee6e
+- type: WEB
+  url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=407519
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/31627
+- type: PACKAGE
+  url: https://github.com/django/django
+- type: WEB
+  url: http://code.djangoproject.com/changeset/3592
+- type: PACKAGE
+  url: https://pypi.org/project/django
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-qc99-g3wm-hgxr
diff --git a/vulns/duplicity/PYSEC-0000-duplicity-GHSA-wxcw-rqxc-hj85.yaml b/vulns/duplicity/PYSEC-0000-duplicity-GHSA-wxcw-rqxc-hj85.yaml
new file mode 100644
index 000000000..c370dd063
--- /dev/null
+++ b/vulns/duplicity/PYSEC-0000-duplicity-GHSA-wxcw-rqxc-hj85.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-duplicity-GHSA-wxcw-rqxc-hj85
+modified: '2026-07-02T14:13:20.444898Z'
+published: '2026-07-02T14:13:20.444898Z'
+aliases:
+- CVE-2007-5201
+- GHSA-wxcw-rqxc-hj85
+summary: FTP backend for Duplicity Discloses Passwords to Process Listing
+details: The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: duplicity
+    purl: pkg:pypi/duplicity
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.4.9
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-5201
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=293081
+- type: PACKAGE
+  url: https://gitlab.com/duplicity/duplicity
+- type: WEB
+  url: https://web.archive.org/web/20080118045107/https://duplicity.nongnu.org/CHANGELOG
+- type: WEB
+  url: https://web.archive.org/web/20200228164800/http://www.securityfocus.com/bid/27771
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00356.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00445.html
+- type: WEB
+  url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=442840
+- type: PACKAGE
+  url: https://pypi.org/project/duplicity
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wxcw-rqxc-hj85
diff --git a/vulns/elastic-apm/PYSEC-0000-elastic-apm-GHSA-r562-m862-63w3.yaml b/vulns/elastic-apm/PYSEC-0000-elastic-apm-GHSA-r562-m862-63w3.yaml
new file mode 100644
index 000000000..29ab5513d
--- /dev/null
+++ b/vulns/elastic-apm/PYSEC-0000-elastic-apm-GHSA-r562-m862-63w3.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-elastic-apm-GHSA-r562-m862-63w3
+modified: '2026-07-02T14:13:14.213376Z'
+published: '2026-07-02T14:13:14.213376Z'
+aliases:
+- CVE-2021-37941
+- GHSA-r562-m862-63w3
+summary: APM Java Agent Local Privilege Escalation
+details: A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an application running with the APM Java agent. Using this vector, a malicious or compromised user account could use the agent to run commands at a higher level of permissions than they possess. This vulnerability affects users that have set up the agent via the attacher cli 3, the attach API 2, as well as users that have enabled the profiling_inferred_spans_enabled option
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: elastic-apm
+    purl: pkg:pypi/elastic-apm
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 1.10.0
+    - fixed: 1.27.0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-37941
+- type: WEB
+  url: https://discuss.elastic.co/t/apm-java-agent-security-update/289627
+- type: PACKAGE
+  url: https://github.com/elastic/apm-agent-python
+- type: PACKAGE
+  url: https://pypi.org/project/elastic-apm
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-r562-m862-63w3
diff --git a/vulns/flask-appbuilder/PYSEC-0000-flask-appbuilder-GHSA-2ccw-7px8-vmpf.yaml b/vulns/flask-appbuilder/PYSEC-0000-flask-appbuilder-GHSA-2ccw-7px8-vmpf.yaml
new file mode 100644
index 000000000..a69653433
--- /dev/null
+++ b/vulns/flask-appbuilder/PYSEC-0000-flask-appbuilder-GHSA-2ccw-7px8-vmpf.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-flask-appbuilder-GHSA-2ccw-7px8-vmpf
+modified: '2026-07-02T14:13:17.201505Z'
+published: '2026-07-02T14:13:17.201505Z'
+aliases:
+- CVE-2022-24776
+- GHSA-2ccw-7px8-vmpf
+summary: Open Redirect in Flask-AppBuilder
+details: "Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)\n"
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: flask-appbuilder
+    purl: pkg:pypi/flask-appbuilder
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.5
+references:
+- type: WEB
+  url: https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-2ccw-7px8-vmpf
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-24776
+- type: WEB
+  url: https://github.com/dpgaspar/Flask-AppBuilder/pull/1804
+- type: WEB
+  url: https://github.com/dpgaspar/Flask-AppBuilder/pull/1804/commits/5214d975ebad2ff32057443d2cc20fef1c04d0ea
+- type: PACKAGE
+  url: https://github.com/dpgaspar/Flask-AppBuilder
+- type: WEB
+  url: https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v3.4.5
+- type: PACKAGE
+  url: https://pypi.org/project/flask-appbuilder
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-2ccw-7px8-vmpf
diff --git a/vulns/freeipa/PYSEC-0000-freeipa-GHSA-7hpj-hfcr-5qwm.yaml b/vulns/freeipa/PYSEC-0000-freeipa-GHSA-7hpj-hfcr-5qwm.yaml
new file mode 100644
index 000000000..d81eb68e9
--- /dev/null
+++ b/vulns/freeipa/PYSEC-0000-freeipa-GHSA-7hpj-hfcr-5qwm.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-freeipa-GHSA-7hpj-hfcr-5qwm
+modified: '2026-07-02T14:13:14.030552Z'
+published: '2026-07-02T14:13:14.030552Z'
+aliases:
+- CVE-2019-14867
+- GHSA-7hpj-hfcr-5qwm
+summary: Code injection in FreeIPA
+details: A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some components of the IPA server, which parsed kerberos key data. An unauthenticated attacker who could trigger parsing of the krb principal key could cause the IPA server to crash or in some conditions, cause arbitrary code to be executed on the server hosting the IPA server.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: freeipa
+    purl: pkg:pypi/freeipa
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 4.6.2
+    - fixed: 4.6.7
+    - introduced: 4.7.0
+    - fixed: 4.7.4
+    - introduced: 4.8.0
+    - fixed: 4.8.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-14867
+- type: WEB
+  url: https://access.redhat.com/errata/RHBA-2019:4268
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2020:0378
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14867
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7hpj-hfcr-5qwm
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/ipa/PYSEC-2019-28.yaml
+- type: WEB
+  url: https://github.com/pypa/advisory-db/tree/main/vulns/ipa/PYSEC-2019-28.yaml
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/67SEUWJAJ5RMH5K4Q6TS2I7HIMXUGNKF
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLFL5XDCJ3WT6JCLCQVKHZBLHGW7PW4T
+- type: WEB
+  url: https://www.freeipa.org/page/Releases/4.6.7
+- type: WEB
+  url: https://www.freeipa.org/page/Releases/4.7.4
+- type: WEB
+  url: https://www.freeipa.org/page/Releases/4.8.3
+- type: PACKAGE
+  url: https://pypi.org/project/freeipa
diff --git a/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-7cr9-rmqr-fpqp.yaml b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-7cr9-rmqr-fpqp.yaml
new file mode 100644
index 000000000..a8ab2848e
--- /dev/null
+++ b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-7cr9-rmqr-fpqp.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-freetakserver-ui-GHSA-7cr9-rmqr-fpqp
+modified: '2026-07-02T14:13:16.273228Z'
+published: '2026-07-02T14:13:16.273228Z'
+aliases:
+- CVE-2022-25511
+- GHSA-7cr9-rmqr-fpqp
+summary: Path traversal in FreeTAKServer-UI
+details: An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: freetakserver-ui
+    purl: pkg:pypi/freetakserver-ui
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.9.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-25511
+- type: WEB
+  url: https://github.com/FreeTAKTeam/UI/issues/29
+- type: PACKAGE
+  url: https://github.com/FreeTAKTeam/UI
+- type: PACKAGE
+  url: https://pypi.org/project/freetakserver-ui
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7cr9-rmqr-fpqp
diff --git a/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-9988-f88m-mr42.yaml b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-9988-f88m-mr42.yaml
new file mode 100644
index 000000000..a53bedc5f
--- /dev/null
+++ b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-9988-f88m-mr42.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-freetakserver-ui-GHSA-9988-f88m-mr42
+modified: '2026-07-02T14:13:16.124889Z'
+published: '2026-07-02T14:13:16.124889Z'
+aliases:
+- CVE-2022-25512
+- GHSA-9988-f88m-mr42
+summary: Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
+details: FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: freetakserver-ui
+    purl: pkg:pypi/freetakserver-ui
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.9.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-25512
+- type: WEB
+  url: https://github.com/FreeTAKTeam/UI/issues/26
+- type: PACKAGE
+  url: https://github.com/FreeTAKTeam/UI
+- type: PACKAGE
+  url: https://pypi.org/project/freetakserver-ui
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9988-f88m-mr42
diff --git a/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-gjh6-wvhq-h4qx.yaml b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-gjh6-wvhq-h4qx.yaml
new file mode 100644
index 000000000..1bc34c4df
--- /dev/null
+++ b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-gjh6-wvhq-h4qx.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-freetakserver-ui-GHSA-gjh6-wvhq-h4qx
+modified: '2026-07-02T14:13:16.200355Z'
+published: '2026-07-02T14:13:16.200355Z'
+aliases:
+- CVE-2022-25507
+- GHSA-gjh6-wvhq-h4qx
+summary: Cross-site Scripting in FreeTAKServer-UI
+details: FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: freetakserver-ui
+    purl: pkg:pypi/freetakserver-ui
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.9.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-25507
+- type: WEB
+  url: https://github.com/FreeTAKTeam/UI/issues/28
+- type: PACKAGE
+  url: https://github.com/FreeTAKTeam/UI
+- type: PACKAGE
+  url: https://pypi.org/project/freetakserver-ui
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-gjh6-wvhq-h4qx
diff --git a/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-jr2m-29wj-w9qc.yaml b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-jr2m-29wj-w9qc.yaml
new file mode 100644
index 000000000..995270a58
--- /dev/null
+++ b/vulns/freetakserver-ui/PYSEC-0000-freetakserver-ui-GHSA-jr2m-29wj-w9qc.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-freetakserver-ui-GHSA-jr2m-29wj-w9qc
+modified: '2026-07-02T14:13:16.036947Z'
+published: '2026-07-02T14:13:16.036947Z'
+aliases:
+- CVE-2022-25506
+- GHSA-jr2m-29wj-w9qc
+summary: SQL Injection in FreeTAKServer-UI
+details: FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: freetakserver-ui
+    purl: pkg:pypi/freetakserver-ui
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.9.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-25506
+- type: WEB
+  url: https://github.com/FreeTAKTeam/UI/issues/27
+- type: PACKAGE
+  url: https://github.com/FreeTAKTeam/UI
+- type: PACKAGE
+  url: https://pypi.org/project/freetakserver-ui
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jr2m-29wj-w9qc
diff --git a/vulns/horizon/PYSEC-0000-horizon-GHSA-8g68-2hcj-h8vg.yaml b/vulns/horizon/PYSEC-0000-horizon-GHSA-8g68-2hcj-h8vg.yaml
new file mode 100644
index 000000000..2d556a65e
--- /dev/null
+++ b/vulns/horizon/PYSEC-0000-horizon-GHSA-8g68-2hcj-h8vg.yaml
@@ -0,0 +1,60 @@
+id: PYSEC-0000-horizon-GHSA-8g68-2hcj-h8vg
+modified: '2026-07-02T14:13:23.057018Z'
+published: '2026-07-02T14:13:23.057018Z'
+aliases:
+- CVE-2014-3594
+- GHSA-8g68-2hcj-h8vg
+summary: OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface
+details: Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: horizon
+    purl: pkg:pypi/horizon
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3594
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/ba2c98aea0db0d03200c811b86b3efe8367f3905
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/ba908ae88d5925f4f6783eb234cc4ea95017472b
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1188
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1335
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1336
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2014-3594
+- type: WEB
+  url: https://bugs.launchpad.net/horizon/+bug/1349491
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1129774
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/95378
+- type: WEB
+  url: https://review.openstack.org/#/c/115310
+- type: WEB
+  url: https://review.openstack.org/#/c/115311
+- type: WEB
+  url: https://review.openstack.org/#/c/115313
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2014-1335.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2014-1336.html
+- type: WEB
+  url: http://seclists.org/oss-sec/2014/q3/413
+- type: WEB
+  url: http://www.securityfocus.com/bid/69291
+- type: PACKAGE
+  url: https://pypi.org/project/horizon
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8g68-2hcj-h8vg
diff --git a/vulns/horizon/PYSEC-0000-horizon-GHSA-8vwv-2v7v-jmgr.yaml b/vulns/horizon/PYSEC-0000-horizon-GHSA-8vwv-2v7v-jmgr.yaml
new file mode 100644
index 000000000..c0b6abd99
--- /dev/null
+++ b/vulns/horizon/PYSEC-0000-horizon-GHSA-8vwv-2v7v-jmgr.yaml
@@ -0,0 +1,48 @@
+id: PYSEC-0000-horizon-GHSA-8vwv-2v7v-jmgr
+modified: '2026-07-02T14:13:23.188473Z'
+published: '2026-07-02T14:13:23.188473Z'
+aliases:
+- CVE-2014-3473
+- GHSA-8vwv-2v7v-jmgr
+summary: Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name
+details: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: horizon
+    purl: pkg:pypi/horizon
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3473
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/c844bd692894353c60b320005b804970605e910f
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/de4466d88b816437fb29eff5ab23b9b964cd3985
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:0939
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1188
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2014-3473
+- type: WEB
+  url: https://bugs.launchpad.net/horizon/+bug/1308727
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1116090
+- type: PACKAGE
+  url: https://opendev.org/openstack/horizon
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2014/07/08/6
+- type: WEB
+  url: http://www.securityfocus.com/bid/68459
+- type: PACKAGE
+  url: https://pypi.org/project/horizon
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8vwv-2v7v-jmgr
diff --git a/vulns/horizon/PYSEC-0000-horizon-GHSA-grm6-x6mr-q3cv.yaml b/vulns/horizon/PYSEC-0000-horizon-GHSA-grm6-x6mr-q3cv.yaml
new file mode 100644
index 000000000..6c41a589d
--- /dev/null
+++ b/vulns/horizon/PYSEC-0000-horizon-GHSA-grm6-x6mr-q3cv.yaml
@@ -0,0 +1,64 @@
+id: PYSEC-0000-horizon-GHSA-grm6-x6mr-q3cv
+modified: '2026-07-02T14:13:22.820828Z'
+published: '2026-07-02T14:13:22.820828Z'
+aliases:
+- CVE-2016-4428
+- GHSA-grm6-x6mr-q3cv
+summary: OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
+details: Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: horizon
+    purl: pkg:pypi/horizon
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.2
+    - introduced: 9.0.0
+    - fixed: 9.1.0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-4428
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1268
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1269
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1270
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1271
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1272
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2016-4428
+- type: WEB
+  url: https://bugs.launchpad.net/horizon/+bug/1567673
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1343982
+- type: WEB
+  url: https://review.openstack.org/329996
+- type: WEB
+  url: https://review.openstack.org/329997
+- type: WEB
+  url: https://review.openstack.org/329998
+- type: WEB
+  url: https://security.openstack.org/ossa/OSSA-2016-010.html
+- type: WEB
+  url: http://www.debian.org/security/2016/dsa-3617
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2016/06/17/4
+- type: PACKAGE
+  url: https://pypi.org/project/horizon
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-grm6-x6mr-q3cv
diff --git a/vulns/horizon/PYSEC-0000-horizon-GHSA-j57p-g33w-95c5.yaml b/vulns/horizon/PYSEC-0000-horizon-GHSA-j57p-g33w-95c5.yaml
new file mode 100644
index 000000000..40925f134
--- /dev/null
+++ b/vulns/horizon/PYSEC-0000-horizon-GHSA-j57p-g33w-95c5.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-horizon-GHSA-j57p-g33w-95c5
+modified: '2026-07-02T14:13:23.115590Z'
+published: '2026-07-02T14:13:23.115590Z'
+aliases:
+- CVE-2014-3474
+- GHSA-j57p-g33w-95c5
+summary: OpenStack Horizon Cross-site scripting (XSS) vulnerability
+details: Cross-site scripting (XSS) vulnerability in `horizon/static/horizon/js/horizon.instances.js` in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: horizon
+    purl: pkg:pypi/horizon
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3474
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/32a7b713468161282f2ea01d5e2faff980d924cd
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/c844bd692894353c60b320005b804970605e910f
+- type: WEB
+  url: https://github.com/openstack/horizon/commit/de4466d88b816437fb29eff5ab23b9b964cd3985
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:0939
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1188
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2014-3474
+- type: WEB
+  url: https://bugs.launchpad.net/horizon/+bug/1322197
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1116090
+- type: PACKAGE
+  url: https://opendev.org/openstack/horizon
+- type: WEB
+  url: https://review.opendev.org/c/openstack/horizon/+/105476
+- type: WEB
+  url: https://review.openstack.org/#/c/105477
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2014/07/08/6
+- type: WEB
+  url: http://www.securityfocus.com/bid/68460
+- type: PACKAGE
+  url: https://pypi.org/project/horizon
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-j57p-g33w-95c5
diff --git a/vulns/instack-undercloud/PYSEC-0000-instack-undercloud-GHSA-53wm-97p6-582f.yaml b/vulns/instack-undercloud/PYSEC-0000-instack-undercloud-GHSA-53wm-97p6-582f.yaml
new file mode 100644
index 000000000..da1117803
--- /dev/null
+++ b/vulns/instack-undercloud/PYSEC-0000-instack-undercloud-GHSA-53wm-97p6-582f.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-instack-undercloud-GHSA-53wm-97p6-582f
+modified: '2026-07-02T14:13:22.649014Z'
+published: '2026-07-02T14:13:22.649014Z'
+aliases:
+- CVE-2017-7549
+- GHSA-53wm-97p6-582f
+summary: instack-undercloud vulnerable to symlink attack on tmp files
+details: A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: instack-undercloud
+    purl: pkg:pypi/instack-undercloud
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 7.2.0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-7549
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2557
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2649
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2687
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2693
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2726
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2017-7549
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1477403
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/instack/PYSEC-2017-152.yaml
+- type: WEB
+  url: https://opendev.org/openstack/instack-undercloud
+- type: WEB
+  url: https://web.archive.org/web/20170907040549/http://www.securityfocus.com/bid/100407
+- type: WEB
+  url: http://www.securityfocus.com/bid/100407
+- type: PACKAGE
+  url: https://pypi.org/project/instack-undercloud
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-53wm-97p6-582f
diff --git a/vulns/ironic/PYSEC-0000-ironic-GHSA-f7cr-7c2c-fm8r.yaml b/vulns/ironic/PYSEC-0000-ironic-GHSA-f7cr-7c2c-fm8r.yaml
new file mode 100644
index 000000000..57ccd9631
--- /dev/null
+++ b/vulns/ironic/PYSEC-0000-ironic-GHSA-f7cr-7c2c-fm8r.yaml
@@ -0,0 +1,56 @@
+id: PYSEC-0000-ironic-GHSA-f7cr-7c2c-fm8r
+modified: '2026-07-02T14:13:22.984032Z'
+published: '2026-07-02T14:13:22.984032Z'
+aliases:
+- CVE-2016-4985
+- GHSA-f7cr-7c2c-fm8r
+summary: OpenStack Ironic Exposure of Sensitive Information to an Unauthorized Actor
+details: The ironic-api service in OpenStack Ironic before 4.2.5 (Liberty) and 5.x before 5.1.2 (Mitaka) allows remote attackers to obtain sensitive information about a registered node by leveraging knowledge of the MAC address of a network card belonging to that node and sending a crafted POST request to the `v1/drivers/$DRIVER_NAME/vendor_passthru` resource.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: ironic
+    purl: pkg:pypi/ironic
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.2.5
+    - introduced: '5.0'
+    - fixed: 5.1.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-4985
+- type: WEB
+  url: https://github.com/openstack/ironic/commit/426a306fb580762e97ada04e1253dedd9b64d410
+- type: WEB
+  url: https://github.com/openstack/ironic/commit/affec224977174581d19a2b914772cb0409f633e
+- type: WEB
+  url: https://github.com/openstack/ironic/commit/f5a3ff1dfcde068769f9a2a477ba6a9edaf69c77
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1377
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2016:1378
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2016-4985
+- type: WEB
+  url: https://bugs.launchpad.net/ironic/+bug/1572796
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1346193
+- type: PACKAGE
+  url: https://github.com/openstack/ironic
+- type: WEB
+  url: https://review.openstack.org/332195
+- type: WEB
+  url: https://review.openstack.org/332196
+- type: WEB
+  url: https://review.openstack.org/332197
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2016/06/21/6
+- type: PACKAGE
+  url: https://pypi.org/project/ironic
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-f7cr-7c2c-fm8r
diff --git a/vulns/jupyterhub/PYSEC-0000-jupyterhub-GHSA-rv62-4pmj-xw6h.yaml b/vulns/jupyterhub/PYSEC-0000-jupyterhub-GHSA-rv62-4pmj-xw6h.yaml
new file mode 100644
index 000000000..a17ec39de
--- /dev/null
+++ b/vulns/jupyterhub/PYSEC-0000-jupyterhub-GHSA-rv62-4pmj-xw6h.yaml
@@ -0,0 +1,44 @@
+id: PYSEC-0000-jupyterhub-GHSA-rv62-4pmj-xw6h
+modified: '2026-07-02T14:13:09.322452Z'
+published: '2026-07-02T14:13:09.322452Z'
+aliases:
+- CVE-2019-10255
+- GHSA-rv62-4pmj-xw6h
+summary: Open Redirect vulnerability in jupyterhub and notebook
+details: An Open Redirect vulnerability for all browsers in Jupyter Notebook before 5.7.8 and some browsers (Chrome, Firefox) in JupyterHub before 0.9.6 allows crafted links to the login page, which will redirect to a malicious site after successful login. Servers running on a base_url prefix are not affected.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: jupyterhub
+    purl: pkg:pypi/jupyterhub
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.9.6
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-10255
+- type: WEB
+  url: https://github.com/jupyter/notebook/commit/08c4c898182edbe97aadef1815cce50448f975cb
+- type: WEB
+  url: https://github.com/jupyter/notebook/commit/70fe9f0ddb3023162ece21fbb77d5564306b913b
+- type: WEB
+  url: https://github.com/jupyter/notebook/commit/d65328d4841892b412aef9015165db1eb029a8ed
+- type: WEB
+  url: https://blog.jupyter.org/open-redirect-vulnerability-in-jupyter-jupyterhub-adf43583f1e4
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-rv62-4pmj-xw6h
+- type: PACKAGE
+  url: https://github.com/jupyter/notebook
+- type: WEB
+  url: https://github.com/jupyter/notebook/compare/05aa4b2...16cf97c
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UP5RLEES2JBBNSNLBR65XM6PCD4EMF7D
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VMDPJBVXOVO6LYGAT46VZNHH6JKSCURO
+- type: PACKAGE
+  url: https://pypi.org/project/jupyterhub
diff --git a/vulns/kallithea/PYSEC-0000-kallithea-GHSA-799h-qr84-pcrp.yaml b/vulns/kallithea/PYSEC-0000-kallithea-GHSA-799h-qr84-pcrp.yaml
new file mode 100644
index 000000000..febc4fd49
--- /dev/null
+++ b/vulns/kallithea/PYSEC-0000-kallithea-GHSA-799h-qr84-pcrp.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-kallithea-GHSA-799h-qr84-pcrp
+modified: '2026-07-02T14:13:24.113671Z'
+published: '2026-07-02T14:13:24.113671Z'
+aliases:
+- CVE-2016-3691
+- GHSA-799h-qr84-pcrp
+summary: Kallithea Routes CSRF Bypass
+details: Routes in Kallithea before 0.3.2 allows remote attackers to bypass the CSRF protection by using the GET HTTP request method.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: kallithea
+    purl: pkg:pypi/kallithea
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.3.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-3691
+- type: PACKAGE
+  url: https://github.com/NexMirror/Kallithea
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2016/05/02/3
+- type: PACKAGE
+  url: https://pypi.org/project/kallithea
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-799h-qr84-pcrp
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-274v-r947-v34r.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-274v-r947-v34r.yaml
new file mode 100644
index 000000000..fe75912e7
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-274v-r947-v34r.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-keystone-GHSA-274v-r947-v34r
+modified: '2026-07-02T14:13:23.805823Z'
+published: '2026-07-02T14:13:23.805823Z'
+aliases:
+- CVE-2014-3476
+- GHSA-274v-r947-v34r
+summary: OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege
+details: OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3476
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1324592
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00031.html
+- type: WEB
+  url: http://secunia.com/advisories/57886
+- type: WEB
+  url: http://secunia.com/advisories/59547
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2014/06/12/3
+- type: WEB
+  url: http://www.securityfocus.com/bid/68026
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-274v-r947-v34r
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-4ppj-4p4v-jf4p.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-4ppj-4p4v-jf4p.yaml
new file mode 100644
index 000000000..42024daec
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-4ppj-4p4v-jf4p.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-keystone-GHSA-4ppj-4p4v-jf4p
+modified: '2026-07-02T14:13:22.017502Z'
+published: '2026-07-02T14:13:22.017502Z'
+aliases:
+- CVE-2013-0270
+- GHSA-4ppj-4p4v-jf4p
+summary: OpenStack Keystone Denial of Service vulnerability via a large HTTP request
+details: OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0270
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2013-0270
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1099025
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=909012
+- type: WEB
+  url: https://launchpad.net/keystone/grizzly/2013.1
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2013-0708.html
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-4ppj-4p4v-jf4p
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-7332-36h8-8jh8.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-7332-36h8-8jh8.yaml
new file mode 100644
index 000000000..02cfc0ecc
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-7332-36h8-8jh8.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-keystone-GHSA-7332-36h8-8jh8
+modified: '2026-07-02T14:13:23.743769Z'
+published: '2026-07-02T14:13:23.743769Z'
+aliases:
+- CVE-2013-2014
+- GHSA-7332-36h8-8jh8
+summary: OpenStack Identity (Keystone) Denial of Service
+details: OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2014
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1098177
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1099025
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/84347
+- type: WEB
+  url: http://lists.fedoraproject.org/pipermail/package-announce/2013-July/111914.html
+- type: WEB
+  url: http://secunia.com/advisories/53397
+- type: WEB
+  url: http://www.securityfocus.com/bid/59936
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7332-36h8-8jh8
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-8833-qrvm-wc3h.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-8833-qrvm-wc3h.yaml
new file mode 100644
index 000000000..431646770
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-8833-qrvm-wc3h.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-keystone-GHSA-8833-qrvm-wc3h
+modified: '2026-07-02T14:13:22.090672Z'
+published: '2026-07-02T14:13:22.090672Z'
+aliases:
+- CVE-2013-0282
+- GHSA-8833-qrvm-wc3h
+summary: OpenStack Keystone allows context-dependent attackers to bypass access restrictions
+details: OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-0282
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/7402f5ef994599653bdbb3ed5ff1a2b8c3e72b9f
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/9572bfc393f66f5ce3b44c0a77a9e29cc0374c6f
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/f0b4d300db5cc61d4f079f8bce9da8e8bea1081a
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1121494
+- type: WEB
+  url: https://launchpad.net/keystone/+milestone/2012.2.4
+- type: WEB
+  url: https://launchpad.net/keystone/grizzly/2013.1
+- type: WEB
+  url: https://review.openstack.org/#/c/22319
+- type: WEB
+  url: https://review.openstack.org/#/c/22320
+- type: WEB
+  url: https://review.openstack.org/#/c/22321
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2013/02/19/3
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8833-qrvm-wc3h
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-8v8f-vc72-pmhc.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-8v8f-vc72-pmhc.yaml
new file mode 100644
index 000000000..06b3f47a5
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-8v8f-vc72-pmhc.yaml
@@ -0,0 +1,52 @@
+id: PYSEC-0000-keystone-GHSA-8v8f-vc72-pmhc
+modified: '2026-07-02T14:13:23.972537Z'
+published: '2026-07-02T14:13:23.972537Z'
+aliases:
+- CVE-2014-3621
+- GHSA-8v8f-vc72-pmhc
+summary: OpenStack Identity Keystone Exposure of Sensitive Information
+details: The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-3621
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/2989ff257e4fde6a168e25b926805e700406aa80
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/52714633c9a4dae5e60279217090859aa6dbcb4f
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1688
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1789
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2014:1790
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2014-3621
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1354208
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1139937
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2014-1688.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2014-1789.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2014-1790.html
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2014/09/16/10
+- type: WEB
+  url: http://www.ubuntu.com/usn/USN-2406-1
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8v8f-vc72-pmhc
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-c4p9-87h3-7vr4.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-c4p9-87h3-7vr4.yaml
new file mode 100644
index 000000000..e3802c5ae
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-c4p9-87h3-7vr4.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-keystone-GHSA-c4p9-87h3-7vr4
+modified: '2026-07-02T14:13:23.908910Z'
+published: '2026-07-02T14:13:23.908910Z'
+aliases:
+- CVE-2014-0204
+- GHSA-c4p9-87h3-7vr4
+summary: OpenStack Identity Keystone Improper Privilege Management
+details: OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2014-0204
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/729dcad7384ba66ee7494154969cdd7ae90d86ee
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/786af9829c5329a982e3451f77afebbfb21850bd
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/97dfd55ad1b40365754dcbfce856f7ffae280a44
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/f0eee2f3b48dd0cffb9f75e396da2d914925cba5
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1309228
+- type: WEB
+  url: https://review.openstack.org/#/c/94396
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2014/05/21/3
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-c4p9-87h3-7vr4
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-jwpw-ppj5-7h4w.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-jwpw-ppj5-7h4w.yaml
new file mode 100644
index 000000000..a340c9b3f
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-jwpw-ppj5-7h4w.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-keystone-GHSA-jwpw-ppj5-7h4w
+modified: '2026-07-02T14:13:23.853843Z'
+published: '2026-07-02T14:13:23.853843Z'
+aliases:
+- CVE-2015-3646
+- GHSA-jwpw-ppj5-7h4w
+summary: OpenStack Keystone Logs Passwords
+details: OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '2011.3'
+    - fixed: 2014.1.5
+    - introduced: '2014.2'
+    - fixed: 2014.2.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2015-3646
+- type: WEB
+  url: https://bugs.launchpad.net/keystone/+bug/1443598
+- type: PACKAGE
+  url: https://github.com/openstack/keystone
+- type: WEB
+  url: https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456
+- type: WEB
+  url: http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html
+- type: WEB
+  url: http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jwpw-ppj5-7h4w
diff --git a/vulns/keystone/PYSEC-0000-keystone-GHSA-qh2x-hpf9-cf2g.yaml b/vulns/keystone/PYSEC-0000-keystone-GHSA-qh2x-hpf9-cf2g.yaml
new file mode 100644
index 000000000..9d8a91752
--- /dev/null
+++ b/vulns/keystone/PYSEC-0000-keystone-GHSA-qh2x-hpf9-cf2g.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-keystone-GHSA-qh2x-hpf9-cf2g
+modified: '2026-07-02T14:13:21.847931Z'
+published: '2026-07-02T14:13:21.847931Z'
+aliases:
+- CVE-2013-2255
+- GHSA-qh2x-hpf9-cf2g
+summary: OpenStack Keystone and other components vulnerable to Improper Certificate Validation
+details: HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: keystone
+    purl: pkg:pypi/keystone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 8.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2255
+- type: WEB
+  url: https://github.com/openstack/cinder/commit/0f9652d92e175a1f7dc3c2a37ab444b8f189375a
+- type: WEB
+  url: https://github.com/openstack/keystone/commit/5bd4c2984d329625a2a8442b316fa235dbb88a3d
+- type: WEB
+  url: https://github.com/openstack/neutron/commit/7255e056092f034daaeb4246a812900645d46911
+- type: WEB
+  url: https://github.com/openstack/python-keystoneclient/commit/20e166fd8a943ee3f91ba362a47e9c14c7cc5f4c
+- type: WEB
+  url: https://access.redhat.com/security/cve/cve-2013-2255
+- type: WEB
+  url: https://bugs.launchpad.net/ossn/+bug/1188189
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2255
+- type: WEB
+  url: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2255
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/85562
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2013-2255
+- type: WEB
+  url: https://web.archive.org/web/20200229073508/https://www.securityfocus.com/bid/61118
+- type: PACKAGE
+  url: https://pypi.org/project/keystone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-qh2x-hpf9-cf2g
diff --git a/vulns/mailman/PYSEC-0000-mailman-GHSA-82rm-28q9-435p.yaml b/vulns/mailman/PYSEC-0000-mailman-GHSA-82rm-28q9-435p.yaml
new file mode 100644
index 000000000..1fce27ce2
--- /dev/null
+++ b/vulns/mailman/PYSEC-0000-mailman-GHSA-82rm-28q9-435p.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-mailman-GHSA-82rm-28q9-435p
+modified: '2026-07-02T14:13:18.100267Z'
+published: '2026-07-02T14:13:18.100267Z'
+aliases:
+- CVE-2003-0038
+- GHSA-82rm-28q9-435p
+summary: 'Mailman Cross-site scripting (XSS) vulnerability '
+details: Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: mailman
+    purl: pkg:pypi/mailman
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.1.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2003-0038
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/11152
+- type: WEB
+  url: http://marc.info/?l=bugtraq&m=104342745916111
+- type: WEB
+  url: http://telia.dl.sourceforge.net/sourceforge/mailman/xss-2.1.0-patch.txt
+- type: WEB
+  url: http://www.debian.org/security/2004/dsa-436
+- type: WEB
+  url: http://www.osvdb.org/9205
+- type: WEB
+  url: http://www.securityfocus.com/bid/6677
+- type: WEB
+  url: http://www.securitytracker.com/id?1005987
+- type: PACKAGE
+  url: https://pypi.org/project/mailman
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-82rm-28q9-435p
diff --git a/vulns/mailman/PYSEC-0000-mailman-GHSA-hj4h-vqpq-95wg.yaml b/vulns/mailman/PYSEC-0000-mailman-GHSA-hj4h-vqpq-95wg.yaml
new file mode 100644
index 000000000..6fdb72b7f
--- /dev/null
+++ b/vulns/mailman/PYSEC-0000-mailman-GHSA-hj4h-vqpq-95wg.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-mailman-GHSA-hj4h-vqpq-95wg
+modified: '2026-07-02T14:13:18.155048Z'
+published: '2026-07-02T14:13:18.155048Z'
+aliases:
+- CVE-2004-0412
+- GHSA-hj4h-vqpq-95wg
+summary: Mailman Sensitive Information Disclosure
+details: Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: mailman
+    purl: pkg:pypi/mailman
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.1.5
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-0412
+- type: WEB
+  url: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=123559
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/16256
+- type: WEB
+  url: https://gitlab.com/mailman
+- type: WEB
+  url: http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000842
+- type: WEB
+  url: http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html
+- type: WEB
+  url: http://marc.info/?l=bugtraq&m=109034869927955&w=2
+- type: WEB
+  url: http://secunia.com/advisories/11701
+- type: WEB
+  url: http://security.gentoo.org/glsa/glsa-200406-04.xml
+- type: WEB
+  url: http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:051
+- type: WEB
+  url: http://www.securityfocus.com/bid/10412
+- type: PACKAGE
+  url: https://pypi.org/project/mailman
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hj4h-vqpq-95wg
diff --git a/vulns/mailman/PYSEC-0000-mailman-GHSA-rh6c-jh4c-9fg3.yaml b/vulns/mailman/PYSEC-0000-mailman-GHSA-rh6c-jh4c-9fg3.yaml
new file mode 100644
index 000000000..4da847397
--- /dev/null
+++ b/vulns/mailman/PYSEC-0000-mailman-GHSA-rh6c-jh4c-9fg3.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-mailman-GHSA-rh6c-jh4c-9fg3
+modified: '2026-07-02T14:13:18.382841Z'
+published: '2026-07-02T14:13:18.382841Z'
+aliases:
+- CVE-2004-1177
+- GHSA-rh6c-jh4c-9fg3
+summary: 'mailman Cross-site scripting (XSS) vulnerability '
+details: Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: mailman
+    purl: pkg:pypi/mailman
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.1.5
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-1177
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/18854
+- type: PACKAGE
+  url: https://github.com/terencehonles/mailman
+- type: WEB
+  url: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11113
+- type: WEB
+  url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=287555
+- type: WEB
+  url: http://marc.info/?l=bugtraq&m=110549296126351&w=2
+- type: WEB
+  url: http://secunia.com/advisories/13603
+- type: WEB
+  url: http://www.debian.org/security/2005/dsa-674
+- type: WEB
+  url: http://www.mandriva.com/security/advisories?name=MDKSA-2005:015
+- type: WEB
+  url: http://www.novell.com/linux/security/advisories/2005_07_mailman.html
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2005-235.html
+- type: PACKAGE
+  url: https://pypi.org/project/mailman
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-rh6c-jh4c-9fg3
diff --git a/vulns/mailman/PYSEC-0000-mailman-GHSA-xq58-69h2-765m.yaml b/vulns/mailman/PYSEC-0000-mailman-GHSA-xq58-69h2-765m.yaml
new file mode 100644
index 000000000..b5866a157
--- /dev/null
+++ b/vulns/mailman/PYSEC-0000-mailman-GHSA-xq58-69h2-765m.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-mailman-GHSA-xq58-69h2-765m
+modified: '2026-07-02T14:13:14.288696Z'
+published: '2026-07-02T14:13:14.288696Z'
+aliases:
+- CVE-2021-44227
+- GHSA-xq58-69h2-765m
+summary: Cross Site Request Forgery in mailman
+details: In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: mailman
+    purl: pkg:pypi/mailman
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.1.38
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-44227
+- type: WEB
+  url: https://bugs.launchpad.net/mailman/+bug/1952384
+- type: PACKAGE
+  url: https://gitlab.com/mailman/mailman
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2022/06/msg00011.html
+- type: PACKAGE
+  url: https://pypi.org/project/mailman
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-xq58-69h2-765m
diff --git a/vulns/mailman/PYSEC-0000-mailman-GHSA-xqvg-xm9m-p2c4.yaml b/vulns/mailman/PYSEC-0000-mailman-GHSA-xqvg-xm9m-p2c4.yaml
new file mode 100644
index 000000000..46f97c334
--- /dev/null
+++ b/vulns/mailman/PYSEC-0000-mailman-GHSA-xqvg-xm9m-p2c4.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-mailman-GHSA-xqvg-xm9m-p2c4
+modified: '2026-07-02T14:13:09.148549Z'
+published: '2026-07-02T14:13:09.148549Z'
+aliases:
+- CVE-2018-13796
+- GHSA-xqvg-xm9m-p2c4
+summary: Moderate severity vulnerability that affects mailman
+details: An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: mailman
+    purl: pkg:pypi/mailman
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.1.28
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-13796
+- type: WEB
+  url: https://bugs.launchpad.net/mailman/+bug/1780874
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-xqvg-xm9m-p2c4
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00034.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201904-10
+- type: WEB
+  url: https://usn.ubuntu.com/4348-1
+- type: WEB
+  url: https://www.mail-archive.com/mailman-users@python.org/msg71003.html
+- type: PACKAGE
+  url: https://pypi.org/project/mailman
diff --git a/vulns/manila-ui/PYSEC-0000-manila-ui-GHSA-vq76-5ghr-9p4v.yaml b/vulns/manila-ui/PYSEC-0000-manila-ui-GHSA-vq76-5ghr-9p4v.yaml
new file mode 100644
index 000000000..987dd9ea0
--- /dev/null
+++ b/vulns/manila-ui/PYSEC-0000-manila-ui-GHSA-vq76-5ghr-9p4v.yaml
@@ -0,0 +1,48 @@
+id: PYSEC-0000-manila-ui-GHSA-vq76-5ghr-9p4v
+modified: '2026-07-02T14:13:22.326003Z'
+published: '2026-07-02T14:13:22.326003Z'
+aliases:
+- CVE-2016-6519
+- GHSA-vq76-5ghr-9p4v
+summary: Openstack Manila Persistent XSS in Metadata field
+details: Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: manila-ui
+    purl: pkg:pypi/manila-ui
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.5.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-6519
+- type: WEB
+  url: https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696
+- type: WEB
+  url: https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd
+- type: WEB
+  url: https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43
+- type: WEB
+  url: https://bugs.launchpad.net/manila-ui/+bug/1597738
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1375147
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2016-2115.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2016-2116.html
+- type: WEB
+  url: http://rhn.redhat.com/errata/RHSA-2016-2117.html
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2016/09/15/7
+- type: WEB
+  url: http://www.securityfocus.com/bid/93001
+- type: PACKAGE
+  url: https://pypi.org/project/manila-ui
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vq76-5ghr-9p4v
diff --git a/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-4822-jvwx-w47h.yaml b/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-4822-jvwx-w47h.yaml
new file mode 100644
index 000000000..09125ef31
--- /dev/null
+++ b/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-4822-jvwx-w47h.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-matrix-synapse-GHSA-4822-jvwx-w47h
+modified: '2026-07-02T14:13:17.409521Z'
+published: '2026-07-02T14:13:17.409521Z'
+aliases:
+- CVE-2022-41952
+- GHSA-4822-jvwx-w47h
+summary: Uncontrolled Resource Consumption in Matrix Synapse
+details: "### Impact\n\nSynapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast).\n\nThis can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled.\n\n### Patches\n1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview.\n\nWe recommend upgrading to 1.53.0 to fully resolve the issue.\n\n### Workarounds\nTurn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.\n\n### References\n- Patch (timeout): https://github.com/matrix-org/synapse/pull/11784\n- Patch (content type allow list): https://github.com/matrix-org/synapse/pull/11936\n\n### For more information\nIf you have any questions or comments about this advisory, e-mail us at security@matrix.org.\n"
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+affected:
+- package:
+    ecosystem: PyPI
+    name: matrix-synapse
+    purl: pkg:pypi/matrix-synapse
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.53.0
+references:
+- type: WEB
+  url: https://github.com/matrix-org/synapse/security/advisories/GHSA-4822-jvwx-w47h
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-41952
+- type: WEB
+  url: https://github.com/matrix-org/synapse/pull/11784
+- type: WEB
+  url: https://github.com/matrix-org/synapse/pull/11936
+- type: PACKAGE
+  url: https://github.com/matrix-org/synapse
+- type: WEB
+  url: https://github.com/matrix-org/synapse/releases/tag/v1.52.0
+- type: WEB
+  url: https://github.com/matrix-org/synapse/releases/tag/v1.53.0
+- type: PACKAGE
+  url: https://pypi.org/project/matrix-synapse
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-4822-jvwx-w47h
diff --git a/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-v8wm-g9f2-xjv4.yaml b/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-v8wm-g9f2-xjv4.yaml
new file mode 100644
index 000000000..ee8a9516e
--- /dev/null
+++ b/vulns/matrix-synapse/PYSEC-0000-matrix-synapse-GHSA-v8wm-g9f2-xjv4.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-matrix-synapse-GHSA-v8wm-g9f2-xjv4
+modified: '2026-07-02T14:13:24.881978Z'
+published: '2026-07-02T14:13:24.881978Z'
+aliases:
+- CVE-2018-12291
+- GHSA-v8wm-g9f2-xjv4
+summary: Matrix Synapse Security Filtering Flaw
+details: The `on_get_missing_events` function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: matrix-synapse
+    purl: pkg:pypi/matrix-synapse
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.31.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-12291
+- type: WEB
+  url: https://github.com/matrix-org/synapse/pull/3371
+- type: WEB
+  url: https://github.com/matrix-org/synapse/commit/0834b49c6a9b6c597a154d4b2dfcf8fff90699ec
+- type: PACKAGE
+  url: https://github.com/matrix-org/synapse
+- type: WEB
+  url: https://github.com/matrix-org/synapse/releases/tag/v0.31.1
+- type: PACKAGE
+  url: https://pypi.org/project/matrix-synapse
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-v8wm-g9f2-xjv4
diff --git a/vulns/mercurial/PYSEC-0000-mercurial-GHSA-7gf7-7wx4-mxmw.yaml b/vulns/mercurial/PYSEC-0000-mercurial-GHSA-7gf7-7wx4-mxmw.yaml
new file mode 100644
index 000000000..9bcc2a587
--- /dev/null
+++ b/vulns/mercurial/PYSEC-0000-mercurial-GHSA-7gf7-7wx4-mxmw.yaml
@@ -0,0 +1,44 @@
+id: PYSEC-0000-mercurial-GHSA-7gf7-7wx4-mxmw
+modified: '2026-07-02T14:13:17.606556Z'
+published: '2026-07-02T14:13:17.606556Z'
+aliases:
+- CVE-2010-4237
+- GHSA-7gf7-7wx4-mxmw
+summary: Mercurial Improper Certificate Validation vulnerability
+details: Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: mercurial
+    purl: pkg:pypi/mercurial
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.6.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2010-4237
+- type: WEB
+  url: https://github.com/dscho/hg/commit/4ea63fb25ceeeaaa4cd1026f733b7ea7672c30b3
+- type: WEB
+  url: https://github.com/dscho/hg/commit/89baabf4fb7abf30ef6fdcf3d455a7893e5cc145
+- type: WEB
+  url: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598841
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4237
+- type: WEB
+  url: https://bz.mercurial-scm.org/show_bug.cgi?id=2407
+- type: WEB
+  url: https://repo.mercurial-scm.org/hg/rev/6ab4a7d3c179
+- type: WEB
+  url: https://repo.mercurial-scm.org/hg/rev/f2937d6492c5
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2010-4237
+- type: PACKAGE
+  url: https://pypi.org/project/mercurial
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7gf7-7wx4-mxmw
diff --git a/vulns/mercurial/PYSEC-0000-mercurial-GHSA-v2gw-x5jf-pgwv.yaml b/vulns/mercurial/PYSEC-0000-mercurial-GHSA-v2gw-x5jf-pgwv.yaml
new file mode 100644
index 000000000..4c320a69b
--- /dev/null
+++ b/vulns/mercurial/PYSEC-0000-mercurial-GHSA-v2gw-x5jf-pgwv.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-mercurial-GHSA-v2gw-x5jf-pgwv
+modified: '2026-07-02T14:13:21.096985Z'
+published: '2026-07-02T14:13:21.096985Z'
+aliases:
+- CVE-2008-2942
+- GHSA-v2gw-x5jf-pgwv
+summary: Mercurial Directory traversal vulnerability
+details: Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: mercurial
+    purl: pkg:pypi/mercurial
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.0.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-2942
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/43551
+- type: PACKAGE
+  url: https://github.com/dscho/hg
+- type: WEB
+  url: https://issues.rpath.com/browse/RPL-2633
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html
+- type: WEB
+  url: http://secunia.com/advisories/31108
+- type: WEB
+  url: http://secunia.com/advisories/31110
+- type: WEB
+  url: http://secunia.com/advisories/31167
+- type: WEB
+  url: http://security.gentoo.org/glsa/glsa-200807-09.xml
+- type: WEB
+  url: http://wiki.rpath.com/Advisories:rPSA-2008-0211
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2008/06/30/1
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2008/07/01/1
+- type: WEB
+  url: http://www.securityfocus.com/archive/1/493881/100/0/threaded
+- type: WEB
+  url: http://www.securityfocus.com/bid/30072
+- type: WEB
+  url: http://www.selenic.com/hg/rev/87c704ac92d4
+- type: PACKAGE
+  url: https://pypi.org/project/mercurial
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-v2gw-x5jf-pgwv
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-53wj-6m7w-j6mj.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-53wj-6m7w-j6mj.yaml
new file mode 100644
index 000000000..bbf917100
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-53wj-6m7w-j6mj.yaml
@@ -0,0 +1,56 @@
+id: PYSEC-0000-moin-GHSA-53wj-6m7w-j6mj
+modified: '2026-07-02T14:13:20.523188Z'
+published: '2026-07-02T14:13:20.523188Z'
+aliases:
+- CVE-2008-0780
+- GHSA-53wj-6m7w-j6mj
+summary: MoinMoin Cross-site scripting (XSS) vulnerability
+details: Cross-site scripting (XSS) vulnerability in MoinMoin 1.5.x through 1.5.8 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the login action.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '1.5'
+    - fixed: 1.6.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-0780
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=432747
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00726.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00752.html
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/2f952fa361c7
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.6/rev/9f4bdc7ef80d
+- type: WEB
+  url: http://secunia.com/advisories/28987
+- type: WEB
+  url: http://secunia.com/advisories/29010
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://secunia.com/advisories/29444
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/27904
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2008/0569/references
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-53wj-6m7w-j6mj
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-6766-r2rx-mfw9.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-6766-r2rx-mfw9.yaml
new file mode 100644
index 000000000..79e3ce720
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-6766-r2rx-mfw9.yaml
@@ -0,0 +1,52 @@
+id: PYSEC-0000-moin-GHSA-6766-r2rx-mfw9
+modified: '2026-07-02T14:13:20.636177Z'
+published: '2026-07-02T14:13:20.636177Z'
+aliases:
+- CVE-2008-0782
+- GHSA-6766-r2rx-mfw9
+summary: MoinMoin Directory traversal vulnerability
+details: 'Directory traversal vulnerability in MoinMoin 1.5.8 and earlier allows remote attackers to overwrite arbitrary files via a `..` (dot dot) in the MOIN_ID user ID in a cookie for a userform action.  NOTE: this issue can be leveraged for PHP code execution via the quicklinks parameter. The issue has been fixed on [e69a16b6e630](http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630).'
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-0782
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/39837
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://www.exploit-db.com/exploits/4957
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/e69a16b6e630
+- type: WEB
+  url: http://secunia.com/advisories/29010
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://secunia.com/advisories/29444
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.attrition.org/pipermail/vim/2008-January/001890.html
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/27404
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2008/0569/references
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-6766-r2rx-mfw9
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-775g-4482-pm94.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-775g-4482-pm94.yaml
new file mode 100644
index 000000000..307e43562
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-775g-4482-pm94.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-moin-GHSA-775g-4482-pm94
+modified: '2026-07-02T14:13:20.575874Z'
+published: '2026-07-02T14:13:20.575874Z'
+aliases:
+- CVE-2008-0781
+- GHSA-775g-4482-pm94
+summary: MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
+details: Multiple cross-site scripting (XSS) vulnerabilities in `action/AttachFile.py` in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) message, (2) pagename, and (3) target filenames. The issue was fixed on [db212dfc58ef](http://hg.moinmo.in/moin/1.5/rev/db212dfc58ef).
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-0781
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=432748
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00726.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00752.html
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/db212dfc58ef
+- type: WEB
+  url: http://secunia.com/advisories/28987
+- type: WEB
+  url: http://secunia.com/advisories/29010
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://secunia.com/advisories/29444
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/27904
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2008/0569/references
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-775g-4482-pm94
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-7hjm-hqgj-xv9f.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-7hjm-hqgj-xv9f.yaml
new file mode 100644
index 000000000..502a807a9
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-7hjm-hqgj-xv9f.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-moin-GHSA-7hjm-hqgj-xv9f
+modified: '2026-07-02T14:13:21.242604Z'
+published: '2026-07-02T14:13:21.242604Z'
+aliases:
+- CVE-2009-0260
+- GHSA-7hjm-hqgj-xv9f
+summary: MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
+details: Multiple cross-site scripting (XSS) vulnerabilities in `action/AttachFile.py` in MoinMoin before 1.8.1 allow remote attackers to inject arbitrary web script or HTML via an AttachFile action to the WikiSandBox component with (1) the rename parameter or (2) the drawing parameter (aka the basename variable).
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.8.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2009-0260
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/48126
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://web.archive.org/web/20200228171520/http://hg.moinmo.in/moin/1.8/rev/8cb4d34ccbc1
+- type: WEB
+  url: https://www.debian.org/security/2009/dsa-1715
+- type: WEB
+  url: http://moinmo.in/SecurityFixes#moin1.8.1
+- type: WEB
+  url: http://osvdb.org/51485
+- type: WEB
+  url: http://secunia.com/advisories/33593
+- type: WEB
+  url: http://secunia.com/advisories/33716
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.securityfocus.com/archive/1/500197/100/0/threaded
+- type: WEB
+  url: http://www.securityfocus.com/bid/33365
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2009/0195
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7hjm-hqgj-xv9f
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-7jrp-r6jx-32cw.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-7jrp-r6jx-32cw.yaml
new file mode 100644
index 000000000..bcf946a8f
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-7jrp-r6jx-32cw.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-moin-GHSA-7jrp-r6jx-32cw
+modified: '2026-07-02T14:13:18.303725Z'
+published: '2026-07-02T14:13:18.303725Z'
+aliases:
+- CVE-2004-0708
+- GHSA-7jrp-r6jx-32cw
+summary: MoinMoin allows administrative access
+details: MoinMoin 1.2.1 and earlier allows remote attackers to gain privileges by creating a user with the same name as an existing group that has higher privileges.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.2.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-0708
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/16465
+- type: WEB
+  url: http://secunia.com/advisories/11807
+- type: WEB
+  url: http://sourceforge.net/tracker/index.php?func=detail&aid=948103&group_id=8482&atid=108482
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200407-09.xml
+- type: WEB
+  url: http://www.osvdb.org/6704
+- type: WEB
+  url: http://www.securityfocus.com/bid/10568
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7jrp-r6jx-32cw
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-8fj9-pj4p-4vq7.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-8fj9-pj4p-4vq7.yaml
new file mode 100644
index 000000000..4a86423df
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-8fj9-pj4p-4vq7.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-moin-GHSA-8fj9-pj4p-4vq7
+modified: '2026-07-02T14:13:20.698066Z'
+published: '2026-07-02T14:13:20.698066Z'
+aliases:
+- CVE-2008-1098
+- GHSA-8fj9-pj4p-4vq7
+summary: MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
+details: "Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) certain input processed by `formatter/text_gedit.py` (aka the gui editor formatter); (2) a page name, which triggers an injection in PageEditor.py when the page is successfully deleted by a victim in a DeletePage action; or (3) the destination page name for a RenamePage action, which triggers an injection in PageEditor.py when a victim's rename attempt fails because of a duplicate name.  NOTE: the AttachFile XSS issue is already covered by CVE-2008-0781, and the login XSS issue is already covered by CVE-2008-0780.\nThe issue has been fixed on [d0152eeb4499](http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499) and [4ede07e792dd](http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd)."
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-1098
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/41037
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/4ede07e792dd
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/d0152eeb4499
+- type: WEB
+  url: http://moinmo.in/SecurityFixes
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://secunia.com/advisories/29444
+- type: WEB
+  url: http://secunia.com/advisories/30031
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/28173
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8fj9-pj4p-4vq7
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-9gj2-ph57-56f5.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-9gj2-ph57-56f5.yaml
new file mode 100644
index 000000000..09138e577
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-9gj2-ph57-56f5.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-moin-GHSA-9gj2-ph57-56f5
+modified: '2026-07-02T14:13:20.213871Z'
+published: '2026-07-02T14:13:20.213871Z'
+aliases:
+- CVE-2007-0901
+- GHSA-9gj2-ph57-56f5
+summary: MoinMoin Cross-Site Scripting (XSS) vulnerability via hitcounts and general parameters
+details: 'Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.'
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0901
+- type: PACKAGE
+  url: https://github.com/moinwiki/moin
+- type: WEB
+  url: https://moinmo.in/MoinMoinRelease1.5/CHANGES
+- type: WEB
+  url: https://web.archive.org/web/20070214032031/http://secunia.com/advisories/24138
+- type: WEB
+  url: https://web.archive.org/web/20070227204439/http://secunia.com/advisories/24244
+- type: WEB
+  url: https://web.archive.org/web/20080516214454/http://www.securityfocus.com/bid/22515
+- type: WEB
+  url: http://www.ubuntu.com/usn/usn-423-1
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9gj2-ph57-56f5
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-9xh4-wpx8-rg2w.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-9xh4-wpx8-rg2w.yaml
new file mode 100644
index 000000000..b6b22a872
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-9xh4-wpx8-rg2w.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-moin-GHSA-9xh4-wpx8-rg2w
+modified: '2026-07-02T14:13:18.763018Z'
+published: '2026-07-02T14:13:18.763018Z'
+aliases:
+- CVE-2004-1463
+- GHSA-9xh4-wpx8-rg2w
+summary: MoinMoin Improper Privilege Management
+details: "MoinMoin 1.2.2 and earlier could allow a remote attacker to gain elevated privileges, caused by an undisclosed Access Control List (ACL) vulnerability in the PageEditor.\n\n"
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.2.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-1463
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/16832
+- type: WEB
+  url: http://sourceforge.net/project/shownotes.php?group_id=8482&release_id=254801
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200408-25.xml
+- type: WEB
+  url: http://www.osvdb.org/displayvuln.php?osvdb_id=8195
+- type: WEB
+  url: http://www.securityfocus.com/bid/10801
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9xh4-wpx8-rg2w
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-cmg7-xr2j-4r9v.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-cmg7-xr2j-4r9v.yaml
new file mode 100644
index 000000000..915d24fb2
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-cmg7-xr2j-4r9v.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-moin-GHSA-cmg7-xr2j-4r9v
+modified: '2026-07-02T14:13:20.287938Z'
+published: '2026-07-02T14:13:20.287938Z'
+aliases:
+- CVE-2007-2637
+- GHSA-cmg7-xr2j-4r9v
+summary: MoinMoin Improper ACL handling for calendars and includes
+details: MoinMoin before 20070507 does not properly enforce ACLs for calendars and includes, which allows remote attackers to read certain pages via unspecified vectors.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-2637
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/34474
+- type: WEB
+  url: https://moinmo.in/MoinMoinRelease1.5/CHANGES
+- type: WEB
+  url: http://osvdb.org/36269
+- type: WEB
+  url: http://secunia.com/advisories/25208
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.ubuntu.com/usn/usn-458-1
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-cmg7-xr2j-4r9v
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-cx94-3h5x-cc57.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-cx94-3h5x-cc57.yaml
new file mode 100644
index 000000000..ea412d81f
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-cx94-3h5x-cc57.yaml
@@ -0,0 +1,48 @@
+id: PYSEC-0000-moin-GHSA-cx94-3h5x-cc57
+modified: '2026-07-02T14:13:21.309699Z'
+published: '2026-07-02T14:13:21.309699Z'
+aliases:
+- CVE-2009-0312
+- GHSA-cx94-3h5x-cc57
+summary: MoinMoin Cross-site scripting (XSS) vulnerability in the antispam feature
+details: Cross-site scripting (XSS) vulnerability in the antispam feature (security/antispam.py) in MoinMoin 1.7 and 1.8.1 allows remote attackers to inject arbitrary web script or HTML via crafted, disallowed content.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.8.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2009-0312
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/48306
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://web.archive.org/web/20090323075215/http://hg.moinmo.in/moin/1.8/raw-file/1.8.2/docs/CHANGES
+- type: WEB
+  url: https://web.archive.org/web/20100825000634/http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad
+- type: WEB
+  url: https://web.archive.org/web/20200228151935/http://hg.moinmo.in/moin/1.8/rev/89b91bf87dad
+- type: WEB
+  url: https://www.debian.org/security/2009/dsa-1715
+- type: WEB
+  url: http://moinmo.in/SecurityFixes#moin1.8.1
+- type: WEB
+  url: http://osvdb.org/51632
+- type: WEB
+  url: http://secunia.com/advisories/33716
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2009/01/27/4
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-cx94-3h5x-cc57
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-jj2f-57jg-5rm6.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-jj2f-57jg-5rm6.yaml
new file mode 100644
index 000000000..8bb5e488d
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-jj2f-57jg-5rm6.yaml
@@ -0,0 +1,52 @@
+id: PYSEC-0000-moin-GHSA-jj2f-57jg-5rm6
+modified: '2026-07-02T14:13:20.768903Z'
+published: '2026-07-02T14:13:20.768903Z'
+aliases:
+- CVE-2008-1099
+- GHSA-jj2f-57jg-5rm6
+summary: 'MoinMoin Improper Access Control  '
+details: '`_macro_Getval` in `wikimacro.py` in MoinMoin 1.5.8 and earlier does not properly enforce ACLs, which allows remote attackers to read protected pages. The issue has been fixed on [4a7de0173734](http://hg.moinmo.in/moin/1.5/rev/4a7de0173734).'
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 1.5.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-1099
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/41038
+- type: WEB
+  url: https://usn.ubuntu.com/716-1
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00510.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00538.html
+- type: WEB
+  url: http://hg.moinmo.in/moin/1.5/rev/4a7de0173734
+- type: WEB
+  url: http://moinmo.in/SecurityFixes
+- type: WEB
+  url: http://secunia.com/advisories/29262
+- type: WEB
+  url: http://secunia.com/advisories/29444
+- type: WEB
+  url: http://secunia.com/advisories/30031
+- type: WEB
+  url: http://secunia.com/advisories/33755
+- type: WEB
+  url: http://www.debian.org/security/2008/dsa-1514
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200803-27.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/28177
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jj2f-57jg-5rm6
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-m84w-vgwf-p893.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-m84w-vgwf-p893.yaml
new file mode 100644
index 000000000..63e95f611
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-m84w-vgwf-p893.yaml
@@ -0,0 +1,48 @@
+id: PYSEC-0000-moin-GHSA-m84w-vgwf-p893
+modified: '2026-07-02T14:13:20.067749Z'
+published: '2026-07-02T14:13:20.067749Z'
+aliases:
+- CVE-2007-0857
+- GHSA-m84w-vgwf-p893
+summary: MoinMoin Multiple cross-site scripting (XSS) vulnerabilities
+details: Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin before 1.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) the page info, or the page name in a (2) AttachFile, (3) RenamePage, or (4) LocalSiteMap action.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.5.7
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0857
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/32377
+- type: WEB
+  url: http://moinmoin.wikiwikiweb.de/MoinMoinRelease1.5/CHANGES
+- type: WEB
+  url: http://osvdb.org/31871
+- type: WEB
+  url: http://osvdb.org/31872
+- type: WEB
+  url: http://osvdb.org/31873
+- type: WEB
+  url: http://secunia.com/advisories/24096
+- type: WEB
+  url: http://secunia.com/advisories/24117
+- type: WEB
+  url: http://www.osvdb.org/31874
+- type: WEB
+  url: http://www.securityfocus.com/bid/22506
+- type: WEB
+  url: http://www.ubuntu.com/usn/usn-421-1
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2007/0553
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-m84w-vgwf-p893
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-mxh8-xgq9-w782.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-mxh8-xgq9-w782.yaml
new file mode 100644
index 000000000..17a9b2a3c
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-mxh8-xgq9-w782.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-moin-GHSA-mxh8-xgq9-w782
+modified: '2026-07-02T14:13:20.125761Z'
+published: '2026-07-02T14:13:20.125761Z'
+aliases:
+- CVE-2007-0902
+- GHSA-mxh8-xgq9-w782
+summary: MoinMoin Insertion of Sensitive Information into Log File
+details: An information leak was discovered in MoinMoin's debug reporting version 1.5.7, which could expose information about the versions of software running on the host system.  MoinMoin administrators can add "show_traceback=0" to their site configurations to disable debug tracebacks.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 1.5.7
+    - fixed: 1.5.8
+  versions:
+  - 1.5.7
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2007-0902
+- type: WEB
+  url: https://moinmo.in/MoinMoinRelease1.5/CHANGES
+- type: WEB
+  url: http://osvdb.org/33173
+- type: WEB
+  url: http://secunia.com/advisories/24138
+- type: WEB
+  url: http://secunia.com/advisories/24244
+- type: WEB
+  url: http://www.securityfocus.com/bid/22515
+- type: WEB
+  url: http://www.ubuntu.com/usn/usn-423-1
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-mxh8-xgq9-w782
diff --git a/vulns/moin/PYSEC-0000-moin-GHSA-v744-h36c-hv5j.yaml b/vulns/moin/PYSEC-0000-moin-GHSA-v744-h36c-hv5j.yaml
new file mode 100644
index 000000000..ae43b1d86
--- /dev/null
+++ b/vulns/moin/PYSEC-0000-moin-GHSA-v744-h36c-hv5j.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-moin-GHSA-v744-h36c-hv5j
+modified: '2026-07-02T14:13:18.707674Z'
+published: '2026-07-02T14:13:18.707674Z'
+aliases:
+- CVE-2004-1462
+- GHSA-v744-h36c-hv5j
+summary: 'MoinMoin Improper Access Control '
+details: Unknown vulnerability in MoinMoin 1.2.2 and earlier allows remote attackers to gain unauthorized access to administrator functions such as (1) revert and (2) delete.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: moin
+    purl: pkg:pypi/moin
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.2.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-1462
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/16833
+- type: WEB
+  url: https://sourceforge.net/project/shownotes.php?group_id=8482&release_id=254801
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200408-25.xml
+- type: WEB
+  url: http://www.osvdb.org/displayvuln.php?osvdb_id=8194
+- type: WEB
+  url: http://www.securityfocus.com/bid/10805
+- type: PACKAGE
+  url: https://pypi.org/project/moin
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-v744-h36c-hv5j
diff --git a/vulns/motioneye/PYSEC-0000-motioneye-GHSA-m2c7-42rf-c62f.yaml b/vulns/motioneye/PYSEC-0000-motioneye-GHSA-m2c7-42rf-c62f.yaml
new file mode 100644
index 000000000..c864c0fd5
--- /dev/null
+++ b/vulns/motioneye/PYSEC-0000-motioneye-GHSA-m2c7-42rf-c62f.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-motioneye-GHSA-m2c7-42rf-c62f
+modified: '2026-07-02T14:13:15.109139Z'
+published: '2026-07-02T14:13:15.109139Z'
+aliases:
+- CVE-2021-44255
+- GHSA-m2c7-42rf-c62f
+summary: Unrestricted Upload of File with Dangerous Type in motionEye
+details: "motionEye <= 0.42.1 and motioneEyeOS <= 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials.\n\nThe GitHub repositories for motionEye and motionEyeOS are no longer being actively maintained as of January 2022, so release of a patched version is unlikely. Keeping a motionEye or motionEyeOS installation off of the Internet and/or using strong credentials provide protection against this issue."
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: motioneye
+    purl: pkg:pypi/motioneye
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 0.42.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-44255
+- type: WEB
+  url: https://github.com/ccrisan/motioneyeos/issues/2843
+- type: PACKAGE
+  url: https://github.com/ccrisan/motioneye
+- type: WEB
+  url: https://www.pizzapower.me/2021/10/09/self-hosted-security-part-1-motioneye
+- type: PACKAGE
+  url: https://pypi.org/project/motioneye
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-m2c7-42rf-c62f
diff --git a/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-2cf3-g243-hhfx.yaml b/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-2cf3-g243-hhfx.yaml
new file mode 100644
index 000000000..18e9b3e42
--- /dev/null
+++ b/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-2cf3-g243-hhfx.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-mysql-connector-python-GHSA-2cf3-g243-hhfx
+modified: '2026-07-02T14:13:24.741892Z'
+published: '2026-07-02T14:13:24.741892Z'
+aliases:
+- CVE-2017-3590
+- GHSA-2cf3-g243-hhfx
+summary: MySQL Connectors Privilege Escalation
+details: 'Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 2.1.5 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: mysql-connector-python
+    purl: pkg:pypi/mysql-connector-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 2.1.5
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-3590
+- type: PACKAGE
+  url: https://github.com/mysql/mysql-connector-python
+- type: WEB
+  url: http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/97840
+- type: WEB
+  url: http://www.securitytracker.com/id/1038287
+- type: PACKAGE
+  url: https://pypi.org/project/mysql-connector-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-2cf3-g243-hhfx
diff --git a/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-v5rq-w2xm-7g5f.yaml b/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-v5rq-w2xm-7g5f.yaml
new file mode 100644
index 000000000..ab5442d12
--- /dev/null
+++ b/vulns/mysql-connector-python/PYSEC-0000-mysql-connector-python-GHSA-v5rq-w2xm-7g5f.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-mysql-connector-python-GHSA-v5rq-w2xm-7g5f
+modified: '2026-07-02T14:13:23.657489Z'
+published: '2026-07-02T14:13:23.657489Z'
+aliases:
+- CVE-2019-2435
+- GHSA-v5rq-w2xm-7g5f
+summary: Improper Access Control in MySQL Connector Python
+details: 'Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data. '
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: mysql-connector-python
+    purl: pkg:pypi/mysql-connector-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.1.0
+    - fixed: 8.0.19
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-2435
+- type: PACKAGE
+  url: https://github.com/mysql/mysql-connector-python
+- type: WEB
+  url: https://security.netapp.com/advisory/ntap-20190118-0002
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00044.html
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00053.html
+- type: WEB
+  url: http://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/106616
+- type: PACKAGE
+  url: https://pypi.org/project/mysql-connector-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-v5rq-w2xm-7g5f
diff --git a/vulns/nanopb/PYSEC-0000-nanopb-GHSA-85rr-4rh9-hhwh.yaml b/vulns/nanopb/PYSEC-0000-nanopb-GHSA-85rr-4rh9-hhwh.yaml
new file mode 100644
index 000000000..a1da2c867
--- /dev/null
+++ b/vulns/nanopb/PYSEC-0000-nanopb-GHSA-85rr-4rh9-hhwh.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-nanopb-GHSA-85rr-4rh9-hhwh
+modified: '2026-07-02T14:13:09.752037Z'
+published: '2026-07-02T14:13:09.752037Z'
+aliases:
+- CVE-2020-26243
+- GHSA-85rr-4rh9-hhwh
+summary: Memory leak in Nanopb
+details: "### Impact\nDecoding specifically formed message can leak memory if dynamic allocation is enabled and an oneof field contains a static submessage that contains a dynamic field, and the message being decoded contains the submessage multiple times. This is rare in normal messages, but it is a concern when untrusted data is parsed.\n\n### Patches\nPreliminary patch is [available on git](https://github.com/nanopb/nanopb/commit/edf6dcbffee4d614ac0c2c1b258ab95185bdb6e9) and problem will be patched in versions 0.3.9.7 and 0.4.4 once testing has been completed.\n\n### Workarounds\nFollowing workarounds are available:\n* Set the option `no_unions` for the oneof field. This will generate fields as separate instead of C union, and avoids triggering the problematic code.\n* Set the type of the submessage field inside oneof to `FT_POINTER`. This way the whole submessage will be dynamically allocated and the problematic code is not executed.\n* Use an arena allocator for nanopb, to make sure all memory can be released afterwards.\n\n### References\nBug report: https://github.com/nanopb/nanopb/issues/615\n\n### For more information\nIf you have any questions or comments about this advisory, comment on the bug report linked above."
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: nanopb
+    purl: pkg:pypi/nanopb
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 0.3.2
+    - fixed: 0.3.9.7
+    - introduced: 0.4.0
+    - fixed: 0.4.4
+references:
+- type: WEB
+  url: https://github.com/nanopb/nanopb/security/advisories/GHSA-85rr-4rh9-hhwh
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-26243
+- type: WEB
+  url: https://github.com/nanopb/nanopb/issues/615
+- type: WEB
+  url: https://github.com/nanopb/nanopb/commit/4fe23595732b6f1254cfc11a9b8d6da900b55b0c
+- type: WEB
+  url: https://github.com/nanopb/nanopb/blob/2b48a361786dfb1f63d229840217a93aae064667/CHANGELOG.txt
+- type: PACKAGE
+  url: https://pypi.org/project/nanopb
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-85rr-4rh9-hhwh
diff --git a/vulns/nemo-toolkit/PYSEC-0000-nemo-toolkit-GHSA-9hg3-hmmf-c3gr.yaml b/vulns/nemo-toolkit/PYSEC-0000-nemo-toolkit-GHSA-9hg3-hmmf-c3gr.yaml
new file mode 100644
index 000000000..d5b5a0b31
--- /dev/null
+++ b/vulns/nemo-toolkit/PYSEC-0000-nemo-toolkit-GHSA-9hg3-hmmf-c3gr.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-nemo-toolkit-GHSA-9hg3-hmmf-c3gr
+modified: '2026-07-02T14:13:14.599712Z'
+published: '2026-07-02T14:13:14.599712Z'
+aliases:
+- CVE-2022-22821
+- GHSA-9hg3-hmmf-c3gr
+summary: Path Traversal in nemo-toolkit
+details: NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: nemo-toolkit
+    purl: pkg:pypi/nemo-toolkit
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.6.0
+references:
+- type: WEB
+  url: https://github.com/NVIDIA/NeMo/security/advisories/GHSA-rpx7-33j2-xx9x
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-22821
+- type: PACKAGE
+  url: https://github.com/NVIDIA/NeMo
+- type: PACKAGE
+  url: https://pypi.org/project/nemo-toolkit
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9hg3-hmmf-c3gr
diff --git a/vulns/neutron/PYSEC-0000-neutron-GHSA-hvxr-2fvv-c3wq.yaml b/vulns/neutron/PYSEC-0000-neutron-GHSA-hvxr-2fvv-c3wq.yaml
new file mode 100644
index 000000000..ec95f429f
--- /dev/null
+++ b/vulns/neutron/PYSEC-0000-neutron-GHSA-hvxr-2fvv-c3wq.yaml
@@ -0,0 +1,56 @@
+id: PYSEC-0000-neutron-GHSA-hvxr-2fvv-c3wq
+modified: '2026-07-02T14:13:22.484803Z'
+published: '2026-07-02T14:13:22.484803Z'
+aliases:
+- CVE-2017-7543
+- GHSA-hvxr-2fvv-c3wq
+summary: OpenStack Neutron Race Condition vulnerability
+details: 'A race-condition flaw was discovered in openstack-neutron before 7.2.0-12.1, 8.x before 8.3.0-11.1, 9.x before 9.3.1-2.1, and 10.x before 10.0.2-1.1, where, following a minor overcloud update, neutron security groups were disabled. Specifically, the following were reset to 0: net.bridge.bridge-nf-call-ip6tables and net.bridge.bridge-nf-call-iptables. The race was only triggered by an update, at which point an attacker could access exposed tenant VMs and network resources.'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: neutron
+    purl: pkg:pypi/neutron
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 7.2.0-12.1
+    - introduced: 8.0.0
+    - fixed: 8.3.0-11.1
+    - introduced: 9.0.0
+    - fixed: 9.3.1-2.1
+    - introduced: 10.0.0
+    - fixed: 10.0.2-1.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-7543
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2447
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2448
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2449
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2450
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2451
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2017:2452
+- type: WEB
+  url: https://access.redhat.com/security/cve/CVE-2017-7543
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1473792
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7543
+- type: PACKAGE
+  url: https://opendev.org/openstack/neutron
+- type: WEB
+  url: https://web.archive.org/web/20200227153412/https://www.securityfocus.com/bid/100237
+- type: PACKAGE
+  url: https://pypi.org/project/neutron
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hvxr-2fvv-c3wq
diff --git a/vulns/nicotine-plus/PYSEC-0000-nicotine-plus-GHSA-p4v2-r99v-wjc2.yaml b/vulns/nicotine-plus/PYSEC-0000-nicotine-plus-GHSA-p4v2-r99v-wjc2.yaml
new file mode 100644
index 000000000..6b6b4f44e
--- /dev/null
+++ b/vulns/nicotine-plus/PYSEC-0000-nicotine-plus-GHSA-p4v2-r99v-wjc2.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-nicotine-plus-GHSA-p4v2-r99v-wjc2
+modified: '2026-07-02T14:13:16.407927Z'
+published: '2026-07-02T14:13:16.407927Z'
+aliases:
+- CVE-2021-45848
+- GHSA-p4v2-r99v-wjc2
+summary: Nicotine+ DoS on Null Character in Download Request
+details: Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: nicotine-plus
+    purl: pkg:pypi/nicotine-plus
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 3.0.3
+    - fixed: 3.2.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-45848
+- type: WEB
+  url: https://github.com/nicotine-plus/nicotine-plus/issues/1777
+- type: WEB
+  url: https://github.com/nicotine-plus/nicotine-plus/commit/0e3e2fac27a518f0a84330f1ddf1193424522045
+- type: PACKAGE
+  url: https://github.com/nicotine-plus/nicotine-plus
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HWYV53KERFH2EC4XI2IVVQFTV75E5XM6
+- type: WEB
+  url: https://security.gentoo.org/glsa/202210-20
+- type: PACKAGE
+  url: https://pypi.org/project/nicotine-plus
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-p4v2-r99v-wjc2
diff --git a/vulns/notebook/PYSEC-0000-notebook-GHSA-4952-p58q-6crx.yaml b/vulns/notebook/PYSEC-0000-notebook-GHSA-4952-p58q-6crx.yaml
new file mode 100644
index 000000000..5f3dca983
--- /dev/null
+++ b/vulns/notebook/PYSEC-0000-notebook-GHSA-4952-p58q-6crx.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-notebook-GHSA-4952-p58q-6crx
+modified: '2026-07-02T14:13:10.480332Z'
+published: '2026-07-02T14:13:10.480332Z'
+aliases:
+- CVE-2021-32797
+- GHSA-4952-p58q-6crx
+summary: 'JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>'
+details: "### Impact\n\nUntrusted notebook can execute code on load. This is a remote code execution, but requires user action to open a notebook.\n\n### Patches\n\nPatched in the following versions: 3.1.4, 3.0.17, 2.3.2, 2.2.10, 1.2.21.\n\n### References\n\n[OWASP Page on Restricting Form Submissions](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)\n\n### For more information\n\nIf you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.\n\nCredit: Guillaume Jeanne from Google\n"
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: notebook
+    purl: pkg:pypi/notebook
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 5.7.11
+    - introduced: 6.0.0
+    - fixed: 6.4.1
+references:
+- type: WEB
+  url: https://github.com/google/security-research/security/advisories/GHSA-c469-p3jp-2vhx
+- type: WEB
+  url: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-32797
+- type: WEB
+  url: https://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/jupyterlab/PYSEC-2021-130.yaml
+- type: PACKAGE
+  url: https://pypi.org/project/notebook
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-4952-p58q-6crx
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-ffmh-r67w-m88f.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-ffmh-r67w-m88f.yaml
new file mode 100644
index 000000000..0c6e2d29c
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-ffmh-r67w-m88f.yaml
@@ -0,0 +1,54 @@
+id: PYSEC-0000-nova-GHSA-ffmh-r67w-m88f
+modified: '2026-07-02T14:13:24.655107Z'
+published: '2026-07-02T14:13:24.655107Z'
+aliases:
+- CVE-2017-18191
+- GHSA-ffmh-r67w-m88f
+summary: OpenStack Nova Denial of service attack on the compute host
+details: An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 15.0.0
+    - fixed: 15.1.1
+    - introduced: 16.0.0
+    - fixed: 16.1.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-18191
+- type: WEB
+  url: https://github.com/openstack/nova/commit/0225a61fc4557c1257383a654f0741f7ef2ddeac
+- type: WEB
+  url: https://github.com/openstack/nova/commit/5b64a1936122eeb35f37a09f9d38159e1a224c58
+- type: WEB
+  url: https://github.com/openstack/nova/commit/cd3eb60c2c00bcccfa9ccd4bf9d1a96ae7a5cd88
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:2332
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:2714
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:2855
+- type: PACKAGE
+  url: https://github.com/openstack/nova
+- type: WEB
+  url: https://launchpad.net/bugs/1739593
+- type: WEB
+  url: https://review.openstack.org/539893
+- type: WEB
+  url: https://security.openstack.org/ossa/OSSA-2018-001.html
+- type: WEB
+  url: http://openwall.com/lists/oss-security/2018/04/20/3
+- type: WEB
+  url: http://www.securityfocus.com/bid/103104
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-ffmh-r67w-m88f
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-hqfx-4x4w-vmwp.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-hqfx-4x4w-vmwp.yaml
new file mode 100644
index 000000000..e902477ff
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-hqfx-4x4w-vmwp.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-nova-GHSA-hqfx-4x4w-vmwp
+modified: '2026-07-02T14:13:17.701725Z'
+published: '2026-07-02T14:13:17.701725Z'
+aliases:
+- CVE-2011-3147
+- GHSA-hqfx-4x4w-vmwp
+summary: Openstack nova qcow format could expose host filesystem information
+details: Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 12.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-3147
+- type: WEB
+  url: https://github.com/openstack/nova/commit/ff9d353b2f4fee469e530fbc8dc231a41f6fed84
+- type: WEB
+  url: https://bugs.launchpad.net/nova/+bug/853330
+- type: WEB
+  url: http://bazaar.launchpad.net/~hudson-openstack/nova/trunk/revision/1604
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hqfx-4x4w-vmwp
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-vcmv-6rxx-fh7r.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-vcmv-6rxx-fh7r.yaml
new file mode 100644
index 000000000..2b58221ab
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-vcmv-6rxx-fh7r.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-nova-GHSA-vcmv-6rxx-fh7r
+modified: '2026-07-02T14:13:18.024973Z'
+published: '2026-07-02T14:13:18.024973Z'
+aliases:
+- CVE-2011-4076
+- GHSA-vcmv-6rxx-fh7r
+summary: OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor
+details: OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 12.0.0a0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-4076
+- type: WEB
+  url: https://github.com/openstack/nova/commit/b1ab6da1495784ff581000018a6047fd19cf82c4
+- type: WEB
+  url: https://github.com/openstack/nova/commit/beee11edbfdd82cd81bc9c0fd75912c167892c2b
+- type: WEB
+  url: https://access.redhat.com/security/cve/cve-2011-4076
+- type: WEB
+  url: https://bugs.launchpad.net/nova/+bug/868360
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4076
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2011-4076
+- type: WEB
+  url: https://www.openwall.com/lists/oss-security/2011/10/25/4
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vcmv-6rxx-fh7r
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-vq76-rxx3-4r4r.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-vq76-rxx3-4r4r.yaml
new file mode 100644
index 000000000..477681b06
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-vq76-rxx3-4r4r.yaml
@@ -0,0 +1,44 @@
+id: PYSEC-0000-nova-GHSA-vq76-rxx3-4r4r
+modified: '2026-07-02T14:13:24.579916Z'
+published: '2026-07-02T14:13:24.579916Z'
+aliases:
+- CVE-2017-17051
+- GHSA-vq76-rxx3-4r4r
+summary: OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
+details: An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 16.0.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-17051
+- type: WEB
+  url: https://github.com/openstack/nova/commit/25a1d78e83065c5bea5d8e0a017fd9d0914d41d9
+- type: WEB
+  url: https://github.com/openstack/nova/commit/fed660c1189fdf4159d97badfdc8c5b35ad14f23
+- type: PACKAGE
+  url: https://github.com/openstack/nova
+- type: WEB
+  url: https://launchpad.net/bugs/1732976
+- type: WEB
+  url: https://review.openstack.org/521662
+- type: WEB
+  url: https://review.openstack.org/523214
+- type: WEB
+  url: https://security.openstack.org/ossa/OSSA-2017-006.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/102102
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vq76-rxx3-4r4r
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-vqp6-j452-j6wp.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-vqp6-j452-j6wp.yaml
new file mode 100644
index 000000000..2c48f83a0
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-vqp6-j452-j6wp.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-nova-GHSA-vqp6-j452-j6wp
+modified: '2026-07-02T14:13:15.447305Z'
+published: '2026-07-02T14:13:15.447305Z'
+aliases:
+- CVE-2021-3654
+- GHSA-vqp6-j452-j6wp
+summary: Open Redirect in CPython that affects users of OpenStack Nova
+details: A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 21.2.3
+    - introduced: 22.0.0
+    - fixed: 22.2.3
+    - introduced: 23.0.0
+    - fixed: 23.0.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-3654
+- type: WEB
+  url: https://bugs.launchpad.net/nova/+bug/1927677
+- type: WEB
+  url: https://bugs.python.org/issue32084
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1961439
+- type: PACKAGE
+  url: https://opendev.org/openstack/nova
+- type: WEB
+  url: https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
+- type: WEB
+  url: https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
+- type: WEB
+  url: https://security.gentoo.org/glsa/202305-02
+- type: WEB
+  url: https://security.openstack.org/ossa/OSSA-2021-002.html
+- type: WEB
+  url: https://www.openwall.com/lists/oss-security/2021/07/29/2
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vqp6-j452-j6wp
diff --git a/vulns/nova/PYSEC-0000-nova-GHSA-w2wf-cgwh-vpqg.yaml b/vulns/nova/PYSEC-0000-nova-GHSA-w2wf-cgwh-vpqg.yaml
new file mode 100644
index 000000000..3b0e3d5ef
--- /dev/null
+++ b/vulns/nova/PYSEC-0000-nova-GHSA-w2wf-cgwh-vpqg.yaml
@@ -0,0 +1,56 @@
+id: PYSEC-0000-nova-GHSA-w2wf-cgwh-vpqg
+modified: '2026-07-02T14:13:24.507335Z'
+published: '2026-07-02T14:13:24.507335Z'
+aliases:
+- CVE-2017-16239
+- GHSA-w2wf-cgwh-vpqg
+summary: OpenStack Nova Filter Scheduler Bypass
+details: 'In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: nova
+    purl: pkg:pypi/nova
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 14.0.0
+    - fixed: 14.0.10
+    - introduced: 15.0.0
+    - fixed: 15.0.8
+    - introduced: 16.0.0
+    - fixed: 16.0.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-16239
+- type: WEB
+  url: https://github.com/openstack/nova/commit/698b261a5a2a6c0f31ef5059046ef7196d5cba30
+- type: WEB
+  url: https://github.com/openstack/nova/commit/984dd8ad6add4523d93c7ce5a666a32233e02e34
+- type: WEB
+  url: https://github.com/openstack/nova/commit/9e2d63da94db63d97bd02e373bfc53d95808b833
+- type: WEB
+  url: https://github.com/openstack/nova/commit/b72105c1c49fcddc94992af63fc2f8078023491a
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:0241
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:0314
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:0369
+- type: PACKAGE
+  url: https://github.com/openstack/nova
+- type: WEB
+  url: https://launchpad.net/bugs/1664931
+- type: WEB
+  url: https://security.openstack.org/ossa/OSSA-2017-005.html
+- type: WEB
+  url: https://www.debian.org/security/2017/dsa-4056
+- type: WEB
+  url: http://www.securityfocus.com/bid/101950
+- type: PACKAGE
+  url: https://pypi.org/project/nova
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-w2wf-cgwh-vpqg
diff --git a/vulns/nvflare/PYSEC-0000-nvflare-GHSA-jx8f-cpx7-fv47.yaml b/vulns/nvflare/PYSEC-0000-nvflare-GHSA-jx8f-cpx7-fv47.yaml
new file mode 100644
index 000000000..fbc0aee98
--- /dev/null
+++ b/vulns/nvflare/PYSEC-0000-nvflare-GHSA-jx8f-cpx7-fv47.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-nvflare-GHSA-jx8f-cpx7-fv47
+modified: '2026-07-02T14:13:16.958887Z'
+published: '2026-07-02T14:13:16.958887Z'
+aliases:
+- CVE-2022-21822
+- GHSA-jx8f-cpx7-fv47
+summary: Allocation of Resources Without Limits or Throttling in nvflare
+details: "### Impact\nNVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable\n\nAll versions before 2.0.16 are affected.\n\n### Patches\nThe patch will be included in nvflare==2.0.16.\n\n### Workarounds\nThe changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e  can be applied to any version of the NVIDIA FLARE without any adverse effect.\n\n### Additional information\nIssue Found on: 2022.3.3\nIssue Found by: Oliver Sellwood (@Nintorac)"
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: nvflare
+    purl: pkg:pypi/nvflare
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.0.16
+references:
+- type: WEB
+  url: https://github.com/NVIDIA/NVFlare/security/advisories/GHSA-jx8f-cpx7-fv47
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-21822
+- type: PACKAGE
+  url: https://github.com/NVIDIA/NVFlare
+- type: PACKAGE
+  url: https://pypi.org/project/nvflare
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jx8f-cpx7-fv47
diff --git a/vulns/onionshare-cli/PYSEC-0000-onionshare-cli-GHSA-6rvj-pw9w-jcvc.yaml b/vulns/onionshare-cli/PYSEC-0000-onionshare-cli-GHSA-6rvj-pw9w-jcvc.yaml
new file mode 100644
index 000000000..70ee503fe
--- /dev/null
+++ b/vulns/onionshare-cli/PYSEC-0000-onionshare-cli-GHSA-6rvj-pw9w-jcvc.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-onionshare-cli-GHSA-6rvj-pw9w-jcvc
+modified: '2026-07-02T14:13:13.896919Z'
+published: '2026-07-02T14:13:13.896919Z'
+aliases:
+- CVE-2021-41867
+- GHSA-6rvj-pw9w-jcvc
+summary: Information disclosure vulnerability in OnionShare
+details: 'An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of participants of a non-public OnionShare node via the --chat feature. '
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: onionshare-cli
+    purl: pkg:pypi/onionshare-cli
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '2.3'
+    - fixed: '2.4'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-41867
+- type: PACKAGE
+  url: https://github.com/onionshare/onionshare
+- type: WEB
+  url: https://github.com/onionshare/onionshare/compare/v2.3.3...v2.4
+- type: WEB
+  url: https://www.ihteam.net/advisory/onionshare
+- type: PACKAGE
+  url: https://pypi.org/project/onionshare-cli
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-6rvj-pw9w-jcvc
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-3448-vrgh-85xr.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-3448-vrgh-85xr.yaml
new file mode 100644
index 000000000..a818a92e2
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-3448-vrgh-85xr.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-3448-vrgh-85xr
+modified: '2026-07-02T14:13:12.865105Z'
+published: '2026-07-02T14:13:12.865105Z'
+aliases:
+- CVE-2019-14493
+- GHSA-3448-vrgh-85xr
+summary: NULL Pointer Dereference in OpenCV.
+details: An issue was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.1.26). There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.1.1.26
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-14493
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/15127
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv/compare/371bba8...ddbd10c
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-3448-vrgh-85xr
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-8849-5h85-98qw.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-8849-5h85-98qw.yaml
new file mode 100644
index 000000000..12ac14525
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-8849-5h85-98qw.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-8849-5h85-98qw
+modified: '2026-07-02T14:13:13.163900Z'
+published: '2026-07-02T14:13:13.163900Z'
+aliases:
+- CVE-2019-9423
+- GHSA-8849-5h85-98qw
+summary: Out-of-bounds Write in OpenCV
+details: 'In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 4.1.1.26
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-9423
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://source.android.com/security/bulletin/android-10
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2019/10/25/17
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2019/10/27/1
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2019/11/07/1
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2020/12/05/1
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8849-5h85-98qw
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fm39-cw8h-3p63.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fm39-cw8h-3p63.yaml
new file mode 100644
index 000000000..81e5798c0
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fm39-cw8h-3p63.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-fm39-cw8h-3p63
+modified: '2026-07-02T14:13:12.650176Z'
+published: '2026-07-02T14:13:12.650176Z'
+aliases:
+- CVE-2019-14491
+- GHSA-fm39-cw8h-3p63
+summary: Out-of-bounds Read in OpenCV
+details: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.7.28
+    - introduced: 4.0.0.21
+    - fixed: 4.1.1.26
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-14491
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/15125
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv/compare/33b765d...4a7ca5a
+- type: WEB
+  url: https://github.com/opencv/opencv/compare/371bba8...ddbd10c
+- type: WEB
+  url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HPFLN6QAX6SUA4XR4NMKKXX26H3TYCVQ
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fm39-cw8h-3p63
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fw99-f933-rgh8.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fw99-f933-rgh8.yaml
new file mode 100644
index 000000000..e38791dd1
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-fw99-f933-rgh8.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-fw99-f933-rgh8
+modified: '2026-07-02T14:13:12.762657Z'
+published: '2026-07-02T14:13:12.762657Z'
+aliases:
+- CVE-2019-14492
+- GHSA-fw99-f933-rgh8
+summary: Out-of-bounds Read and Out-of-bounds Write in OpenCV
+details: An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.7.28
+    - introduced: 4.0.0.21
+    - fixed: 4.1.1.26
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-14492
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/15124
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv/compare/33b765d...4a7ca5a
+- type: WEB
+  url: https://github.com/opencv/opencv/compare/371bba8...ddbd10c
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fw99-f933-rgh8
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-hxfw-jm98-v4mq.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-hxfw-jm98-v4mq.yaml
new file mode 100644
index 000000000..9d2f08f67
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-hxfw-jm98-v4mq.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-hxfw-jm98-v4mq
+modified: '2026-07-02T14:13:12.971623Z'
+published: '2026-07-02T14:13:12.971623Z'
+aliases:
+- CVE-2019-15939
+- GHSA-hxfw-jm98-v4mq
+summary: Divide By Zero in OpenCV.
+details: An issue was discovered in OpenCV 4.1.0 (OpenCV-Python 4.1.0.25). There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.1.1.26
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-15939
+- type: WEB
+  url: https://github.com/OpenCV/opencv/issues/15287
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/15382
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00025.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hxfw-jm98-v4mq
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-jggw-2q6g-c3m6.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-jggw-2q6g-c3m6.yaml
new file mode 100644
index 000000000..cfb2684ba
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-jggw-2q6g-c3m6.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-jggw-2q6g-c3m6
+modified: '2026-07-02T14:13:13.279329Z'
+published: '2026-07-02T14:13:13.279329Z'
+aliases:
+- CVE-2019-19624
+- GHSA-jggw-2q6g-c3m6
+summary: Out-of-bounds Read in OpenCV
+details: An out-of-bounds read was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.0.25). Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.1.0.25
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-19624
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/14554
+- type: WEB
+  url: https://github.com/opencv/opencv/commit/d1615ba11a93062b1429fce9f0f638d1572d3418
+- type: WEB
+  url: https://access.redhat.com/security/cve/cve-2019-19624
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/25
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jggw-2q6g-c3m6
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-m6vm-8g8v-xfjh.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-m6vm-8g8v-xfjh.yaml
new file mode 100644
index 000000000..192403822
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-m6vm-8g8v-xfjh.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-m6vm-8g8v-xfjh
+modified: '2026-07-02T14:13:13.393444Z'
+published: '2026-07-02T14:13:13.393444Z'
+aliases:
+- CVE-2019-5063
+- GHSA-m6vm-8g8v-xfjh
+summary: Out-of-bounds Write in OpenCV
+details: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 (corresponds with OpenCV-Python 4.1.0.25). A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 4.1.0.25
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-5063
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/16951
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/25
+- type: WEB
+  url: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0852
+- type: WEB
+  url: https://www.oracle.com//security-alerts/cpujul2021.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuApr2021.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-m6vm-8g8v-xfjh
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-q799-q27x-vp7w.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-q799-q27x-vp7w.yaml
new file mode 100644
index 000000000..8b5eb6c6b
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-q799-q27x-vp7w.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-q799-q27x-vp7w
+modified: '2026-07-02T14:13:13.495435Z'
+published: '2026-07-02T14:13:13.495435Z'
+aliases:
+- CVE-2019-5064
+- GHSA-q799-q27x-vp7w
+summary: Out-of-bounds Write in OpenCV
+details: An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 (corresponds with OpenCV-Python version 4.1.2.30). A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.2.0.32
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-5064
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/15857
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/32
+- type: WEB
+  url: https://github.com/opencv/opencv/releases/tag/4.2.0
+- type: WEB
+  url: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0853
+- type: WEB
+  url: https://www.oracle.com//security-alerts/cpujul2021.html
+- type: WEB
+  url: https://www.oracle.com/security-alerts/cpuApr2021.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-q799-q27x-vp7w
diff --git a/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-x3rm-644h-67m8.yaml b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-x3rm-644h-67m8.yaml
new file mode 100644
index 000000000..6ffc3e206
--- /dev/null
+++ b/vulns/opencv-contrib-python-headless/PYSEC-0000-opencv-contrib-python-headless-GHSA-x3rm-644h-67m8.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-opencv-contrib-python-headless-GHSA-x3rm-644h-67m8
+modified: '2026-07-02T14:13:13.066573Z'
+published: '2026-07-02T14:13:13.066573Z'
+aliases:
+- CVE-2019-16249
+- GHSA-x3rm-644h-67m8
+summary: Out-of-bounds Read in OpenCV
+details: OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python-headless
+    purl: pkg:pypi/opencv-contrib-python-headless
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 4.1.2.30
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2019-16249
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/15481
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/15531
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1752702
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/30
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python-headless
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-x3rm-644h-67m8
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-267x-w5hx-8hjr.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-267x-w5hx-8hjr.yaml
new file mode 100644
index 000000000..2d4cbf9e3
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-267x-w5hx-8hjr.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-267x-w5hx-8hjr
+modified: '2026-07-02T14:13:12.041837Z'
+published: '2026-07-02T14:13:12.041837Z'
+aliases:
+- CVE-2017-12864
+- GHSA-267x-w5hx-8hjr
+summary: Integer Overflow or Wraparound in OpenCV
+details: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12864
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9372
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-267x-w5hx-8hjr
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-33h2-69j3-r336.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-33h2-69j3-r336.yaml
new file mode 100644
index 000000000..849e59017
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-33h2-69j3-r336.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-33h2-69j3-r336
+modified: '2026-07-02T14:13:10.869724Z'
+published: '2026-07-02T14:13:10.869724Z'
+aliases:
+- CVE-2017-12598
+- GHSA-33h2-69j3-r336
+summary: 'Out-of-bounds Read in OpenCV '
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12598
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/11
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/9
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-33h2-69j3-r336
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-5rpc-gwh9-q9fg.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-5rpc-gwh9-q9fg.yaml
new file mode 100644
index 000000000..414db464b
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-5rpc-gwh9-q9fg.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-5rpc-gwh9-q9fg
+modified: '2026-07-02T14:13:11.851507Z'
+published: '2026-07-02T14:13:11.851507Z'
+aliases:
+- CVE-2017-12862
+- GHSA-5rpc-gwh9-q9fg
+summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
+details: In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12862
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9370
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-5rpc-gwh9-q9fg
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-634c-v2xv-ffpg.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-634c-v2xv-ffpg.yaml
new file mode 100644
index 000000000..9f43db5fb
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-634c-v2xv-ffpg.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-634c-v2xv-ffpg
+modified: '2026-07-02T14:13:12.154539Z'
+published: '2026-07-02T14:13:12.154539Z'
+aliases:
+- CVE-2017-14136
+- GHSA-634c-v2xv-ffpg
+summary: Out-of-bounds Write in OpenCV
+details: 'OpenCV (Open Source Computer Vision Library) 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597.'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-14136
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9443
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9448
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-634c-v2xv-ffpg
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-6v6p-p97v-g2p7.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-6v6p-p97v-g2p7.yaml
new file mode 100644
index 000000000..f2c01cf07
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-6v6p-p97v-g2p7.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-6v6p-p97v-g2p7
+modified: '2026-07-02T14:13:11.333773Z'
+published: '2026-07-02T14:13:11.333773Z'
+aliases:
+- CVE-2017-12603
+- GHSA-6v6p-p97v-g2p7
+summary: Out-of-bounds Write in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12603
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-6v6p-p97v-g2p7
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-83rh-hx5x-q9p5.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-83rh-hx5x-q9p5.yaml
new file mode 100644
index 000000000..8e04731f4
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-83rh-hx5x-q9p5.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-83rh-hx5x-q9p5
+modified: '2026-07-02T14:13:12.360350Z'
+published: '2026-07-02T14:13:12.360350Z'
+aliases:
+- CVE-2017-18009
+- GHSA-83rh-hx5x-q9p5
+summary: Out-of-bounds Read in OpenCV
+details: In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.1.15
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-18009
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/10479
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/10480/commits/4ca89db22dea962690f31c1781bce5937ee91837
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: http://www.securityfocus.com/bid/106945
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-83rh-hx5x-q9p5
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-89rj-5ggj-3p9p.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-89rj-5ggj-3p9p.yaml
new file mode 100644
index 000000000..a93ce9925
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-89rj-5ggj-3p9p.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-89rj-5ggj-3p9p
+modified: '2026-07-02T14:13:12.540136Z'
+published: '2026-07-02T14:13:12.540136Z'
+aliases:
+- CVE-2018-5269
+- GHSA-89rj-5ggj-3p9p
+summary: Reachable Assertion in OpenCV.
+details: In OpenCV 3.3.1 (corresponds with OpenCV-Python 3.3.1.11), an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.1.15
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-5269
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/10540
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/10563
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/04/msg00019.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/106945
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-89rj-5ggj-3p9p
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-8w3x-457r-wg53.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-8w3x-457r-wg53.yaml
new file mode 100644
index 000000000..9abfad639
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-8w3x-457r-wg53.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-8w3x-457r-wg53
+modified: '2026-07-02T14:13:10.784461Z'
+published: '2026-07-02T14:13:10.784461Z'
+aliases:
+- CVE-2017-12597
+- GHSA-8w3x-457r-wg53
+summary: Out-of-bounds Write in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to opencv-python and opencv-contrib-python through 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12597
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/11
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/9
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8w3x-457r-wg53
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-9g8h-pjm4-q92p.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-9g8h-pjm4-q92p.yaml
new file mode 100644
index 000000000..86b791497
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-9g8h-pjm4-q92p.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-9g8h-pjm4-q92p
+modified: '2026-07-02T14:13:13.588245Z'
+published: '2026-07-02T14:13:13.588245Z'
+aliases:
+- CVE-2018-5268
+- GHSA-9g8h-pjm4-q92p
+summary: Out-of-bounds Write in OpenCV.
+details: In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.1.15
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2018-5268
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/10541
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/10566/commits/435a3e337bd9d4e11af61cf8b8afca067bf1a8aa
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/04/msg00019.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/106945
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9g8h-pjm4-q92p
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-c7gp-2pch-qh2v.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-c7gp-2pch-qh2v.yaml
new file mode 100644
index 000000000..2a1f62b8f
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-c7gp-2pch-qh2v.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-c7gp-2pch-qh2v
+modified: '2026-07-02T14:13:11.429417Z'
+published: '2026-07-02T14:13:11.429417Z'
+aliases:
+- CVE-2017-12604
+- GHSA-c7gp-2pch-qh2v
+summary: Out-of-bounds Write in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12604
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-c7gp-2pch-qh2v
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-cvhw-2593-5j2q.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-cvhw-2593-5j2q.yaml
new file mode 100644
index 000000000..849d5a1eb
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-cvhw-2593-5j2q.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-cvhw-2593-5j2q
+modified: '2026-07-02T14:13:10.584916Z'
+published: '2026-07-02T14:13:10.584916Z'
+aliases:
+- CVE-2016-1516
+- GHSA-cvhw-2593-5j2q
+summary: Double Free in OpenCV
+details: OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV-Python and and OpenCV-Contrib-Python 3.3.1.11).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-1516
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/5956
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: WEB
+  url: https://arxiv.org/pdf/1701.04739.pdf
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-cvhw-2593-5j2q
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fffj-9qwg-qmh5.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fffj-9qwg-qmh5.yaml
new file mode 100644
index 000000000..c75652e16
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fffj-9qwg-qmh5.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-fffj-9qwg-qmh5
+modified: '2026-07-02T14:13:10.694156Z'
+published: '2026-07-02T14:13:10.694156Z'
+aliases:
+- CVE-2016-1517
+- GHSA-fffj-9qwg-qmh5
+summary: Improper Input Validation in OpenCV
+details: OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV 3.3.1.11).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2016-1517
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/5956
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: WEB
+  url: https://arxiv.org/pdf/1701.04739.pdf
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fffj-9qwg-qmh5
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fr58-2xhv-qp3w.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fr58-2xhv-qp3w.yaml
new file mode 100644
index 000000000..945ddf0ae
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fr58-2xhv-qp3w.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-fr58-2xhv-qp3w
+modified: '2026-07-02T14:13:11.052462Z'
+published: '2026-07-02T14:13:11.052462Z'
+aliases:
+- CVE-2017-12600
+- GHSA-fr58-2xhv-qp3w
+summary: Denial of Service in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12600
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9311
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/11
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/9
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fr58-2xhv-qp3w
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fvq6-392h-6mjj.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fvq6-392h-6mjj.yaml
new file mode 100644
index 000000000..0e81701b1
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-fvq6-392h-6mjj.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-fvq6-392h-6mjj
+modified: '2026-07-02T14:13:10.960803Z'
+published: '2026-07-02T14:13:10.960803Z'
+aliases:
+- CVE-2017-12599
+- GHSA-fvq6-392h-6mjj
+summary: 'Out-of-bounds Read in OpenCV '
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12599
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/11
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/9
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-fvq6-392h-6mjj
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-jcxv-2j3h-mg59.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-jcxv-2j3h-mg59.yaml
new file mode 100644
index 000000000..349e0e187
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-jcxv-2j3h-mg59.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-jcxv-2j3h-mg59
+modified: '2026-07-02T14:13:12.259895Z'
+published: '2026-07-02T14:13:12.259895Z'
+aliases:
+- CVE-2017-17760
+- GHSA-jcxv-2j3h-mg59
+summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
+details: OpenCV 3.3.1 (corresponding with opencv-python and opencv-contrib-python 3.3.1.11) has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.4.0.12
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-17760
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/10351
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/10369/commits/7bbe1a53cfc097b82b1589f7915a2120de39274c
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: http://www.securityfocus.com/bid/102974
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jcxv-2j3h-mg59
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-m43c-649m-pm48.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-m43c-649m-pm48.yaml
new file mode 100644
index 000000000..2180d9c58
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-m43c-649m-pm48.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-m43c-649m-pm48
+modified: '2026-07-02T14:13:12.452411Z'
+published: '2026-07-02T14:13:12.452411Z'
+aliases:
+- CVE-2017-1000450
+- GHSA-m43c-649m-pm48
+summary: Integer Overflow or Wraparound in OpenCV.
+details: In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-1000450
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9723
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9726/commits/c58152d94ba878b2d7d76bcac59146312199b9eb
+- type: WEB
+  url: https://github.com/blendin/pocs/blob/master/opencv/0.OOB_Write_FillUniColor
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/01/msg00008.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-m43c-649m-pm48
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-pqjj-6f5q-gqph.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-pqjj-6f5q-gqph.yaml
new file mode 100644
index 000000000..b9ce1ab7e
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-pqjj-6f5q-gqph.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-pqjj-6f5q-gqph
+modified: '2026-07-02T14:13:11.245678Z'
+published: '2026-07-02T14:13:11.245678Z'
+aliases:
+- CVE-2017-12602
+- GHSA-pqjj-6f5q-gqph
+summary: Denial of Service in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12602
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9311
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-pqjj-6f5q-gqph
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-rqxg-xvcq-3v2f.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-rqxg-xvcq-3v2f.yaml
new file mode 100644
index 000000000..5a97d0cfe
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-rqxg-xvcq-3v2f.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-rqxg-xvcq-3v2f
+modified: '2026-07-02T14:13:11.624456Z'
+published: '2026-07-02T14:13:11.624456Z'
+aliases:
+- CVE-2017-12605
+- GHSA-rqxg-xvcq-3v2f
+summary: Out-of-bounds Write in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12605
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-rqxg-xvcq-3v2f
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-vc29-rj92-gc7j.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-vc29-rj92-gc7j.yaml
new file mode 100644
index 000000000..6e2e7d8ed
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-vc29-rj92-gc7j.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-vc29-rj92-gc7j
+modified: '2026-07-02T14:13:11.738628Z'
+published: '2026-07-02T14:13:11.738628Z'
+aliases:
+- CVE-2017-12606
+- GHSA-vc29-rj92-gc7j
+summary: Out-of-bounds Write in OpenCV
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12606
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vc29-rj92-gc7j
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-w96g-3p64-63wr.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-w96g-3p64-63wr.yaml
new file mode 100644
index 000000000..545ea217e
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-w96g-3p64-63wr.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-w96g-3p64-63wr
+modified: '2026-07-02T14:13:11.144260Z'
+published: '2026-07-02T14:13:11.144260Z'
+aliases:
+- CVE-2017-12601
+- GHSA-w96g-3p64-63wr
+summary: 'Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV '
+details: OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12601
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9309
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/11
+- type: WEB
+  url: https://github.com/opencv/opencv-python/releases/tag/9
+- type: WEB
+  url: https://github.com/xiaoqx/pocs/blob/master/opencv.md
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-w96g-3p64-63wr
diff --git a/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-wq8f-wvqp-xvvm.yaml b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-wq8f-wvqp-xvvm.yaml
new file mode 100644
index 000000000..d8ae0e69b
--- /dev/null
+++ b/vulns/opencv-contrib-python/PYSEC-0000-opencv-contrib-python-GHSA-wq8f-wvqp-xvvm.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-opencv-contrib-python-GHSA-wq8f-wvqp-xvvm
+modified: '2026-07-02T14:13:11.936447Z'
+published: '2026-07-02T14:13:11.936447Z'
+aliases:
+- CVE-2017-12863
+- GHSA-wq8f-wvqp-xvvm
+summary: Integer Overflow or Wraparound in OpenCV
+details: In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: opencv-contrib-python
+    purl: pkg:pypi/opencv-contrib-python
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.3.1.11
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12863
+- type: WEB
+  url: https://github.com/opencv/opencv/issues/9371
+- type: WEB
+  url: https://github.com/opencv/opencv/pull/9376
+- type: PACKAGE
+  url: https://github.com/opencv/opencv-python
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2018/07/msg00030.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2021/10/msg00028.html
+- type: WEB
+  url: https://security.gentoo.org/glsa/201712-02
+- type: PACKAGE
+  url: https://pypi.org/project/opencv-contrib-python
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wq8f-wvqp-xvvm
diff --git a/vulns/openexr/PYSEC-0000-openexr-GHSA-8m57-j273-2qg9.yaml b/vulns/openexr/PYSEC-0000-openexr-GHSA-8m57-j273-2qg9.yaml
new file mode 100644
index 000000000..f97a3df0c
--- /dev/null
+++ b/vulns/openexr/PYSEC-0000-openexr-GHSA-8m57-j273-2qg9.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-openexr-GHSA-8m57-j273-2qg9
+modified: '2026-07-02T14:13:23.364469Z'
+published: '2026-07-02T14:13:23.364469Z'
+aliases:
+- CVE-2017-9112
+- GHSA-8m57-j273-2qg9
+summary: OpenEXR invalid read
+details: In OpenEXR 2.2.0, an invalid read of size 1 in the getBits function in ImfHuf.cpp could cause the application to crash.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: openexr
+    purl: pkg:pypi/openexr
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.2.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-9112
+- type: WEB
+  url: https://github.com/openexr/openexr/issues/232
+- type: WEB
+  url: https://github.com/openexr/openexr/pull/233
+- type: PACKAGE
+  url: https://github.com/AcademySoftwareFoundation/openexr
+- type: WEB
+  url: https://github.com/openexr/openexr/releases/tag/v2.2.1
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html
+- type: WEB
+  url: https://usn.ubuntu.com/4148-1
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2017/05/12/5
+- type: PACKAGE
+  url: https://pypi.org/project/openexr
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8m57-j273-2qg9
diff --git a/vulns/openexr/PYSEC-0000-openexr-GHSA-qxh9-r8xw-7v99.yaml b/vulns/openexr/PYSEC-0000-openexr-GHSA-qxh9-r8xw-7v99.yaml
new file mode 100644
index 000000000..1d9815482
--- /dev/null
+++ b/vulns/openexr/PYSEC-0000-openexr-GHSA-qxh9-r8xw-7v99.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-openexr-GHSA-qxh9-r8xw-7v99
+modified: '2026-07-02T14:13:23.487285Z'
+published: '2026-07-02T14:13:23.487285Z'
+aliases:
+- CVE-2017-9111
+- GHSA-qxh9-r8xw-7v99
+summary: OpenEXR invalid write
+details: In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE function in ImfOptimizedPixelReading.h could cause the application to crash or execute arbitrary code.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: openexr
+    purl: pkg:pypi/openexr
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.2.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-9111
+- type: WEB
+  url: https://github.com/openexr/openexr/issues/232
+- type: WEB
+  url: https://github.com/openexr/openexr/pull/233
+- type: PACKAGE
+  url: https://github.com/AcademySoftwareFoundation/openexr
+- type: WEB
+  url: https://github.com/openexr/openexr/releases/tag/v2.2.1
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2020/08/msg00056.html
+- type: WEB
+  url: https://usn.ubuntu.com/4148-1
+- type: WEB
+  url: https://usn.ubuntu.com/4339-1
+- type: WEB
+  url: https://www.debian.org/security/2020/dsa-4755
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00060.html
+- type: WEB
+  url: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00000.html
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2017/05/12/5
+- type: PACKAGE
+  url: https://pypi.org/project/openexr
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-qxh9-r8xw-7v99
diff --git a/vulns/pgadmin4/PYSEC-0000-pgadmin4-GHSA-cr8c-972v-rmp3.yaml b/vulns/pgadmin4/PYSEC-0000-pgadmin4-GHSA-cr8c-972v-rmp3.yaml
new file mode 100644
index 000000000..e0acc2cfd
--- /dev/null
+++ b/vulns/pgadmin4/PYSEC-0000-pgadmin4-GHSA-cr8c-972v-rmp3.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-pgadmin4-GHSA-cr8c-972v-rmp3
+modified: '2026-07-02T14:13:16.698617Z'
+published: '2026-07-02T14:13:16.698617Z'
+aliases:
+- CVE-2022-0959
+- GHSA-cr8c-972v-rmp3
+summary: pgAdmin 4 Path Traversal vulnerability
+details: When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques being used to store files outside of the storage directory. A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: pgadmin4
+    purl: pkg:pypi/pgadmin4
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: '6.7'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-0959
+- type: WEB
+  url: https://github.com/pgadmin-org/pgadmin4/commit/dccd4f0bbaafa783d9f0360c7592b128d5cc3928
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=2063759
+- type: PACKAGE
+  url: https://github.com/pgadmin-org/pgadmin4
+- type: PACKAGE
+  url: https://pypi.org/project/pgadmin4
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-cr8c-972v-rmp3
diff --git a/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-2c8c-84w2-j38j.yaml b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-2c8c-84w2-j38j.yaml
new file mode 100644
index 000000000..67d67924a
--- /dev/null
+++ b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-2c8c-84w2-j38j.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-plone-supermodel-GHSA-2c8c-84w2-j38j
+modified: '2026-07-02T14:13:10.056554Z'
+published: '2026-07-02T14:13:10.056554Z'
+aliases:
+- CVE-2020-28736
+- GHSA-2c8c-84w2-j38j
+summary: Improper Restriction of XML External Entity Reference in Plone
+details: Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone-supermodel
+    purl: pkg:pypi/plone-supermodel
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.6.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-28736
+- type: WEB
+  url: https://github.com/plone/Products.CMFPlone/issues/3209
+- type: WEB
+  url: https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-2c8c-84w2-j38j
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-248.yaml
+- type: WEB
+  url: https://www.misakikata.com/codes/plone/python-en.html
+- type: PACKAGE
+  url: https://pypi.org/project/plone-supermodel
diff --git a/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-wq6x-g685-w5f2.yaml b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-wq6x-g685-w5f2.yaml
new file mode 100644
index 000000000..2f8ce5d05
--- /dev/null
+++ b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-wq6x-g685-w5f2.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-plone-supermodel-GHSA-wq6x-g685-w5f2
+modified: '2026-07-02T14:13:09.907843Z'
+published: '2026-07-02T14:13:09.907843Z'
+aliases:
+- CVE-2020-28734
+- GHSA-wq6x-g685-w5f2
+summary: Improper Restriction of XML External Entity Reference in Plone
+details: Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone-supermodel
+    purl: pkg:pypi/plone-supermodel
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.6.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-28734
+- type: WEB
+  url: https://github.com/plone/Products.CMFPlone/issues/3209
+- type: WEB
+  url: https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wq6x-g685-w5f2
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-246.yaml
+- type: WEB
+  url: https://www.misakikata.com/codes/plone/python-en.html
+- type: PACKAGE
+  url: https://pypi.org/project/plone-supermodel
diff --git a/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-x7wf-5mjc-6x76.yaml b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-x7wf-5mjc-6x76.yaml
new file mode 100644
index 000000000..03b29996b
--- /dev/null
+++ b/vulns/plone-supermodel/PYSEC-0000-plone-supermodel-GHSA-x7wf-5mjc-6x76.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-plone-supermodel-GHSA-x7wf-5mjc-6x76
+modified: '2026-07-02T14:13:09.993688Z'
+published: '2026-07-02T14:13:09.993688Z'
+aliases:
+- CVE-2020-28735
+- GHSA-x7wf-5mjc-6x76
+summary: SSRF attacks via tracebacks in Plone
+details: Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
+- type: CVSS_V4
+  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone-supermodel
+    purl: pkg:pypi/plone-supermodel
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.6.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-28735
+- type: WEB
+  url: https://github.com/plone/Products.CMFPlone/issues/3209
+- type: WEB
+  url: https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-x7wf-5mjc-6x76
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
+- type: WEB
+  url: https://www.misakikata.com/codes/plone/python-en.html
+- type: PACKAGE
+  url: https://pypi.org/project/plone-supermodel
diff --git a/vulns/plone/PYSEC-0000-plone-GHSA-46f9-f8jm-mw2x.yaml b/vulns/plone/PYSEC-0000-plone-GHSA-46f9-f8jm-mw2x.yaml
new file mode 100644
index 000000000..9ea27ed90
--- /dev/null
+++ b/vulns/plone/PYSEC-0000-plone-GHSA-46f9-f8jm-mw2x.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-plone-GHSA-46f9-f8jm-mw2x
+modified: '2026-07-02T14:13:21.174937Z'
+published: '2026-07-02T14:13:21.174937Z'
+aliases:
+- CVE-2008-4571
+- GHSA-46f9-f8jm-mw2x
+summary: Plone Cross-site Scripting vulnerability in the LiveSearch module
+details: Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone
+    purl: pkg:pypi/plone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.0.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-4571
+- type: PACKAGE
+  url: https://github.com/plone/Plone
+- type: WEB
+  url: https://web.archive.org/web/20081012113150/http://secunia.com/advisories/28293
+- type: WEB
+  url: https://web.archive.org/web/20120705155735/http://www.securityfocus.com/bid/27098
+- type: WEB
+  url: http://dev.plone.org/plone/ticket/7439
+- type: WEB
+  url: http://plone.org/products/plone/releases/3.0.4
+- type: PACKAGE
+  url: https://pypi.org/project/plone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-46f9-f8jm-mw2x
diff --git a/vulns/plone/PYSEC-0000-plone-GHSA-593c-j348-f3gv.yaml b/vulns/plone/PYSEC-0000-plone-GHSA-593c-j348-f3gv.yaml
new file mode 100644
index 000000000..6ae916198
--- /dev/null
+++ b/vulns/plone/PYSEC-0000-plone-GHSA-593c-j348-f3gv.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-plone-GHSA-593c-j348-f3gv
+modified: '2026-07-02T14:13:20.921783Z'
+published: '2026-07-02T14:13:20.921783Z'
+aliases:
+- CVE-2008-1393
+- GHSA-593c-j348-f3gv
+summary: Plone Improper Session Management
+details: Plone CMS before 3, places a base64 encoded form of the username and password in the `__ac` cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone
+    purl: pkg:pypi/plone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: '3.0'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-1393
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/41427
+- type: PACKAGE
+  url: https://github.com/plone/Plone
+- type: WEB
+  url: http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords
+- type: WEB
+  url: http://plone.org/products/plone/roadmap/48?
+- type: WEB
+  url: http://securityreason.com/securityalert/3754
+- type: WEB
+  url: http://www.procheckup.com/Hacking_Plone_CMS.pdf
+- type: WEB
+  url: http://www.securityfocus.com/archive/1/489544/100/0/threaded
+- type: PACKAGE
+  url: https://pypi.org/project/plone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-593c-j348-f3gv
diff --git a/vulns/plone/PYSEC-0000-plone-GHSA-hjp5-hv33-q58g.yaml b/vulns/plone/PYSEC-0000-plone-GHSA-hjp5-hv33-q58g.yaml
new file mode 100644
index 000000000..702299a9c
--- /dev/null
+++ b/vulns/plone/PYSEC-0000-plone-GHSA-hjp5-hv33-q58g.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-plone-GHSA-hjp5-hv33-q58g
+modified: '2026-07-02T14:13:20.996430Z'
+published: '2026-07-02T14:13:20.996430Z'
+aliases:
+- CVE-2008-1396
+- GHSA-hjp5-hv33-q58g
+summary: Plone credentials stored in session cookie
+details: Plone CMS 3.1.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone
+    purl: pkg:pypi/plone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 3.1.7
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-1396
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/41421
+- type: WEB
+  url: https://github.com/plone/Plone
+- type: WEB
+  url: http://securityreason.com/securityalert/3754
+- type: WEB
+  url: http://www.procheckup.com/Hacking_Plone_CMS.pdf
+- type: WEB
+  url: http://www.securityfocus.com/archive/1/489544/100/0/threaded
+- type: PACKAGE
+  url: https://pypi.org/project/plone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hjp5-hv33-q58g
diff --git a/vulns/plone/PYSEC-0000-plone-GHSA-jcwh-rj6j-vm75.yaml b/vulns/plone/PYSEC-0000-plone-GHSA-jcwh-rj6j-vm75.yaml
new file mode 100644
index 000000000..887c8de5e
--- /dev/null
+++ b/vulns/plone/PYSEC-0000-plone-GHSA-jcwh-rj6j-vm75.yaml
@@ -0,0 +1,39 @@
+id: PYSEC-0000-plone-GHSA-jcwh-rj6j-vm75
+modified: '2026-07-02T14:13:19.823848Z'
+published: '2026-07-02T14:13:19.823848Z'
+aliases:
+- CVE-2006-1711
+- GHSA-jcwh-rj6j-vm75
+summary: Plone allows remote users to modify arbitrary portraits
+details: Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone
+    purl: pkg:pypi/plone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.0.6
+    - introduced: 2.1.0
+  versions:
+  - 2.5-beta1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2006-1711
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/25781
+- type: PACKAGE
+  url: https://github.com/plone/Plone
+- type: WEB
+  url: https://web.archive.org/web/20060412111111/https://dev.plone.org/plone/ticket/5432
+- type: WEB
+  url: https://web.archive.org/web/20060422195724/http://www.securityfocus.com/bid/17484
+- type: WEB
+  url: http://www.debian.org/security/2006/dsa-1032
+- type: PACKAGE
+  url: https://pypi.org/project/plone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-jcwh-rj6j-vm75
diff --git a/vulns/plone/PYSEC-0000-plone-GHSA-mq3q-jjph-rp5p.yaml b/vulns/plone/PYSEC-0000-plone-GHSA-mq3q-jjph-rp5p.yaml
new file mode 100644
index 000000000..5b89569ed
--- /dev/null
+++ b/vulns/plone/PYSEC-0000-plone-GHSA-mq3q-jjph-rp5p.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-plone-GHSA-mq3q-jjph-rp5p
+modified: '2026-07-02T14:13:20.849677Z'
+published: '2026-07-02T14:13:20.849677Z'
+aliases:
+- CVE-2008-1394
+- GHSA-mq3q-jjph-rp5p
+summary: Plone CMS Improper Session Management
+details: Plone CMS before 3 places a base64 encoded form of the username and password in the `__ac` cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: plone
+    purl: pkg:pypi/plone
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: '3.0'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2008-1394
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/41425
+- type: PACKAGE
+  url: https://github.com/plone/Plone
+- type: WEB
+  url: http://plone.org/about/security/overview/security-overview-of-plone
+- type: WEB
+  url: http://securityreason.com/securityalert/3754
+- type: WEB
+  url: http://www.procheckup.com/Hacking_Plone_CMS.pdf
+- type: WEB
+  url: http://www.securityfocus.com/archive/1/489544/100/0/threaded
+- type: PACKAGE
+  url: https://pypi.org/project/plone
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-mq3q-jjph-rp5p
diff --git a/vulns/pollbot/PYSEC-0000-pollbot-GHSA-vg27-hr3v-3cqv.yaml b/vulns/pollbot/PYSEC-0000-pollbot-GHSA-vg27-hr3v-3cqv.yaml
new file mode 100644
index 000000000..25647d462
--- /dev/null
+++ b/vulns/pollbot/PYSEC-0000-pollbot-GHSA-vg27-hr3v-3cqv.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-pollbot-GHSA-vg27-hr3v-3cqv
+modified: '2026-07-02T14:13:15.349245Z'
+published: '2026-07-02T14:13:15.349245Z'
+aliases:
+- CVE-2022-0637
+- GHSA-vg27-hr3v-3cqv
+summary: open redirect in pollbot
+details: "(From https://bugzilla.mozilla.org/show_bug.cgi?id=1753838)\n\nSummary:\nThere was an open redirection vulnerability in the path of:\n\nhttps://pollbot.services.mozilla.com/ and https://pollbot.stage.mozaws.net/\n\nDescription:\nAn attacker can redirect anyone to malicious sites.\n\nSteps To Reproduce:\nType in this URL:\n\nhttps://pollbot.services.mozilla.com/%0a/evil.com/\n\nIt redirects to that website\n\nevil.com\n\nevil.com was used as an example but this could be any website. Note, the /%0a/ and trailing / are required.\n\nSupporting Material/References:\nhttps://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html\n\nImpact\n\nAttackers can serve malicious websites that steal passwords or download ransomware to their victims machine due to a redirect and there are a heap of other attack vectors."
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: pollbot
+    purl: pkg:pypi/pollbot
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.4.6
+references:
+- type: WEB
+  url: https://github.com/mozilla/PollBot/security/advisories/GHSA-vg27-hr3v-3cqv
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-0637
+- type: WEB
+  url: https://github.com/mozilla/PollBot/pull/360
+- type: WEB
+  url: https://github.com/mozilla/PollBot/commit/e39d8bec2df582ba525bb2e2f33c3ebc584d7ff8
+- type: WEB
+  url: https://bugzilla.mozilla.org/show_bug.cgi?id=1753838
+- type: WEB
+  url: https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2022-0637
+- type: PACKAGE
+  url: https://github.com/mozilla/PollBot
+- type: PACKAGE
+  url: https://pypi.org/project/pollbot
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vg27-hr3v-3cqv
diff --git a/vulns/products-plonepas/PYSEC-0000-products-plonepas-GHSA-pq3x-96c3-xgjg.yaml b/vulns/products-plonepas/PYSEC-0000-products-plonepas-GHSA-pq3x-96c3-xgjg.yaml
new file mode 100644
index 000000000..12d3adbcf
--- /dev/null
+++ b/vulns/products-plonepas/PYSEC-0000-products-plonepas-GHSA-pq3x-96c3-xgjg.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-products-plonepas-GHSA-pq3x-96c3-xgjg
+modified: '2026-07-02T14:13:08.768013Z'
+published: '2026-07-02T14:13:08.768013Z'
+aliases:
+- CVE-2009-0662
+- GHSA-pq3x-96c3-xgjg
+summary: Moderate severity vulnerability that affects Products.PlonePAS
+details: The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: products-plonepas
+    purl: pkg:pypi/products-plonepas
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '3'
+    - fixed: '3.9'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2009-0662
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/50061
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-pq3x-96c3-xgjg
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2009-17.yaml
+- type: WEB
+  url: http://osvdb.org/53975
+- type: WEB
+  url: http://plone.org/products/plone/security/advisories/cve-2009-0662
+- type: WEB
+  url: http://secunia.com/advisories/34840
+- type: WEB
+  url: http://www.securityfocus.com/bid/34664
+- type: PACKAGE
+  url: https://pypi.org/project/products-plonepas
diff --git a/vulns/proteus/PYSEC-0000-proteus-GHSA-cj78-rgw3-4h5p.yaml b/vulns/proteus/PYSEC-0000-proteus-GHSA-cj78-rgw3-4h5p.yaml
new file mode 100644
index 000000000..b52505a6e
--- /dev/null
+++ b/vulns/proteus/PYSEC-0000-proteus-GHSA-cj78-rgw3-4h5p.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-proteus-GHSA-cj78-rgw3-4h5p
+modified: '2026-07-02T14:13:15.757085Z'
+published: '2026-07-02T14:13:15.757085Z'
+aliases:
+- CVE-2022-26661
+- GHSA-cj78-rgw3-4h5p
+summary: Improper Restriction of XML External Entity Reference in trytond and proteus
+details: An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: proteus
+    purl: pkg:pypi/proteus
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 5.0.0
+    - fixed: 5.0.12
+    - introduced: 6.0.0
+    - fixed: 6.0.5
+    - introduced: 6.1.0
+    - fixed: 6.2.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-26661
+- type: WEB
+  url: https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
+- type: WEB
+  url: https://foss.heptapod.net/tryton/tryton/-/issues/11219
+- type: PACKAGE
+  url: https://hg.tryton.org/trytond
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
+- type: WEB
+  url: https://www.debian.org/security/2022/dsa-5098
+- type: WEB
+  url: https://www.debian.org/security/2022/dsa-5099
+- type: PACKAGE
+  url: https://pypi.org/project/proteus
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-cj78-rgw3-4h5p
diff --git a/vulns/proteus/PYSEC-0000-proteus-GHSA-pm3h-mm62-pwm8.yaml b/vulns/proteus/PYSEC-0000-proteus-GHSA-pm3h-mm62-pwm8.yaml
new file mode 100644
index 000000000..05a46f122
--- /dev/null
+++ b/vulns/proteus/PYSEC-0000-proteus-GHSA-pm3h-mm62-pwm8.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-proteus-GHSA-pm3h-mm62-pwm8
+modified: '2026-07-02T14:13:15.845785Z'
+published: '2026-07-02T14:13:15.845785Z'
+aliases:
+- CVE-2022-26662
+- GHSA-pm3h-mm62-pwm8
+summary: XML Entity Expansion in trytond and proteus
+details: An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: proteus
+    purl: pkg:pypi/proteus
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 5.0.0
+    - fixed: 5.0.12
+    - introduced: 6.0.0
+    - fixed: 6.0.5
+    - introduced: 6.1.0
+    - fixed: 6.2.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-26662
+- type: WEB
+  url: https://bugs.tryton.org/issue11244
+- type: WEB
+  url: https://discuss.tryton.org/t/security-release-for-issue11219-and-issue11244/5059
+- type: PACKAGE
+  url: https://hg.tryton.org/trytond
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2022/03/msg00016.html
+- type: WEB
+  url: https://lists.debian.org/debian-lts-announce/2022/03/msg00017.html
+- type: WEB
+  url: https://www.debian.org/security/2022/dsa-5098
+- type: WEB
+  url: https://www.debian.org/security/2022/dsa-5099
+- type: PACKAGE
+  url: https://pypi.org/project/proteus
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-pm3h-mm62-pwm8
diff --git a/vulns/py2play/PYSEC-0000-py2play-GHSA-wcpc-f63g-x26q.yaml b/vulns/py2play/PYSEC-0000-py2play-GHSA-wcpc-f63g-x26q.yaml
new file mode 100644
index 000000000..8593a1d39
--- /dev/null
+++ b/vulns/py2play/PYSEC-0000-py2play-GHSA-wcpc-f63g-x26q.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-py2play-GHSA-wcpc-f63g-x26q
+modified: '2026-07-02T14:13:19.651111Z'
+published: '2026-07-02T14:13:19.651111Z'
+aliases:
+- CVE-2005-2875
+- GHSA-wcpc-f63g-x26q
+summary: Py2Play Unpickles Untrusted Objects
+details: Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: py2play
+    purl: pkg:pypi/py2play
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: 0.1.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2005-2875
+- type: WEB
+  url: https://bugs.gentoo.org/show_bug.cgi?id=103524
+- type: WEB
+  url: https://web.archive.org/web/20040824010038/http://home.gna.org/oomadness/fr/slune/index.html
+- type: WEB
+  url: https://web.archive.org/web/20050213041706/http://soya.literati.org
+- type: WEB
+  url: https://web.archive.org/web/20161225000907/http://www.securityfocus.com/bid/14864
+- type: WEB
+  url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=326976
+- type: WEB
+  url: http://www.debian.org/security/2005/dsa-856
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200509-09.xml
+- type: PACKAGE
+  url: https://pypi.org/project/py2play
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wcpc-f63g-x26q
diff --git a/vulns/pyo/PYSEC-0000-pyo-GHSA-5f5c-687x-g5qm.yaml b/vulns/pyo/PYSEC-0000-pyo-GHSA-5f5c-687x-g5qm.yaml
new file mode 100644
index 000000000..834d83ae6
--- /dev/null
+++ b/vulns/pyo/PYSEC-0000-pyo-GHSA-5f5c-687x-g5qm.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-pyo-GHSA-5f5c-687x-g5qm
+modified: '2026-07-02T14:13:14.435882Z'
+published: '2026-07-02T14:13:14.435882Z'
+aliases:
+- CVE-2021-41499
+- GHSA-5f5c-687x-g5qm
+summary: Classic Buffer Overflow in pyo
+details: Buffer Overflow Vulnerability exists in ajaxsoundstudio.com in Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: pyo
+    purl: pkg:pypi/pyo
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 1.0.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-41499
+- type: WEB
+  url: https://github.com/belangeo/pyo/issues/222
+- type: PACKAGE
+  url: https://github.com/belangeo/pyo
+- type: PACKAGE
+  url: https://pypi.org/project/pyo
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-5f5c-687x-g5qm
diff --git a/vulns/roundup/PYSEC-0000-roundup-GHSA-9rj9-5wcv-xgf2.yaml b/vulns/roundup/PYSEC-0000-roundup-GHSA-9rj9-5wcv-xgf2.yaml
new file mode 100644
index 000000000..7a64a0044
--- /dev/null
+++ b/vulns/roundup/PYSEC-0000-roundup-GHSA-9rj9-5wcv-xgf2.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-roundup-GHSA-9rj9-5wcv-xgf2
+modified: '2026-07-02T14:13:21.376368Z'
+published: '2026-07-02T14:13:21.376368Z'
+aliases:
+- CVE-2009-2737
+- GHSA-9rj9-5wcv-xgf2
+summary: Roundup Improper Access Control
+details: The EditCSVAction function in `cgi/actions.py` in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: roundup
+    purl: pkg:pypi/roundup
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '1.2'
+    - fixed: 1.2.1
+    - introduced: '1.4'
+    - fixed: 1.4.7
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2009-2737
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=489355
+- type: WEB
+  url: https://github.com/roundup-tracker/roundup/blob/d24abceaa19072b28e5c8ae0db4dd341597d14fc/CHANGES.txt#L2356
+- type: WEB
+  url: https://sourceforge.net/p/roundup/code/ci/4081
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00429.html
+- type: WEB
+  url: https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00439.html
+- type: WEB
+  url: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768
+- type: WEB
+  url: http://issues.roundup-tracker.org/issue2550521
+- type: WEB
+  url: http://secunia.com/advisories/34192
+- type: WEB
+  url: http://www.debian.org/security/2009/dsa-1754
+- type: WEB
+  url: http://www.osvdb.org/56368
+- type: WEB
+  url: http://www.securityfocus.com/bid/34059
+- type: PACKAGE
+  url: https://pypi.org/project/roundup
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9rj9-5wcv-xgf2
diff --git a/vulns/roundup/PYSEC-0000-roundup-GHSA-q7mf-hp9m-cx6f.yaml b/vulns/roundup/PYSEC-0000-roundup-GHSA-q7mf-hp9m-cx6f.yaml
new file mode 100644
index 000000000..aa7ef8fe1
--- /dev/null
+++ b/vulns/roundup/PYSEC-0000-roundup-GHSA-q7mf-hp9m-cx6f.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-roundup-GHSA-q7mf-hp9m-cx6f
+modified: '2026-07-02T14:13:18.630695Z'
+published: '2026-07-02T14:13:18.630695Z'
+aliases:
+- CVE-2004-1444
+- GHSA-q7mf-hp9m-cx6f
+summary: Roundup Directory traversal vulnerability
+details: Directory traversal vulnerability in Roundup 0.6.4 and earlier allows remote attackers to view arbitrary files via `..` (dot dot) sequences in an `@@` command in an HTTP GET request.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: roundup
+    purl: pkg:pypi/roundup
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.7.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2004-1444
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/16350
+- type: PACKAGE
+  url: https://github.com/roundup-tracker/roundup
+- type: WEB
+  url: http://packetstormsecurity.nl/0406-exploits/roundUP.txt
+- type: WEB
+  url: http://secunia.com/advisories/11801
+- type: WEB
+  url: http://securitytracker.com/id?1010415
+- type: WEB
+  url: http://sourceforge.net/tracker/index.php?func=detail&aid=961511&group_id=31577&atid=402788
+- type: WEB
+  url: http://www.gentoo.org/security/en/glsa/glsa-200408-09.xml
+- type: WEB
+  url: http://www.securityfocus.com/bid/10495
+- type: PACKAGE
+  url: https://pypi.org/project/roundup
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-q7mf-hp9m-cx6f
diff --git a/vulns/saleor/PYSEC-0000-saleor-GHSA-mcgw-5fhw-3fq8.yaml b/vulns/saleor/PYSEC-0000-saleor-GHSA-mcgw-5fhw-3fq8.yaml
new file mode 100644
index 000000000..e91af0ec2
--- /dev/null
+++ b/vulns/saleor/PYSEC-0000-saleor-GHSA-mcgw-5fhw-3fq8.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-saleor-GHSA-mcgw-5fhw-3fq8
+modified: '2026-07-02T14:13:15.901408Z'
+published: '2026-07-02T14:13:15.901408Z'
+aliases:
+- CVE-2022-0932
+- GHSA-mcgw-5fhw-3fq8
+summary: saleor Missing Authorization vulnerability
+details: Missing Authorization in saleor prior to 3.1.2.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: saleor
+    purl: pkg:pypi/saleor
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 3.1.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-0932
+- type: WEB
+  url: https://github.com/saleor/saleor/commit/521dfd6394f3926a77c60d8633c058e16d0f916d
+- type: PACKAGE
+  url: https://github.com/saleor/saleor
+- type: WEB
+  url: https://huntr.dev/bounties/88ae4cbc-c697-401b-8b04-7dc4e03ad8eb
+- type: PACKAGE
+  url: https://pypi.org/project/saleor
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-mcgw-5fhw-3fq8
diff --git a/vulns/saleor/PYSEC-0000-saleor-GHSA-rgcm-rpq9-9cgr.yaml b/vulns/saleor/PYSEC-0000-saleor-GHSA-rgcm-rpq9-9cgr.yaml
new file mode 100644
index 000000000..ca4d02eb3
--- /dev/null
+++ b/vulns/saleor/PYSEC-0000-saleor-GHSA-rgcm-rpq9-9cgr.yaml
@@ -0,0 +1,32 @@
+id: PYSEC-0000-saleor-GHSA-rgcm-rpq9-9cgr
+modified: '2026-07-02T14:13:10.410968Z'
+published: '2026-07-02T14:13:10.410968Z'
+aliases:
+- CVE-2020-7964
+- GHSA-rgcm-rpq9-9cgr
+summary: Missing Authentication for Critical Function in Saleor
+details: An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackers to attach their checkouts to any user ID and consequently leak user data (e.g., name, address, and previous orders of any other customer).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: saleor
+    purl: pkg:pypi/saleor
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.0.0
+    - fixed: 2.9.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2020-7964
+- type: WEB
+  url: https://github.com/mirumee/saleor/commit/233b8890c60fa6d90daf99e4d90fea85867732c3
+- type: WEB
+  url: https://github.com/mirumee/saleor/releases/tag/2.9.1
+- type: PACKAGE
+  url: https://pypi.org/project/saleor
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-rgcm-rpq9-9cgr
diff --git a/vulns/salt/PYSEC-0000-salt-GHSA-gq26-cpq6-w85r.yaml b/vulns/salt/PYSEC-0000-salt-GHSA-gq26-cpq6-w85r.yaml
new file mode 100644
index 000000000..aa4dbacd0
--- /dev/null
+++ b/vulns/salt/PYSEC-0000-salt-GHSA-gq26-cpq6-w85r.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-salt-GHSA-gq26-cpq6-w85r
+modified: '2026-07-02T14:13:21.938484Z'
+published: '2026-07-02T14:13:21.938484Z'
+aliases:
+- CVE-2013-2228
+- GHSA-gq26-cpq6-w85r
+summary: SaltStack RSA Key Generation allows remote users to decrypt communications
+details: SaltStack RSA Key Generation allows remote users to decrypt communications
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: salt
+    purl: pkg:pypi/salt
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 0.15.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-2228
+- type: WEB
+  url: https://bugs.gentoo.org/show_bug.cgi?id=CVE-2013-2228
+- type: WEB
+  url: https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2228
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/85372
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2013-2228
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2013/07/01/1
+- type: WEB
+  url: http://www.securityfocus.com/bid/60868
+- type: WEB
+  url: http://www.securitytracker.com/id/1028717
+- type: PACKAGE
+  url: https://pypi.org/project/salt
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-gq26-cpq6-w85r
diff --git a/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-694v-63fq-fmr4.yaml b/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-694v-63fq-fmr4.yaml
new file mode 100644
index 000000000..725c1d7f5
--- /dev/null
+++ b/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-694v-63fq-fmr4.yaml
@@ -0,0 +1,40 @@
+id: PYSEC-0000-scout-browser-GHSA-694v-63fq-fmr4
+modified: '2026-07-02T14:13:21.676775Z'
+published: '2026-07-02T14:13:21.676775Z'
+aliases:
+- CVE-2022-1554
+- GHSA-694v-63fq-fmr4
+summary: Path Traversal in scout-browser
+details: Scout is a Variant Call Format (VCF) visualization interface. The Pypi package `scout-browser` is vulnerable to path traversal due to `send_file` call in versions prior to 4.52.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
+affected:
+- package:
+    ecosystem: PyPI
+    name: scout-browser
+    purl: pkg:pypi/scout-browser
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: '4.52'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-1554
+- type: WEB
+  url: https://github.com/Clinical-Genomics/scout/issues/3128
+- type: WEB
+  url: https://github.com/Clinical-Genomics/scout/issues/3302
+- type: WEB
+  url: https://github.com/Clinical-Genomics/scout/pull/3303
+- type: WEB
+  url: https://github.com/clinical-genomics/scout/commit/952a2e2319af2d95d22b017a561730feac086ff1
+- type: PACKAGE
+  url: https://github.com/clinical-genomics/scout
+- type: WEB
+  url: https://huntr.dev/bounties/7acac778-5ba4-4f02-99e2-e4e17a81e600
+- type: PACKAGE
+  url: https://pypi.org/project/scout-browser
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-694v-63fq-fmr4
diff --git a/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-g53g-q539-93cv.yaml b/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-g53g-q539-93cv.yaml
new file mode 100644
index 000000000..becfbcf8b
--- /dev/null
+++ b/vulns/scout-browser/PYSEC-0000-scout-browser-GHSA-g53g-q539-93cv.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-scout-browser-GHSA-g53g-q539-93cv
+modified: '2026-07-02T14:13:22.170189Z'
+published: '2026-07-02T14:13:22.170189Z'
+aliases:
+- CVE-2022-1592
+- GHSA-g53g-q539-93cv
+summary: Server-Side Request Forgery in scout-browser
+details: Pypi package scout-browser (GitHub repository clinical-genomics/scout) prior to v4.52 is vulnerable to server-side request forgery. An attacker could make the application perform arbitrary requests to steal cookies, request access to private areas, or lead to cross-site scripting.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: scout-browser
+    purl: pkg:pypi/scout-browser
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: '4.52'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-1592
+- type: WEB
+  url: https://github.com/Clinical-Genomics/scout/issues/3325
+- type: WEB
+  url: https://github.com/Clinical-Genomics/scout/pull/3326
+- type: WEB
+  url: https://github.com/clinical-genomics/scout/commit/b0ef15f4737d0c801154c1991b52ff5cab4f5c83
+- type: PACKAGE
+  url: https://github.com/clinical-genomics/scout
+- type: WEB
+  url: https://huntr.dev/bounties/352b39da-0f2e-415a-9793-5480cae8bd27
+- type: PACKAGE
+  url: https://pypi.org/project/scout-browser
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-g53g-q539-93cv
diff --git a/vulns/swift/PYSEC-0000-swift-GHSA-8fxc-qm65-vpxg.yaml b/vulns/swift/PYSEC-0000-swift-GHSA-8fxc-qm65-vpxg.yaml
new file mode 100644
index 000000000..e0ee90152
--- /dev/null
+++ b/vulns/swift/PYSEC-0000-swift-GHSA-8fxc-qm65-vpxg.yaml
@@ -0,0 +1,30 @@
+id: PYSEC-0000-swift-GHSA-8fxc-qm65-vpxg
+modified: '2026-07-02T14:13:10.117781Z'
+published: '2026-07-02T14:13:10.117781Z'
+aliases:
+- CVE-2017-8761
+- GHSA-8fxc-qm65-vpxg
+summary: Temporary urls leaked via logging
+details: In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: swift
+    purl: pkg:pypi/swift
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.15.2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-8761
+- type: WEB
+  url: https://bugs.launchpad.net/swift/+bug/1685798/comments/18
+- type: WEB
+  url: https://launchpad.net/bugs/1685798
+- type: PACKAGE
+  url: https://pypi.org/project/swift
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-8fxc-qm65-vpxg
diff --git a/vulns/tensorflow-gpu/PYSEC-0000-tensorflow-gpu-GHSA-9x52-887g-fhc2.yaml b/vulns/tensorflow-gpu/PYSEC-0000-tensorflow-gpu-GHSA-9x52-887g-fhc2.yaml
new file mode 100644
index 000000000..48fdea471
--- /dev/null
+++ b/vulns/tensorflow-gpu/PYSEC-0000-tensorflow-gpu-GHSA-9x52-887g-fhc2.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-tensorflow-gpu-GHSA-9x52-887g-fhc2
+modified: '2026-07-02T14:13:15.201868Z'
+published: '2026-07-02T14:13:15.201868Z'
+aliases:
+- CVE-2022-23594
+- GHSA-9x52-887g-fhc2
+summary: Out of bounds read in Tensorflow
+details: "### Impact\nThe [TFG dialect of TensorFlow (MLIR)](https://github.com/tensorflow/tensorflow/tree/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/ir/importexport) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect.\n\nIf an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible.\n    \nThese issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.\n        \n### Patches\nWe have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.\n      \n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions."
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
+affected:
+- package:
+    ecosystem: PyPI
+    name: tensorflow-gpu
+    purl: pkg:pypi/tensorflow-gpu
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.7.0
+    - fixed: 2.7.1
+  versions:
+  - 2.7.0
+references:
+- type: WEB
+  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9x52-887g-fhc2
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2022-23594
+- type: WEB
+  url: https://github.com/tensorflow/tensorflow
+- type: WEB
+  url: https://github.com/tensorflow/tensorflow/tree/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/ir/importexport
+- type: PACKAGE
+  url: https://pypi.org/project/tensorflow-gpu
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9x52-887g-fhc2
diff --git a/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-hm3x-jwwf-jpr9.yaml b/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-hm3x-jwwf-jpr9.yaml
new file mode 100644
index 000000000..108633ffa
--- /dev/null
+++ b/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-hm3x-jwwf-jpr9.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-tripleo-heat-templates-GHSA-hm3x-jwwf-jpr9
+modified: '2026-07-02T14:13:17.118333Z'
+published: '2026-07-02T14:13:17.118333Z'
+aliases:
+- CVE-2021-4180
+- GHSA-hm3x-jwwf-jpr9
+summary: Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates
+details: An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the `www_authenticate_uri parameter` (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. A patch is available on the `master` branch and anticipated to be part of version 11.6.1.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: tripleo-heat-templates
+    purl: pkg:pypi/tripleo-heat-templates
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 11.6.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2021-4180
+- type: WEB
+  url: https://github.com/openstack/tripleo-heat-templates/commit/160936df134a471cfd245bd60964046027a571ea
+- type: WEB
+  url: https://github.com/openstack/tripleo-heat-templates/commit/2b9461e97fc5c4ceb0848d1cc4484f656bb85515
+- type: WEB
+  url: https://bugs.launchpad.net/tripleo/+bug/1955397
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=2035793
+- type: PACKAGE
+  url: https://github.com/openstack/tripleo-heat-templates
+- type: PACKAGE
+  url: https://pypi.org/project/tripleo-heat-templates
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-hm3x-jwwf-jpr9
diff --git a/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-w8gx-hhcx-px6w.yaml b/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-w8gx-hhcx-px6w.yaml
new file mode 100644
index 000000000..cac276d58
--- /dev/null
+++ b/vulns/tripleo-heat-templates/PYSEC-0000-tripleo-heat-templates-GHSA-w8gx-hhcx-px6w.yaml
@@ -0,0 +1,44 @@
+id: PYSEC-0000-tripleo-heat-templates-GHSA-w8gx-hhcx-px6w
+modified: '2026-07-02T14:13:24.276345Z'
+published: '2026-07-02T14:13:24.276345Z'
+aliases:
+- CVE-2017-12155
+- GHSA-w8gx-hhcx-px6w
+summary: Openstack tripleo-heat-templates unauthenticated file access
+details: A resource-permission flaw was found in the `tripleo-heat-templates` package where `ceph.client.openstack.keyring` is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume. This has been patched in versions [7.0.6](https://github.com/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4) and [8.0.0](https://github.com/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30).
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: tripleo-heat-templates
+    purl: pkg:pypi/tripleo-heat-templates
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 7.0.6
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2017-12155
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:0602
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:1593
+- type: WEB
+  url: https://access.redhat.com/errata/RHSA-2018:1627
+- type: WEB
+  url: https://bugs.launchpad.net/tripleo/+bug/1720787
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=1489360
+- type: PACKAGE
+  url: https://github.com/openstack/tripleo-heat-templates
+- type: WEB
+  url: https://opendev.org/openstack/tripleo-heat-templates/commit/a18fd59077d97de83496c85c017b9d256a3eddd4
+- type: WEB
+  url: https://opendev.org/openstack/tripleo-heat-templates/commit/ce7b65f443d38a6627631f53cb22336338e97d30
+- type: PACKAGE
+  url: https://pypi.org/project/tripleo-heat-templates
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-w8gx-hhcx-px6w
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-7944-h5rw-qmjx.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-7944-h5rw-qmjx.yaml
new file mode 100644
index 000000000..b166225e3
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-7944-h5rw-qmjx.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-zope-GHSA-7944-h5rw-qmjx
+modified: '2026-07-02T14:13:19.270008Z'
+published: '2026-07-02T14:13:19.270008Z'
+aliases:
+- CVE-2002-0688
+- GHSA-7944-h5rw-qmjx
+summary: ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions
+details: ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.4.0
+    - fixed: 2.6.0
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2002-0688
+- type: WEB
+  url: https://web.archive.org/web/20020810160608/http://www.zope.org/Products/Zope/Hotfix_2002-06-14/security_alert
+- type: WEB
+  url: https://web.archive.org/web/20020822025750/http://www.iss.net/security_center/static/9610.php
+- type: WEB
+  url: https://web.archive.org/web/20021206023914/http://rhn.redhat.com/errata/RHSA-2002-060.html
+- type: WEB
+  url: https://web.archive.org/web/20021223212650/http://online.securityfocus.com/bid/5812
+- type: WEB
+  url: https://web.archive.org/web/20070430090648/http://www.debian.org/security/2004/dsa-490
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7944-h5rw-qmjx
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-7whr-j8vf-r4wj.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-7whr-j8vf-r4wj.yaml
new file mode 100644
index 000000000..a13e3346f
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-7whr-j8vf-r4wj.yaml
@@ -0,0 +1,36 @@
+id: PYSEC-0000-zope-GHSA-7whr-j8vf-r4wj
+modified: '2026-07-02T14:13:19.133523Z'
+published: '2026-07-02T14:13:19.133523Z'
+aliases:
+- CVE-2000-1212
+- GHSA-7whr-j8vf-r4wj
+summary: Zope allows attackers to modify raw image and file data
+details: Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.2.0
+    - last_affected: 2.2.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2000-1212
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/5778
+- type: WEB
+  url: https://web.archive.org/web/20020117134418/http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000365
+- type: WEB
+  url: http://www.debian.org/security/2001/dsa-007
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2000-135.html
+- type: WEB
+  url: http://www.zope.org/Products/Zope/Hotfix_2000-12-18/security_alert
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-7whr-j8vf-r4wj
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-9cmq-pj6p-hgwf.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-9cmq-pj6p-hgwf.yaml
new file mode 100644
index 000000000..d68cdc6bd
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-9cmq-pj6p-hgwf.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-zope-GHSA-9cmq-pj6p-hgwf
+modified: '2026-07-02T14:13:18.990025Z'
+published: '2026-07-02T14:13:18.990025Z'
+aliases:
+- CVE-2000-0725
+- GHSA-9cmq-pj6p-hgwf
+summary: Zope does not properly restrict access to the getRoles method
+details: Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.2.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2000-0725
+- type: WEB
+  url: https://web.archive.org/web/20010219192346/http://archives.neohapsis.com/archives/bugtraq/2000-08/0198.html
+- type: WEB
+  url: https://web.archive.org/web/20010219192441/http://archives.neohapsis.com/archives/bugtraq/2000-08/0259.html
+- type: WEB
+  url: https://web.archive.org/web/20010228172804/http://www.securityfocus.com/bid/1577
+- type: WEB
+  url: http://www.debian.org/security/2000/20000821
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2000-052.html
+- type: WEB
+  url: http://www.zope.org/Products/Zope/Hotfix_08_09_2000/security_alert
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-9cmq-pj6p-hgwf
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-c3rp-4cjh-cp38.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-c3rp-4cjh-cp38.yaml
new file mode 100644
index 000000000..06088d928
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-c3rp-4cjh-cp38.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-zope-GHSA-c3rp-4cjh-cp38
+modified: '2026-07-02T14:13:19.201129Z'
+published: '2026-07-02T14:13:19.201129Z'
+aliases:
+- CVE-2002-0170
+- GHSA-c3rp-4cjh-cp38
+summary: Zope does not properly verify the access for objects with proxy roles
+details: Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.2.0
+    - fixed: 2.4.4
+    - introduced: 2.5.0
+    - fixed: 2.5.1
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2002-0170
+- type: PACKAGE
+  url: https://github.com/zopefoundation/Zope
+- type: WEB
+  url: https://launchpad.net/zope2/+milestone/2.4.4
+- type: WEB
+  url: https://launchpad.net/zope2/+milestone/2.5.1
+- type: WEB
+  url: https://web.archive.org/web/20021120034302/http://online.securityfocus.com/bid/4229
+- type: WEB
+  url: https://web.archive.org/web/20070914020022/http://xforce.iss.net/xforce/xfdb/8334
+- type: WEB
+  url: http://marc.info/?l=bugtraq&m=101503023511996&w=2
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2002-060.html
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-c3rp-4cjh-cp38
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-h2xh-jvpf-xq42.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-h2xh-jvpf-xq42.yaml
new file mode 100644
index 000000000..a02f39f95
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-h2xh-jvpf-xq42.yaml
@@ -0,0 +1,34 @@
+id: PYSEC-0000-zope-GHSA-h2xh-jvpf-xq42
+modified: '2026-07-02T14:13:19.063420Z'
+published: '2026-07-02T14:13:19.063420Z'
+aliases:
+- CVE-2000-1211
+- GHSA-h2xh-jvpf-xq42
+summary: Zope does not properly perform security registration for legacy names
+details: Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.2.0
+    - last_affected: 2.2.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2000-1211
+- type: WEB
+  url: https://web.archive.org/web/20010910131909/http://www.linux-mandrake.com/en/security/2000/MDKSA-2000-083.php3
+- type: WEB
+  url: https://web.archive.org/web/20021227061438/http://www.iss.net/security_center/static/5824.php
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2000-125.html
+- type: WEB
+  url: http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-h2xh-jvpf-xq42
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-j5cc-3h6r-jqh4.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-j5cc-3h6r-jqh4.yaml
new file mode 100644
index 000000000..5f1f4b077
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-j5cc-3h6r-jqh4.yaml
@@ -0,0 +1,38 @@
+id: PYSEC-0000-zope-GHSA-j5cc-3h6r-jqh4
+modified: '2026-07-02T14:13:21.516080Z'
+published: '2026-07-02T14:13:21.516080Z'
+aliases:
+- CVE-2000-0483
+- GHSA-j5cc-3h6r-jqh4
+summary: Zope DocumentTemplate package allows unauthenticated write
+details: The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - last_affected: '2.2'
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2000-0483
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/4716
+- type: WEB
+  url: https://web.archive.org/web/20000819120649/http://archives.neohapsis.com/archives/bugtraq/2000-06/0144.html
+- type: WEB
+  url: https://web.archive.org/web/20000819123924/http://archives.neohapsis.com/archives/bugtraq/2000-07/0412.html
+- type: WEB
+  url: https://web.archive.org/web/20010702023709/http://www.securityfocus.com/bid/1354
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2000-038.html
+- type: WEB
+  url: http://www.zope.org/Products/Zope/Hotfix_06_16_2000/security_alert
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-j5cc-3h6r-jqh4
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-vwrc-g9q6-f675.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-vwrc-g9q6-f675.yaml
new file mode 100644
index 000000000..ab3b63447
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-vwrc-g9q6-f675.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-zope-GHSA-vwrc-g9q6-f675
+modified: '2026-07-02T14:13:19.339413Z'
+published: '2026-07-02T14:13:19.339413Z'
+aliases:
+- CVE-2002-0687
+- GHSA-vwrc-g9q6-f675
+summary: Zope Server vulnerable to DoS via header injection
+details: Zope is a Web application server for Linux. Zope versions 2.0 through 2.5.1 b1 are vulnerable to a denial of service attack, caused by a vulnerability that occurs when using the "through the Web code" capability. A remote attacker could inject malicious headers into a response to cause the vulnerable system to crash.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.0.0
+    - fixed: 2.4.4b2
+    - introduced: 2.5.0
+    - fixed: 2.5.1b2
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2002-0687
+- type: WEB
+  url: https://marc.info/?l=zope-announce&m=101890177815066&w=2
+- type: WEB
+  url: https://marc.info/?l=zope-announce&m=101897461507941&w=2
+- type: WEB
+  url: https://marc.info/?l=zope-announce&m=101897462107967&w=2
+- type: WEB
+  url: https://web.archive.org/web/20020822024423/http://www.iss.net/security_center/static/9621.php
+- type: WEB
+  url: https://web.archive.org/web/20021018100409/http://online.securityfocus.com/bid/5813
+- type: WEB
+  url: http://www.redhat.com/support/errata/RHSA-2002-060.html
+- type: WEB
+  url: http://www.zope.org/Products/Zope/Hotfix_2002-04-15/security_alert
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vwrc-g9q6-f675
diff --git a/vulns/zope/PYSEC-0000-zope-GHSA-wcwp-r3fj-mm3p.yaml b/vulns/zope/PYSEC-0000-zope-GHSA-wcwp-r3fj-mm3p.yaml
new file mode 100644
index 000000000..1680027a3
--- /dev/null
+++ b/vulns/zope/PYSEC-0000-zope-GHSA-wcwp-r3fj-mm3p.yaml
@@ -0,0 +1,28 @@
+id: PYSEC-0000-zope-GHSA-wcwp-r3fj-mm3p
+modified: '2026-07-02T14:13:18.910953Z'
+published: '2026-07-02T14:13:18.910953Z'
+aliases:
+- CVE-2000-0062
+- GHSA-wcwp-r3fj-mm3p
+summary: Zope DTML implementation Improper Authentication
+details: The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope
+    purl: pkg:pypi/zope
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.2.0
+    - last_affected: 2.2.4
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2000-0062
+- type: WEB
+  url: https://web.archive.org/web/20010218085743/http://www.securityfocus.com/bid/922
+- type: PACKAGE
+  url: https://pypi.org/project/zope
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-wcwp-r3fj-mm3p
diff --git a/vulns/zope2/PYSEC-0000-zope2-GHSA-5r4x-qc7q-vj27.yaml b/vulns/zope2/PYSEC-0000-zope2-GHSA-5r4x-qc7q-vj27.yaml
new file mode 100644
index 000000000..cf5099b45
--- /dev/null
+++ b/vulns/zope2/PYSEC-0000-zope2-GHSA-5r4x-qc7q-vj27.yaml
@@ -0,0 +1,42 @@
+id: PYSEC-0000-zope2-GHSA-5r4x-qc7q-vj27
+modified: '2026-07-02T14:13:21.447849Z'
+published: '2026-07-02T14:13:21.447849Z'
+aliases:
+- CVE-2009-5145
+- GHSA-5r4x-qc7q-vj27
+summary: Zope Cross-site scripting (XSS) vulnerability in ZMI pages
+details: Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
+severity:
+- type: CVSS_V3
+  score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope2
+    purl: pkg:pypi/zope2
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.12.5
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2009-5145
+- type: WEB
+  url: https://github.com/zopefoundation/Zope/commit/2abdf14620f146857dc8e3ffd2b6a754884c331d
+- type: WEB
+  url: https://bugs.launchpad.net/zope2/+bug/490514
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2017-148.yaml
+- type: PACKAGE
+  url: https://github.com/zopefoundation/Zope
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2009-5145
+- type: WEB
+  url: http://cve.killedkenny.io/cve/CVE-2009-5145
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2015/03/02/7
+- type: PACKAGE
+  url: https://pypi.org/project/zope2
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-5r4x-qc7q-vj27
diff --git a/vulns/zope2/PYSEC-0000-zope2-GHSA-p6h9-hpcg-c6gm.yaml b/vulns/zope2/PYSEC-0000-zope2-GHSA-p6h9-hpcg-c6gm.yaml
new file mode 100644
index 000000000..8e7f5235d
--- /dev/null
+++ b/vulns/zope2/PYSEC-0000-zope2-GHSA-p6h9-hpcg-c6gm.yaml
@@ -0,0 +1,56 @@
+id: PYSEC-0000-zope2-GHSA-p6h9-hpcg-c6gm
+modified: '2026-07-02T14:13:09.002503Z'
+published: '2026-07-02T14:13:09.002503Z'
+aliases:
+- CVE-2011-2528
+- GHSA-p6h9-hpcg-c6gm
+summary: High severity vulnerability that affects Plone and Zope2
+details: 'Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a "highly serious vulnerability." NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.'
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope2
+    purl: pkg:pypi/zope2
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.12.0
+    - fixed: 2.12.19
+    - introduced: 2.13.0
+    - fixed: 2.13.8
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-2528
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=718824
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-25.yaml
+- type: WEB
+  url: https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2011-32.yaml
+- type: WEB
+  url: https://mail.zope.org/pipermail/zope-announce/2011-June/002260.html
+- type: WEB
+  url: https://plone.org/products/plone-hotfix/releases/20110622
+- type: WEB
+  url: https://plone.org/products/plone/security/advisories/20110622
+- type: WEB
+  url: https://www.openwall.com/lists/oss-security/2011/07/04/6
+- type: WEB
+  url: https://www.openwall.com/lists/oss-security/2011/07/12/9
+- type: WEB
+  url: http://plone.org/products/plone-hotfix/releases/20110622
+- type: WEB
+  url: http://plone.org/products/plone/security/advisories/20110622
+- type: WEB
+  url: http://secunia.com/advisories/45056
+- type: WEB
+  url: http://secunia.com/advisories/45111
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2011/07/04/6
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2011/07/12/9
+- type: PACKAGE
+  url: https://pypi.org/project/zope2
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-p6h9-hpcg-c6gm
diff --git a/vulns/zope2/PYSEC-0000-zope2-GHSA-v7q8-wvvh-c97p.yaml b/vulns/zope2/PYSEC-0000-zope2-GHSA-v7q8-wvvh-c97p.yaml
new file mode 100644
index 000000000..600a920b5
--- /dev/null
+++ b/vulns/zope2/PYSEC-0000-zope2-GHSA-v7q8-wvvh-c97p.yaml
@@ -0,0 +1,46 @@
+id: PYSEC-0000-zope2-GHSA-v7q8-wvvh-c97p
+modified: '2026-07-02T14:13:08.911604Z'
+published: '2026-07-02T14:13:08.911604Z'
+aliases:
+- CVE-2010-1104
+- GHSA-v7q8-wvvh-c97p
+summary: Moderate severity vulnerability that affects Zope2
+details: Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
+severity: []
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope2
+    purl: pkg:pypi/zope2
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: 2.8.0
+    - fixed: 2.8.12
+    - introduced: 2.9.0
+    - fixed: 2.9.12
+    - introduced: 2.10.0
+    - fixed: 2.10.11
+    - introduced: 2.11.0
+    - fixed: 2.11.6
+    - introduced: 2.12.0
+    - fixed: 2.12.3
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2010-1104
+- type: WEB
+  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/55599
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-v7q8-wvvh-c97p
+- type: WEB
+  url: https://mail.zope.org/pipermail/zope-announce/2010-January/002229.html
+- type: WEB
+  url: http://secunia.com/advisories/38007
+- type: WEB
+  url: http://www.osvdb.org/61655
+- type: WEB
+  url: http://www.securityfocus.com/bid/37765
+- type: WEB
+  url: http://www.vupen.com/english/advisories/2010/0104
+- type: PACKAGE
+  url: https://pypi.org/project/zope2
diff --git a/vulns/zope2/PYSEC-0000-zope2-GHSA-vh6g-786f-hxxp.yaml b/vulns/zope2/PYSEC-0000-zope2-GHSA-vh6g-786f-hxxp.yaml
new file mode 100644
index 000000000..e4c751be0
--- /dev/null
+++ b/vulns/zope2/PYSEC-0000-zope2-GHSA-vh6g-786f-hxxp.yaml
@@ -0,0 +1,50 @@
+id: PYSEC-0000-zope2-GHSA-vh6g-786f-hxxp
+modified: '2026-07-02T14:13:17.937454Z'
+published: '2026-07-02T14:13:17.937454Z'
+aliases:
+- CVE-2011-4924
+- GHSA-vh6g-786f-hxxp
+summary: Zope XSS Vulnerability
+details: 'Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104'
+severity:
+- type: CVSS_V3
+  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+affected:
+- package:
+    ecosystem: PyPI
+    name: zope2
+    purl: pkg:pypi/zope2
+  ranges:
+  - type: ECOSYSTEM
+    events:
+    - introduced: '0'
+    - fixed: 2.12.22
+    - introduced: 2.13.0a1
+    - fixed: 2.13.12
+references:
+- type: ADVISORY
+  url: https://nvd.nist.gov/vuln/detail/CVE-2011-4924
+- type: WEB
+  url: https://github.com/zopefoundation/Zope/commit/37e4ea774acc668f6b430a45a6ab1e359710f590
+- type: WEB
+  url: https://github.com/zopefoundation/Zope/commit/a0655194cb39ad88ce3323a3e489927c5f979c44
+- type: WEB
+  url: https://access.redhat.com/security/cve/cve-2011-4924
+- type: WEB
+  url: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4924
+- type: PACKAGE
+  url: https://github.com/zopefoundation/Zope
+- type: WEB
+  url: https://security-tracker.debian.org/tracker/CVE-2011-4924
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2012/01/19/16
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2012/01/19/17
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2012/01/19/18
+- type: WEB
+  url: http://www.openwall.com/lists/oss-security/2012/01/19/19
+- type: PACKAGE
+  url: https://pypi.org/project/zope2
+- type: ADVISORY
+  url: https://github.com/advisories/GHSA-vh6g-786f-hxxp