[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:20:36+00:00",
  "ms": 0,
  "reply": {
   "slug": "secops-patcher",
   "title": "Look up real advisories (OSV.dev) for a package list",
   "status": "ok",
   "input": null,
   "total_ms": 2519,
   "steps": [
    {
     "call": "POST /scan",
     "request": {
      "packages": [
       {
        "name": "requests",
        "version": "2.19.0",
        "ecosystem": "PyPI"
       },
       {
        "name": "jinja2",
        "version": "2.10",
        "ecosystem": "PyPI"
       }
      ]
     },
     "status": 200,
     "ms": 2501,
     "reply": {
      "_truncated": true,
      "_bytes": 16153,
      "preview": "{\"packages_scanned\": 2, \"findings\": [{\"finding_id\": \"finding_d71c9cf0c873\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-x84v-xcm2-53pg\", \"aliases\": [\"CVE-2018-18074\", \"PYSEC-2018-28\"], \"summary\": \"Insufficiently Protected Credentials in Requests\", \"severity\": \"high\", \"priority_score\": 75, \"fixed_version\": \"2.20.0\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2018-18074\", \"https://github.com/requests/requests/issues/4716\", \"https://github.com/requests/requests/pull/4718\", \"https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"https://access.redhat.com/errata/RHSA-2019:2035\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.20.0\"}, {\"finding_id\": \"finding_d65a81128e29\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-462w-v97r-4m45\", \"aliases\": [\"CVE-2019-10906\", \"PYSEC-2019-217\"], \"summary\": \"Jinja2 sandbox escape via string formatting\", \"severity\": \"high\", \"priority_score\": 75, \"fixed_version\": \"2.10.1\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2019-10906\", \"https://usn.ubuntu.com/4011-2\", \"https://usn.ubuntu.com/4011-1\", \"https://palletsprojects.com/blog/jinja-2-10-1-released\", \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 2.10.1\"}, {\"finding_id\": \"finding_b9e99b6d289a\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-9hjg-9r4m-mvj7\", \"aliases\": [\"CVE-2024-47081\", \"PYSEC-2026-1872\"], \"summary\": \"Requests vulnerable to .netrc credentials leak via malicious URLs\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.4\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-47081\", \"https://github.com/psf/requests/pull/6965\", \"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef\", \"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.4\"}, {\"finding_id\": \"finding_f4b5d18d6178\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-9wx4-h78v-vm56\", \"aliases\": [\"CVE-2024-35195\", \"PYSEC-2026-1873\"], \"summary\": \"Requests `Session` object does not verify requests after making first request with verify=False\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-35195\", \"https://github.com/psf/requests/pull/6655\", \"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.0\"}, {\"finding_id\": \"finding_b4aad9420cef\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-gc5v-m9x4-r6x2\", \"aliases\": [\"CVE-2026-25645\", \"PYSEC-2026-2275\"], \"summary\": \"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.33.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2\", \"https://nvd.nist.gov/vuln/detail/CVE-2026-25645\", \"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\", \"https://github.com/psf/requests\", \"https://github.com/psf/requests/releases/tag/v2.33.0\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.33.0\"}, {\"finding_id\": \"finding_57fe1c3e84c6\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-j8r2-6x86-q33q\", \"aliases\": [\"CVE-2023-32681\", \"PYSEC-2023-74\"], \"summary\": \"Unintended leak of Proxy-Authorization header in requests\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.31.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q\", \"https://nvd.nist.gov/vuln/detail/CVE-2023-32681\", \"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"https://github.com/psf/requests\", \"https://github.com/psf/requests/releases/tag/v2.31.0\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.31.0\"}, {\"finding_id\": \"finding_12a439dc878a\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2018-28\", \"aliases\": [\"CVE-2018-18074\", \"GHSA-x84v-xcm2-53pg\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"references\": [\"https://github.com/requests/requests/pull/4718\", \"https://github.com/requests/requests/issues/4716\", \"https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"https://bugs.debian.org/910766\", \"https://usn.ubuntu.com/3790-1/\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to c45d7c49ea75133e52ab22a8e9e13173938e36ff\"}, {\"finding_id\": \"finding_d35b6d34724b\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2023-74\", \"aliases\": [\"CVE-2023-32681\", \"GHSA-j8r2-6x86-q33q\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q\", \"https://github.com/psf/requests/releases/tag/v2.31.0\", \"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\"}, {\"finding_id\": \"finding_67883e661e61\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-1872\", \"aliases\": [\"CVE-2024-47081\", \"GHSA-9hjg-9r4m-mvj7\"], \"summary\": \"Requests vulnerable to .netrc credentials leak via malicious URLs\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.4\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-47081\", \"https://github.com/psf/requests/pull/6965\", \"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.4\"}, {\"finding_id\": \"finding_9e168d4cdbd7\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-1873\", \"aliases\": [\"CVE-2024-35195\", \"GHSA-9wx4-h78v-vm56\"], \"summary\": \"Requests `Session` object does not verify requests after making first request with verify=False\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-35195\", \"https://github.com/psf/requests/pull/6655\", \"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.0\"}, {\"finding_id\": \"finding_8371b3a3cd74\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-2275\", \"aliases\": [\"CVE-2026-25645\", \"GHSA-gc5v-m9x4-r6x2\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.33.0\", \"references\": [\"https://github.com/psf/requests/releases/tag/v2.33.0\", \"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2\", \"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.33.0\"}, {\"finding_id\": \"finding_f257a6eb150e\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-cpwx-vrp4-4pq7\", \"aliases\": [\"CVE-2025-27516\", \"PYSEC-2026-1471\"], \"summary\": \"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.6\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7\", \"https://nvd.nist.gov/vuln/detail/CVE-2025-27516\", \"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403\", \"https://github.com/pallets/jinja\", \"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.6\"}, {\"finding_id\": \"finding_1a8a6c8e529c\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-g3rq-g295-4j3m\", \"aliases\": [\"CVE-2020-28493\", \"PYSEC-2021-66\", \"SNYK-PYTHON-JINJA2-1012994\"], \"summary\": \"Regular Expression Denial of Service (ReDoS) in Jinja2\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.11.3\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2020-28493\", \"https://github.com/pallets/jinja/pull/1343\", \"https://github.com/pallets/jinja/commit/15ef8f09b659f9100610583938005a7a10472d4d\", \"https://github.com/advisories/GHSA-g3rq-g295-4j3m\", \"https://github.com/pallets/jinja\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 2.11.3\"}, {\"finding_id\": \"finding_ffb97431fa0c\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-h5c8-rqwp-cp95\", \"aliases\": [\"CVE-2024-22195\", \"PYSEC-2026-1473\"], \"summary\": \"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.3\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-22195\", \"https://github.com/pallets/jinja/commit/716795349a41d4983a9a4771f7d883c96ea17be7\", \"https://github.com/pallets/jinja\", \"https://github.com/pallets/jinja/releases/tag/3.1.3\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.3\"}, {\"finding_id\": \"finding_79da96289946\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-h75v-3vvj-5mfj\", \"aliases\": [\"CVE-2024-34064\", \"PYSEC-2026-1474\"], \"summary\": \"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.4\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-34064\", \"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb\", \"https://github.com/pallets/jinja\", \"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.4\"}, {\"finding_id\": \"finding_a35bb224c943\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-q2x7-8rv6-6q7h\", \"aliases\": [\"CVE-2024-56326\", \"PYSEC-2026-1475\"], \"summary\": \"Jinja has a sandbox breakout through indirect reference to format method\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.5\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-56326\", \"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4\", \"https://github.com/pallets/jinja\", \"https://github.com/pallets/jinja/releases/tag/3.1.5\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.5\"}, {\"finding_id\": \"finding_c77f938ca4f7\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2019-217\", \"aliases\": [\"CVE-2019-10906\", \"GHSA-462w-v97r-4m45\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.10.1\", \"references\": [\"https://palletsprojects.com/blog/jinja-2-10-1-released\", \"https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E\", \"https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b050"
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:20:36+00:00",
  "ms": 0,
  "reply": {
   "slug": "secops-patcher",
   "title": "Look up real advisories (OSV.dev) for a package list",
   "status": "ok",
   "input": null,
   "total_ms": 2519,
   "steps": [
    {
     "call": "POST /scan",
     "request": {
      "packages": [
       {
        "name": "requests",
        "version": "2.19.0",
        "ecosystem": "PyPI"
       },
       {
        "name": "jinja2",
        "version": "2.10",
        "ecosystem": "PyPI"
       }
      ]
     },
     "status": 200,
     "ms": 2501,
     "reply": {
      "_truncated": true,
      "_bytes": 16153,
      "preview": "{\"packages_scanned\": 2, \"findings\": [{\"finding_id\": \"finding_d71c9cf0c873\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-x84v-xcm2-53pg\", \"aliases\": [\"CVE-2018-18074\", \"PYSEC-2018-28\"], \"summary\": \"Insufficiently Protected Credentials in Requests\", \"severity\": \"high\", \"priority_score\": 75, \"fixed_version\": \"2.20.0\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2018-18074\", \"https://github.com/requests/requests/issues/4716\", \"https://github.com/requests/requests/pull/4718\", \"https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"https://access.redhat.com/errata/RHSA-2019:2035\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.20.0\"}, {\"finding_id\": \"finding_d65a81128e29\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-462w-v97r-4m45\", \"aliases\": [\"CVE-2019-10906\", \"PYSEC-2019-217\"], \"summary\": \"Jinja2 sandbox escape via string formatting\", \"severity\": \"high\", \"priority_score\": 75, \"fixed_version\": \"2.10.1\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2019-10906\", \"https://usn.ubuntu.com/4011-2\", \"https://usn.ubuntu.com/4011-1\", \"https://palletsprojects.com/blog/jinja-2-10-1-released\", \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TS7IVZAJBWOHNRDMFJDIZVFCMRP6YIUQ\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 2.10.1\"}, {\"finding_id\": \"finding_b9e99b6d289a\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-9hjg-9r4m-mvj7\", \"aliases\": [\"CVE-2024-47081\", \"PYSEC-2026-1872\"], \"summary\": \"Requests vulnerable to .netrc credentials leak via malicious URLs\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.4\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-47081\", \"https://github.com/psf/requests/pull/6965\", \"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef\", \"https://github.com/advisories/GHSA-9hjg-9r4m-mvj7\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.4\"}, {\"finding_id\": \"finding_f4b5d18d6178\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-9wx4-h78v-vm56\", \"aliases\": [\"CVE-2024-35195\", \"PYSEC-2026-1873\"], \"summary\": \"Requests `Session` object does not verify requests after making first request with verify=False\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-35195\", \"https://github.com/psf/requests/pull/6655\", \"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.0\"}, {\"finding_id\": \"finding_b4aad9420cef\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-gc5v-m9x4-r6x2\", \"aliases\": [\"CVE-2026-25645\", \"PYSEC-2026-2275\"], \"summary\": \"Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.33.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2\", \"https://nvd.nist.gov/vuln/detail/CVE-2026-25645\", \"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\", \"https://github.com/psf/requests\", \"https://github.com/psf/requests/releases/tag/v2.33.0\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.33.0\"}, {\"finding_id\": \"finding_57fe1c3e84c6\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-j8r2-6x86-q33q\", \"aliases\": [\"CVE-2023-32681\", \"PYSEC-2023-74\"], \"summary\": \"Unintended leak of Proxy-Authorization header in requests\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.31.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q\", \"https://nvd.nist.gov/vuln/detail/CVE-2023-32681\", \"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"https://github.com/psf/requests\", \"https://github.com/psf/requests/releases/tag/v2.31.0\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.31.0\"}, {\"finding_id\": \"finding_12a439dc878a\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2018-28\", \"aliases\": [\"CVE-2018-18074\", \"GHSA-x84v-xcm2-53pg\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"references\": [\"https://github.com/requests/requests/pull/4718\", \"https://github.com/requests/requests/issues/4716\", \"https://github.com/requests/requests/commit/c45d7c49ea75133e52ab22a8e9e13173938e36ff\", \"https://bugs.debian.org/910766\", \"https://usn.ubuntu.com/3790-1/\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to c45d7c49ea75133e52ab22a8e9e13173938e36ff\"}, {\"finding_id\": \"finding_d35b6d34724b\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2023-74\", \"aliases\": [\"CVE-2023-32681\", \"GHSA-j8r2-6x86-q33q\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q\", \"https://github.com/psf/requests/releases/tag/v2.31.0\", \"https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\", \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5\"}, {\"finding_id\": \"finding_67883e661e61\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-1872\", \"aliases\": [\"CVE-2024-47081\", \"GHSA-9hjg-9r4m-mvj7\"], \"summary\": \"Requests vulnerable to .netrc credentials leak via malicious URLs\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.4\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9hjg-9r4m-mvj7\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-47081\", \"https://github.com/psf/requests/pull/6965\", \"https://github.com/psf/requests/commit/96ba401c1296ab1dda74a2365ef36d88f7d144ef\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.4\"}, {\"finding_id\": \"finding_9e168d4cdbd7\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-1873\", \"aliases\": [\"CVE-2024-35195\", \"GHSA-9wx4-h78v-vm56\"], \"summary\": \"Requests `Session` object does not verify requests after making first request with verify=False\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.32.0\", \"references\": [\"https://github.com/psf/requests/security/advisories/GHSA-9wx4-h78v-vm56\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-35195\", \"https://github.com/psf/requests/pull/6655\", \"https://github.com/psf/requests/commit/a58d7f2ffb4d00b46dca2d70a3932a0b37e22fac\", \"https://github.com/psf/requests\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.32.0\"}, {\"finding_id\": \"finding_8371b3a3cd74\", \"package\": \"requests\", \"version\": \"2.19.0\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2026-2275\", \"aliases\": [\"CVE-2026-25645\", \"GHSA-gc5v-m9x4-r6x2\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.33.0\", \"references\": [\"https://github.com/psf/requests/releases/tag/v2.33.0\", \"https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2\", \"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"], \"recommended_action\": \"Upgrade requests from 2.19.0 to 2.33.0\"}, {\"finding_id\": \"finding_f257a6eb150e\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-cpwx-vrp4-4pq7\", \"aliases\": [\"CVE-2025-27516\", \"PYSEC-2026-1471\"], \"summary\": \"Jinja2 vulnerable to sandbox breakout through attr filter selecting format method\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.6\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7\", \"https://nvd.nist.gov/vuln/detail/CVE-2025-27516\", \"https://github.com/pallets/jinja/commit/90457bbf33b8662926ae65cdde4c4c32e756e403\", \"https://github.com/pallets/jinja\", \"https://lists.debian.org/debian-lts-announce/2025/04/msg00022.html\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.6\"}, {\"finding_id\": \"finding_1a8a6c8e529c\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-g3rq-g295-4j3m\", \"aliases\": [\"CVE-2020-28493\", \"PYSEC-2021-66\", \"SNYK-PYTHON-JINJA2-1012994\"], \"summary\": \"Regular Expression Denial of Service (ReDoS) in Jinja2\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.11.3\", \"references\": [\"https://nvd.nist.gov/vuln/detail/CVE-2020-28493\", \"https://github.com/pallets/jinja/pull/1343\", \"https://github.com/pallets/jinja/commit/15ef8f09b659f9100610583938005a7a10472d4d\", \"https://github.com/advisories/GHSA-g3rq-g295-4j3m\", \"https://github.com/pallets/jinja\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 2.11.3\"}, {\"finding_id\": \"finding_ffb97431fa0c\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-h5c8-rqwp-cp95\", \"aliases\": [\"CVE-2024-22195\", \"PYSEC-2026-1473\"], \"summary\": \"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.3\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-22195\", \"https://github.com/pallets/jinja/commit/716795349a41d4983a9a4771f7d883c96ea17be7\", \"https://github.com/pallets/jinja\", \"https://github.com/pallets/jinja/releases/tag/3.1.3\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.3\"}, {\"finding_id\": \"finding_79da96289946\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-h75v-3vvj-5mfj\", \"aliases\": [\"CVE-2024-34064\", \"PYSEC-2026-1474\"], \"summary\": \"Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.4\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-34064\", \"https://github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb\", \"https://github.com/pallets/jinja\", \"https://lists.debian.org/debian-lts-announce/2024/12/msg00009.html\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.4\"}, {\"finding_id\": \"finding_a35bb224c943\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"GHSA-q2x7-8rv6-6q7h\", \"aliases\": [\"CVE-2024-56326\", \"PYSEC-2026-1475\"], \"summary\": \"Jinja has a sandbox breakout through indirect reference to format method\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"3.1.5\", \"references\": [\"https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h\", \"https://nvd.nist.gov/vuln/detail/CVE-2024-56326\", \"https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4\", \"https://github.com/pallets/jinja\", \"https://github.com/pallets/jinja/releases/tag/3.1.5\"], \"recommended_action\": \"Upgrade jinja2 from 2.10 to 3.1.5\"}, {\"finding_id\": \"finding_c77f938ca4f7\", \"package\": \"jinja2\", \"version\": \"2.10\", \"ecosystem\": \"PyPI\", \"osv_id\": \"PYSEC-2019-217\", \"aliases\": [\"CVE-2019-10906\", \"GHSA-462w-v97r-4m45\"], \"summary\": \"\", \"severity\": \"medium\", \"priority_score\": 50, \"fixed_version\": \"2.10.1\", \"references\": [\"https://palletsprojects.com/blog/jinja-2-10-1-released\", \"https://lists.apache.org/thread.html/b2380d147b508bbcb90d2cad443c159e63e12555966ab4f320ee22da@%3Ccommits.airflow.apache.org%3E\", \"https://lists.apache.org/thread.html/46c055e173b52d599c648a98199972dbd6a89d2b4c4647b050"
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]