{"url":"https://pypi.sbomify.com/package/agnt5/0.15.2","markdown_url":"https://pypi.sbomify.com/package/agnt5/0.15.2.md","name":"agnt5","version":"0.15.2","purl":"pkg:pypi/agnt5@0.15.2","summary":"AGNT5 Python SDK - Build durable, resilient agent-first applications","author":null,"project_urls":{"Documentation":"https://agnt5.com/sdk/python","Homepage":"https://agnt5.com","Issues":"https://github.com/agnt5dev/sdk-python/issues","Repository":"https://github.com/agnt5dev/sdk-python"},"requires_python":">=3.11","license":"Apache-2.0","classifiers":["Development Status :: 5 - Production/Stable","Intended Audience :: Developers","Operating System :: MacOS","Operating System :: Microsoft :: Windows","Operating System :: POSIX :: Linux","Programming Language :: Python :: 3","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.14","Programming Language :: Rust"],"wheels":[{"filename":"agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","url":"https://files.pythonhosted.org/packages/fc/cc/3f02524471a52e7c9dfa1041fd1937c882a173684624a564b2b4f9a14ce5/agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","sboms":[{"artifact_uuid":"2ac7becd-2ad6-5ed5-a85c-b22e1f86b70f","path":"agnt5-0.15.2.dist-info/sboms/agnt5-sdk-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/2ac7becd-2ad6-5ed5-a85c-b22e1f86b70f/download","vulnerability_count":87,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl","url":"https://files.pythonhosted.org/packages/55/ef/1a93723fdfaee1226e7cdff5bde463bc216764ee64271db160915aa6f1a4/agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl","sboms":[{"artifact_uuid":"f2be7459-8d66-5a1d-bfb4-ee0605e1c7a7","path":"agnt5-0.15.2.dist-info/sboms/agnt5-sdk-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/f2be7459-8d66-5a1d-bfb4-ee0605e1c7a7/download","vulnerability_count":87,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":2,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-115889","aliases":["GHSA-897f-g5gm-fmxm","RUSTSEC-2026-0380"],"summary":"Bit-packing in Cranelift compiler causes silent overflow and miscompilation","severity":"critical","score":9.9,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.19"],"url":"https://insights.sbomify.com/CVE-2026-115889/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115893","aliases":["GHSA-mghf-wjfp-p5xm","RUSTSEC-2026-0379"],"summary":"Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction","severity":"critical","score":9.9,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.19"],"url":"https://insights.sbomify.com/CVE-2026-115893/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34987","aliases":["GHSA-xx5w-cvp6-jv83","RUSTSEC-2026-0095"],"summary":"Wasmtime with Winch compiler backend may allow a sandbox-escaping memory access","severity":"critical","score":9.2,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34987/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34971","aliases":["GHSA-jhxm-h53p-jm7w","RUSTSEC-2026-0096"],"summary":"Miscompiled guest heap access enables sandbox escape on aarch64 Cranelift","severity":"critical","score":9.0,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34971/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115392","aliases":["GHSA-vqjp-4c8c-hfgg","RUSTSEC-2026-0269"],"summary":"Filesystem sandbox escape when paths or symlinks contain trailing slashes","severity":"high","score":8.8,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.14"],"url":"https://insights.sbomify.com/CVE-2026-115392/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-118688","aliases":["GHSA-m9f7-9w4p-gv38","RUSTSEC-2026-0352"],"summary":"Filesystem sandbox escape when renaming symlinks with trailing slashes","severity":"high","score":8.8,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.18"],"url":"https://insights.sbomify.com/CVE-2026-118688/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34941","aliases":["GHSA-hx6p-xpx3-jvvv","RUSTSEC-2026-0093"],"summary":"Heap OOB read in component model UTF-16 to latin1+utf16 string transcoding","severity":"high","score":8.1,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34941/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0414","aliases":[],"summary":"Exponential event growth with `ENABLE_WIKILINKS`","severity":"high","score":7.5,"package":"pulldown-cmark","version":"0.13.4","ecosystem":"crates.io","purl":"pkg:cargo/pulldown-cmark@0.13.4","fixed":["0.13.5"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0414","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0433","aliases":[],"summary":"Quadratic parsing of nested image wikilinks with `ENABLE_WIKILINKS`","severity":"high","score":7.5,"package":"pulldown-cmark","version":"0.13.4","ecosystem":"crates.io","purl":"pkg:cargo/pulldown-cmark@0.13.4","fixed":["0.13.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0433","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0341","aliases":["GHSA-qfwj-vfxf-92j2"],"summary":"Stream reassembly memory-exhaustion guard in quinn-proto can be bypassed","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0341","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34943","aliases":["GHSA-m758-wjhj-p3jq","RUSTSEC-2026-0085"],"summary":"Panic when lifting `flags` component value","severity":"high","score":7.5,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34943/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34946","aliases":["GHSA-q49f-xg75-m9xw","RUSTSEC-2026-0089"],"summary":"Host panic when Winch compiler executes `table.fill`","severity":"high","score":7.5,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34946/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-47261","aliases":["GHSA-2r75-cxrj-cmph","RUSTSEC-2026-0149"],"summary":"WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction","severity":"high","score":7.5,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.10"],"url":"https://insights.sbomify.com/CVE-2026-47261/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-27204","aliases":["GHSA-852m-cvvp-9p4w","RUSTSEC-2026-0020"],"summary":"Guest-controlled resource exhaustion in WASI implementations","severity":"medium","score":6.9,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.6"],"url":"https://insights.sbomify.com/CVE-2026-27204/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-27572","aliases":["GHSA-243v-98vx-264h","RUSTSEC-2026-0021"],"summary":"Panic adding excessive fields to a `wasi:http/types.fields` instance","severity":"medium","score":6.9,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.6"],"url":"https://insights.sbomify.com/CVE-2026-27572/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34942","aliases":["GHSA-jxhv-7h78-9775","RUSTSEC-2026-0092"],"summary":"Panic when transcoding misaligned component model UTF-16 strings","severity":"medium","score":6.5,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34942/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34945","aliases":["GHSA-m9w2-8782-2946","RUSTSEC-2026-0086"],"summary":"Host data leakage with 64-bit tables and Winch","severity":"medium","score":6.5,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34945/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-58494","aliases":["GHSA-4ch3-9j33-3pmj","RUSTSEC-2026-0188"],"summary":"WASI hard links and renames bypass wasmtime-wasi's FilePerms for destination","severity":"medium","score":6.5,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.12"],"url":"https://insights.sbomify.com/CVE-2026-58494/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-119134","aliases":["GHSA-q554-3cjc-rx7p","RUSTSEC-2026-0363"],"summary":"Component-model handle tables are capped only per instance and charged to no limit","severity":"medium","score":6.2,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.18"],"url":"https://insights.sbomify.com/CVE-2026-119134/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115387","aliases":["GHSA-j2g9-4prp-pf6h","RUSTSEC-2026-0314"],"summary":"Guest can panic host through filesystem datetime overflow","severity":"medium","score":6.2,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.16"],"url":"https://insights.sbomify.com/CVE-2026-115387/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-35186","aliases":["GHSA-f984-pcp8-v2p7","RUSTSEC-2026-0094"],"summary":"Improperly masked return value from `table.grow` with Winch compiler backend","severity":"medium","score":6.1,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-35186/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-35195","aliases":["GHSA-394w-hwhg-8vgm","RUSTSEC-2026-0091"],"summary":"Out-of-bounds write or crash when transcoding component model strings","severity":"medium","score":6.1,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-35195/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115381","aliases":["GHSA-gqmc-89g8-p25r","RUSTSEC-2026-0322"],"summary":"Excessive allocated memory on the host when guests don't have stdio","severity":"medium","score":5.9,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.17"],"url":"https://insights.sbomify.com/CVE-2026-115381/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34944","aliases":["GHSA-qqfj-4vcm-26hv","RUSTSEC-2026-0087"],"summary":"Wasmtime segfault or unused out-of-sandbox load with `f64x2.splat` operator on Cranelift x86-64","severity":"medium","score":5.7,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34944/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-48504","aliases":["GHSA-w9wp-h8wv-79jx"],"summary":"opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation","severity":"medium","score":5.3,"package":"opentelemetry_sdk","version":"0.30.0","ecosystem":"crates.io","purl":"pkg:cargo/opentelemetry_sdk@0.30.0","fixed":["0.32.1"],"url":"https://insights.sbomify.com/CVE-2026-48504/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123613","aliases":["GHSA-2mjx-qc3c-rqvc","RUSTSEC-2026-0285"],"summary":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","severity":"medium","score":5.3,"package":"rustls","version":"0.23.42","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.42","fixed":["0.23.45"],"url":"https://insights.sbomify.com/CVE-2026-123613/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-54786","aliases":["GHSA-3p27-qvp9-27qf","RUSTSEC-2026-0182"],"summary":"Leak in WASIp1 `fd_renumber` implementation","severity":"medium","score":5.0,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.11"],"url":"https://insights.sbomify.com/CVE-2026-54786/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93602","aliases":["GHSA-pwjx-qhcg-rvj4","RUSTSEC-2026-0049"],"summary":"CRLs not considered authoritative by Distribution Point due to faulty matching logic","severity":"medium","score":4.4,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.10"],"url":"https://insights.sbomify.com/CVE-2026-93602/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-24116","aliases":["GHSA-vc8c-j3xm-xj73","RUSTSEC-2026-0006"],"summary":"Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64","severity":"medium","score":4.1,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.5"],"url":"https://insights.sbomify.com/CVE-2026-24116/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.23.42","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.42","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115380","aliases":["GHSA-j366-h8gg-77pm","RUSTSEC-2026-0321"],"summary":"WASI preview 0 implementation of `poll_oneoff` circumvents fuel consumption","severity":"medium","score":4.0,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.17"],"url":"https://insights.sbomify.com/CVE-2026-115380/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115393","aliases":["GHSA-hgjw-h833-99q9","RUSTSEC-2026-0222"],"summary":"Stores can mix up type indices between engines","severity":"low","score":3.8,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.13"],"url":"https://insights.sbomify.com/CVE-2026-115393/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Brotli certificate decompression can allocate up to 1 GiB before authentication","severity":"low","score":3.7,"package":"rustls","version":"0.23.42","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.42","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.22.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.22.4","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.23.42","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.42","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2025-53901","aliases":["GHSA-fm79-3f68-h2fc","RUSTSEC-2025-0046"],"summary":"Wasmtime CLI  is vulnerable to host panic through its fd_renumber function","severity":"low","score":3.5,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["33.0.2"],"url":"https://insights.sbomify.com/CVE-2025-53901/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2025-53901","aliases":["GHSA-fm79-3f68-h2fc","RUSTSEC-2025-0046"],"summary":"Host panic with `fd_renumber` WASIp1 function","severity":"low","score":3.3,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["33.0.2"],"url":"https://insights.sbomify.com/CVE-2025-53901/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2025-47736","aliases":["GHSA-8m95-fffc-h4c5"],"summary":"libsql-sqlite3-parser crash due to invalid UTF-8 input","severity":"low","score":2.9,"package":"libsql-sqlite3-parser","version":"0.13.0","ecosystem":"crates.io","purl":"pkg:cargo/libsql-sqlite3-parser@0.13.0","fixed":[],"url":"https://insights.sbomify.com/CVE-2025-47736/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-34988","aliases":["GHSA-6wgr-89rj-399p","RUSTSEC-2026-0088"],"summary":"Data leakage between pooling allocator instances","severity":"low","score":2.3,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.7"],"url":"https://insights.sbomify.com/CVE-2026-34988/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115386","aliases":["GHSA-96f6-r43r-8c24","RUSTSEC-2026-0323"],"summary":"fd_readdir copies uninitialized struct padding into guest memory","severity":"low","score":2.1,"package":"wasmtime-wasi","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime-wasi@29.0.1","fixed":["36.0.17"],"url":"https://insights.sbomify.com/CVE-2026-115386/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2025-64345","aliases":["GHSA-hc7m-r6v8-hg9q","RUSTSEC-2025-0118"],"summary":"Unsound API access to a WebAssembly shared linear memory","severity":"low","score":1.8,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.3"],"url":"https://insights.sbomify.com/CVE-2025-64345/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-115389","aliases":["GHSA-jqpg-j7w6-42pr","RUSTSEC-2026-0316"],"summary":"Dynamic record lifting can allocate beyond the hostcall fuel limit","severity":"low","score":1.0,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.16"],"url":"https://insights.sbomify.com/CVE-2026-115389/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2025-0141","aliases":[],"summary":"Bincode is unmaintained","severity":"unknown","score":null,"package":"bincode","version":"1.3.3","ecosystem":"crates.io","purl":"pkg:cargo/bincode@1.3.3","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0141","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2025-0057","aliases":[],"summary":"fxhash - no longer maintained","severity":"unknown","score":null,"package":"fxhash","version":"0.2.1","ecosystem":"crates.io","purl":"pkg:cargo/fxhash@0.2.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0057","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.3.27","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.3.27","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.4.15","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.4.15","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.16","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.16","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"1.0.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@1.0.4","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"2.2.0","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@2.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.102.8","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.102.8","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.103.13","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.13","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.53.1","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.53.1","fixed":["1.53.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2024-0449","aliases":[],"summary":"unsafe-libyaml is unmaintained","severity":"unknown","score":null,"package":"unsafe-libyaml","version":"0.2.11","ecosystem":"crates.io","purl":"pkg:cargo/unsafe-libyaml@0.2.11","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0449","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0424","aliases":["GHSA-6fr9-xmw9-5352"],"summary":"Unchecked memory usage in transferring borrowed resources between components","severity":"unknown","score":null,"package":"wasmtime","version":"29.0.1","ecosystem":"crates.io","purl":"pkg:cargo/wasmtime@29.0.1","fixed":["36.0.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0424","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-roots","version":"1.0.9","ecosystem":"crates.io","purl":"pkg:cargo/webpki-roots@1.0.9","fixed":["1.0.10"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0391","aliases":[],"summary":"Data from an abandoned stream leaks into the next stream on a reused context","severity":"unknown","score":null,"package":"zstd","version":"0.13.3","ecosystem":"crates.io","purl":"pkg:cargo/zstd@0.13.3","fixed":["0.13.4"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0391","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0396","aliases":[],"summary":"`Seekable` reads a NULL or out-of-bounds seek table","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0398","aliases":[],"summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0405","aliases":[],"summary":"Out-of-bounds read with an out-of-range `InBuffer::pos`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0405","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]},{"id":"RUSTSEC-2026-0410","aliases":[],"summary":"WebAssembly allocator shim corrupts memory on allocation failure","severity":"unknown","score":null,"package":"zstd-sys","version":"2.0.16+zstd.1.5.7","ecosystem":"crates.io","purl":"pkg:cargo/zstd-sys@2.0.16%2Bzstd.1.5.7","fixed":["2.1.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0410","wheels":["agnt5-0.15.2-cp310-abi3-manylinux_2_28_aarch64.whl","agnt5-0.15.2-cp310-abi3-manylinux_2_28_x86_64.whl"]}],"vulnerability_scan":{"scanned_sboms":2,"total_sboms":2,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":4,"high":13,"medium":21,"low":18,"unknown":31}}}