{"url":"https://pypi.sbomify.com/package/bromium/0.8.15","markdown_url":"https://pypi.sbomify.com/package/bromium/0.8.15.md","name":"bromium","version":"0.8.15","purl":"pkg:pypi/bromium@0.8.15","summary":"A Python extension for UI Automation on Windows.","author":null,"project_urls":{},"requires_python":">=3.12","license":null,"classifiers":["Programming Language :: Python :: Implementation :: CPython","Programming Language :: Python :: Implementation :: PyPy","Programming Language :: Rust"],"wheels":[{"filename":"bromium-0.8.15-cp312-cp312-win_amd64.whl","url":"https://files.pythonhosted.org/packages/97/ad/076500d4cb4b5b9561f8c9d95b907a20a3c16a4c90eac7a24624ee40216d/bromium-0.8.15-cp312-cp312-win_amd64.whl","sboms":[{"artifact_uuid":"d7220987-218c-5dd7-a75a-455bb3f4f75d","path":"bromium-0.8.15.dist-info/sboms/bromium.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/d7220987-218c-5dd7-a75a-455bb3f4f75d/download","vulnerability_count":15,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":1,"has_attestation":false,"vulnerabilities":[{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.25.1","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.25.1","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.30.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.30.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.38.4","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.38.4","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.30.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.30.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.38.4","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.38.4","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.25.1","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.25.1","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"CVE-2026-25541","aliases":["GHSA-434x-w66g-qw3r","RUSTSEC-2026-0007"],"summary":"Integer overflow in `BytesMut::reserve`","severity":"medium","score":5.5,"package":"bytes","version":"1.10.1","ecosystem":"crates.io","purl":"pkg:cargo/bytes@1.10.1","fixed":["1.11.1"],"url":"https://insights.sbomify.com/CVE-2026-25541/","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2025-0057","aliases":[],"summary":"fxhash - no longer maintained","severity":"unknown","score":null,"package":"fxhash","version":"0.2.1","ecosystem":"crates.io","purl":"pkg:cargo/fxhash@0.2.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0057","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2022-0081","aliases":[],"summary":"json is unmaintained","severity":"unknown","score":null,"package":"json","version":"0.12.4","ecosystem":"crates.io","purl":"pkg:cargo/json@0.12.4","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2022-0081","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0186","aliases":[],"summary":"Unchecked pointer offset in crate `memmap2`","severity":"unknown","score":null,"package":"memmap2","version":"0.9.5","ecosystem":"crates.io","purl":"pkg:cargo/memmap2@0.9.5","fixed":["0.9.11"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0186","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2024-0370","aliases":[],"summary":"proc-macro-error is unmaintained","severity":"unknown","score":null,"package":"proc-macro-error","version":"0.4.12","ecosystem":"crates.io","purl":"pkg:cargo/proc-macro-error@0.4.12","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0370","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.8.5","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.8.5","fixed":["0.8.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0001","aliases":[],"summary":"Potential Undefined Behaviors in `Arc<T>`/`Rc<T>` impls of `from_value` on OOM","severity":"unknown","score":null,"package":"rkyv","version":"0.7.45","ecosystem":"crates.io","purl":"pkg:cargo/rkyv@0.7.45","fixed":["0.7.46"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0001","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]},{"id":"RUSTSEC-2026-0235","aliases":[],"summary":"Insufficient archive validation can cause out-of-bounds reads in archives containing Rc/Arc","severity":"unknown","score":null,"package":"rkyv","version":"0.7.45","ecosystem":"crates.io","purl":"pkg:cargo/rkyv@0.7.45","fixed":["0.8.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0235","wheels":["bromium-0.8.15-cp312-cp312-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":1,"total_sboms":1,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":5,"medium":2,"unknown":8}}}