{"url":"https://pypi.sbomify.com/package/genomeshader/0.3.1","markdown_url":"https://pypi.sbomify.com/package/genomeshader/0.3.1.md","name":"genomeshader","version":"0.3.1","purl":"pkg:pypi/genomeshader@0.3.1","summary":null,"author":null,"project_urls":{"Homepage":"https://github.com/broadinstitute/genomeshader"},"requires_python":null,"license":null,"classifiers":[],"wheels":[{"filename":"genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/95/7d/1f95a502460245a96f694b72284ca4e87c37ffdde665ac84a4e803a8cf31/genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"32c688f6-56e2-537d-9cef-5dc384df328f","path":"genomeshader-0.3.1.dist-info/sboms/genomeshader.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/32c688f6-56e2-537d-9cef-5dc384df328f/download","vulnerability_count":69,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"broadinstitute/genomeshader","workflow":"publish.yml","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.10":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/broadinstitute/genomeshader","1.3.6.1.4.1.57264.1.13":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.14":"refs/heads/main","1.3.6.1.4.1.57264.1.15":"736003119","1.3.6.1.4.1.57264.1.16":"https://github.com/broadinstitute","1.3.6.1.4.1.57264.1.17":"393552","1.3.6.1.4.1.57264.1.18":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.19":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.20":"workflow_run","1.3.6.1.4.1.57264.1.21":"https://github.com/broadinstitute/genomeshader/actions/runs/37639082088/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/00/25/68c9586605a845d7cba263ad05fbb0a61c3612df87b17afb4ce148ce2e9e/genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"6c147cfb-d00e-5e73-93ad-d8360743d956","path":"genomeshader-0.3.1.dist-info/sboms/genomeshader.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/6c147cfb-d00e-5e73-93ad-d8360743d956/download","vulnerability_count":69,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"broadinstitute/genomeshader","workflow":"publish.yml","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.10":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/broadinstitute/genomeshader","1.3.6.1.4.1.57264.1.13":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.14":"refs/heads/main","1.3.6.1.4.1.57264.1.15":"736003119","1.3.6.1.4.1.57264.1.16":"https://github.com/broadinstitute","1.3.6.1.4.1.57264.1.17":"393552","1.3.6.1.4.1.57264.1.18":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.19":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.20":"workflow_run","1.3.6.1.4.1.57264.1.21":"https://github.com/broadinstitute/genomeshader/actions/runs/37639082088/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}},{"filename":"genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","url":"https://files.pythonhosted.org/packages/c2/d1/d740c2835eed97d387376f7a69bc4f9bd5d73ab9c32e4bc6cd80a67576a9/genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl","sboms":[{"artifact_uuid":"7dda8264-b5a2-581b-9fc9-2fe5196cdaac","path":"genomeshader-0.3.1.dist-info/sboms/genomeshader.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/7dda8264-b5a2-581b-9fc9-2fe5196cdaac/download","vulnerability_count":69,"scan_error":null}],"attestation":{"status":"verified","publisher_kind":"GitHub","repository":"broadinstitute/genomeshader","workflow":"publish.yml","predicate_type":"https://docs.pypi.org/attestations/publish/v1","certificate_claims":{"1.3.6.1.4.1.57264.1.8":"https://token.actions.githubusercontent.com","1.3.6.1.4.1.57264.1.9":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.10":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.11":"github-hosted","1.3.6.1.4.1.57264.1.12":"https://github.com/broadinstitute/genomeshader","1.3.6.1.4.1.57264.1.13":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.14":"refs/heads/main","1.3.6.1.4.1.57264.1.15":"736003119","1.3.6.1.4.1.57264.1.16":"https://github.com/broadinstitute","1.3.6.1.4.1.57264.1.17":"393552","1.3.6.1.4.1.57264.1.18":"https://github.com/broadinstitute/genomeshader/.github/workflows/publish.yml@refs/heads/main","1.3.6.1.4.1.57264.1.19":"6c4cb81dc92d5eec3cb47fe87ded24e01f05ddae","1.3.6.1.4.1.57264.1.20":"workflow_run","1.3.6.1.4.1.57264.1.21":"https://github.com/broadinstitute/genomeshader/actions/runs/37639082088/attempts/1","1.3.6.1.4.1.57264.1.22":"public"}}}],"formats":["CycloneDX"],"sbom_count":3,"has_attestation":true,"vulnerabilities":[{"id":"CVE-2026-42327","aliases":["GHSA-xp3w-r5p5-63rr"],"summary":"rust-openssl has undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs","severity":"high","score":8.7,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.79"],"url":"https://insights.sbomify.com/CVE-2026-42327/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"GHSA-36hh-v3qg-5jq4","aliases":["RUSTSEC-2026-0176"],"summary":"PyO3 has an Out-of-bounds Read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.20.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/GHSA-36hh-v3qg-5jq4","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-41898","aliases":["GHSA-hppc-g8h3-xhp3"],"summary":"rust-openssl: Unchecked callback length in PSK/cookie trampolines leaks adjacent memory to peer","severity":"high","score":8.3,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.78"],"url":"https://insights.sbomify.com/CVE-2026-41898/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-41681","aliases":["GHSA-ghm9-cr32-g9qj"],"summary":"rust-openssl: rustMdCtxRef::digest_final() writes past caller buffer with no length check","severity":"high","score":8.1,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.78"],"url":"https://insights.sbomify.com/CVE-2026-41681/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2024-27308","aliases":["GHSA-r8w9-5wcg-vfj7","RUSTSEC-2024-0019"],"summary":"Tokens for named pipes may be delivered after deregistration","severity":"high","score":7.5,"package":"mio","version":"0.8.10","ecosystem":"crates.io","purl":"pkg:cargo/mio@0.8.10","fixed":["0.8.11"],"url":"https://insights.sbomify.com/CVE-2024-27308/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0194","aliases":[],"summary":"Quadratic run time when checking a start tag for duplicate attribute names","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0194","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0195","aliases":[],"summary":"Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service","severity":"high","score":7.5,"package":"quick-xml","version":"0.31.0","ecosystem":"crates.io","purl":"pkg:cargo/quick-xml@0.31.0","fixed":["0.41.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0195","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-41676","aliases":["GHSA-pqf5-4pqq-29f5"],"summary":"rust-openssl: Deriver::derive and PkeyCtxRef::derive can overflow short buffers on OpenSSL 1.1.1","severity":"high","score":7.2,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.78"],"url":"https://insights.sbomify.com/CVE-2026-41676/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-41678","aliases":["GHSA-8c75-8mhr-p7r9","RUSTSEC-2026-0463"],"summary":"Out-of-bounds write in `aes::unwrap_key`","severity":"high","score":7.2,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.78"],"url":"https://insights.sbomify.com/CVE-2026-41678/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2024-0357","aliases":["GHSA-q445-7m23-qrmw"],"summary":"`MemBio::get_buf` has undefined behavior with empty buffers","severity":"medium","score":6.9,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.66"],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0357","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-25727","aliases":["GHSA-r6v5-fh4h-64xc","RUSTSEC-2026-0009"],"summary":"Denial of Service via Stack Exhaustion","severity":"medium","score":6.8,"package":"time","version":"0.3.44","ecosystem":"crates.io","purl":"pkg:cargo/time@0.3.44","fixed":["0.3.47"],"url":"https://insights.sbomify.com/CVE-2026-25727/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2025-4432","aliases":["GHSA-4p46-pwfr-66x6","GHSA-c86p-w88r-qvqr","GO-2025-3678","RUSTSEC-2025-0009"],"summary":"Some AES functions may panic when overflow checking is enabled.","severity":"medium","score":6.6,"package":"ring","version":"0.16.20","ecosystem":"crates.io","purl":"pkg:cargo/ring@0.16.20","fixed":["0.17.12"],"url":"https://insights.sbomify.com/CVE-2025-4432/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2025-4432","aliases":["GHSA-4p46-pwfr-66x6","GHSA-c86p-w88r-qvqr","GO-2025-3678","RUSTSEC-2025-0009"],"summary":"Some AES functions may panic when overflow checking is enabled.","severity":"medium","score":6.6,"package":"ring","version":"0.17.7","ecosystem":"crates.io","purl":"pkg:cargo/ring@0.17.7","fixed":["0.17.12"],"url":"https://insights.sbomify.com/CVE-2025-4432/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2024-12224","aliases":["GHSA-h97m-ww89-6jmq","RUSTSEC-2024-0421"],"summary":"`idna` accepts Punycode labels that do not produce any non-ASCII when decoded","severity":"medium","score":6.3,"package":"idna","version":"0.5.0","ecosystem":"crates.io","purl":"pkg:cargo/idna@0.5.0","fixed":["1.0.0"],"url":"https://insights.sbomify.com/CVE-2024-12224/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2025-24898","aliases":["GHSA-rpmj-rpgj-qmpm","RUSTSEC-2025-0004"],"summary":"ssl::select_next_proto use after free","severity":"medium","score":6.3,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.70"],"url":"https://insights.sbomify.com/CVE-2025-24898/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0022","aliases":["GHSA-4fcv-w3qc-ppgg"],"summary":"Use-After-Free in `Md::fetch` and `Cipher::fetch`","severity":"medium","score":6.3,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.72"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0022","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.20.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2023-49092","aliases":["GHSA-4grx-2x9w-596c","GHSA-c38w-74pg-36hr","RUSTSEC-2023-0071"],"summary":"Marvin Attack: potential key recovery through timing sidechannels","severity":"medium","score":5.9,"package":"rsa","version":"0.6.1","ecosystem":"crates.io","purl":"pkg:cargo/rsa@0.6.1","fixed":["0.10.0"],"url":"https://insights.sbomify.com/CVE-2023-49092/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-25541","aliases":["GHSA-434x-w66g-qw3r","RUSTSEC-2026-0007"],"summary":"Integer overflow in `BytesMut::reserve`","severity":"medium","score":5.5,"package":"bytes","version":"1.5.0","ecosystem":"crates.io","purl":"pkg:cargo/bytes@1.5.0","fixed":["1.11.1"],"url":"https://insights.sbomify.com/CVE-2026-25541/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-25537","aliases":["GHSA-h395-gr6q-cpjc"],"summary":"jsonwebtoken has Type Confusion that leads to potential authorization bypass","severity":"medium","score":5.5,"package":"jsonwebtoken","version":"7.2.0","ecosystem":"crates.io","purl":"pkg:cargo/jsonwebtoken@7.2.0","fixed":["10.3.0"],"url":"https://insights.sbomify.com/CVE-2026-25537/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2024-0332","aliases":["GHSA-q6cp-qfwq-4gcv"],"summary":"Degradation of service in h2 servers with CONTINUATION Flood","severity":"medium","score":5.3,"package":"h2","version":"0.3.24","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.3.24","fixed":["0.3.26"],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0332","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-44662","aliases":["GHSA-xv59-967r-8726"],"summary":"rust-openssl vulnerable to heap buffer overflow when encrypting with AES key-wrap-with-padding","severity":"medium","score":5.1,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.79"],"url":"https://insights.sbomify.com/CVE-2026-44662/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-45784","aliases":["GHSA-phqj-4mhp-q6mq"],"summary":"rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers","severity":"medium","score":5.1,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.80"],"url":"https://insights.sbomify.com/CVE-2026-45784/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2024-41178","aliases":["GHSA-c2hf-vcmr-qjrf","RUSTSEC-2024-0358"],"summary":"Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files","severity":"medium","score":4.8,"package":"object_store","version":"0.8.0","ecosystem":"crates.io","purl":"pkg:cargo/object_store@0.8.0","fixed":["0.10.2"],"url":"https://insights.sbomify.com/CVE-2024-41178/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0019","aliases":["GHSA-67r5-rqwv-9p9q"],"summary":"`array-init-cursor` in version 0.2.0 and below is unsound when used with types that implement `Drop`","severity":"low","score":2.9,"package":"array-init-cursor","version":"0.2.0","ecosystem":"crates.io","purl":"pkg:cargo/array-init-cursor@0.2.0","fixed":["0.2.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0019","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0020","aliases":["GHSA-pph8-gcv7-4qj5"],"summary":"Risk of buffer overflow in `PyString::from_object`","severity":"low","score":2.9,"package":"pyo3","version":"0.20.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.20.2","fixed":["0.24.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0020","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2024-0379","aliases":["GHSA-x8jh-xj3x-gx3c"],"summary":"Multiple soundness issues","severity":"low","score":2.7,"package":"fast-float","version":"0.2.0","ecosystem":"crates.io","purl":"pkg:cargo/fast-float@0.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0379","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-21895","aliases":["GHSA-9c48-w39g-hm26"],"summary":"rsa crate has potential panic on a prime being equal to 1","severity":"low","score":2.7,"package":"rsa","version":"0.6.1","ecosystem":"crates.io","purl":"pkg:cargo/rsa@0.6.1","fixed":["0.9.10"],"url":"https://insights.sbomify.com/CVE-2026-21895/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0023","aliases":["GHSA-rr8g-9fpq-6wmg"],"summary":"Broadcast channel calls clone in parallel, but does not require `Sync`","severity":"low","score":2.7,"package":"tokio","version":"1.35.1","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.35.1","fixed":["1.38.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0023","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"GHSA-6g2r-675j-hx59","aliases":[],"summary":"xxhash-rust: Safe xxh3 custom-secret API accepts too-short secret in release","severity":"low","score":2.3,"package":"xxhash-rust","version":"0.8.8","ecosystem":"crates.io","purl":"pkg:cargo/xxhash-rust@0.8.8","fixed":["0.8.16"],"url":"https://osv.dev/vulnerability/GHSA-6g2r-675j-hx59","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-41677","aliases":["GHSA-xmgf-hq76-4vx2"],"summary":"rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length","severity":"low","score":1.7,"package":"openssl","version":"0.10.63","ecosystem":"crates.io","purl":"pkg:cargo/openssl@0.10.63","fixed":["0.10.78"],"url":"https://insights.sbomify.com/CVE-2026-41677/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0056","aliases":[],"summary":"adler crate is unmaintained, use adler2 instead","severity":"unknown","score":null,"package":"adler","version":"1.0.2","ecosystem":"crates.io","purl":"pkg:cargo/adler@1.0.2","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0056","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0190","aliases":[],"summary":"Unsoundness in `Error::downcast_mut()`","severity":"unknown","score":null,"package":"anyhow","version":"1.0.79","ecosystem":"crates.io","purl":"pkg:cargo/anyhow@1.0.79","fixed":["1.0.103"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0190","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0052","aliases":[],"summary":"async-std has been discontinued","severity":"unknown","score":null,"package":"async-std","version":"1.12.0","ecosystem":"crates.io","purl":"pkg:cargo/async-std@1.12.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0052","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0012","aliases":[],"summary":"`backoff` is unmaintained.","severity":"unknown","score":null,"package":"backoff","version":"0.4.0","ecosystem":"crates.io","purl":"pkg:cargo/backoff@0.4.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0012","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0387","aliases":[],"summary":"Multiple timing variability issues in operations intended to be constant-time","severity":"unknown","score":null,"package":"crypto-bigint","version":"0.3.2","ecosystem":"crates.io","purl":"pkg:cargo/crypto-bigint@0.3.2","fixed":["0.7.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0387","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0058","aliases":[],"summary":"custom_derive crate is unmaintained","severity":"unknown","score":null,"package":"custom_derive","version":"0.1.7","ecosystem":"crates.io","purl":"pkg:cargo/custom_derive@0.1.7","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0058","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2021-0141","aliases":[],"summary":"dotenv is Unmaintained","severity":"unknown","score":null,"package":"dotenv","version":"0.15.0","ecosystem":"crates.io","purl":"pkg:cargo/dotenv@0.15.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2021-0141","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0003","aliases":["GHSA-8655-xgh5-5vvq"],"summary":"Segmentation fault due to lack of bound check","severity":"unknown","score":null,"package":"fast-float","version":"0.2.0","ecosystem":"crates.io","purl":"pkg:cargo/fast-float@0.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0003","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.3.24","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.3.24","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2024-0384","aliases":[],"summary":"`instant` is unmaintained","severity":"unknown","score":null,"package":"instant","version":"0.1.12","ecosystem":"crates.io","purl":"pkg:cargo/instant@0.1.12","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0384","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0418","aliases":["GHSA-8p3x-q3q3-q3v5"],"summary":"libz-sys build script leaks environment variables in the build directory","severity":"unknown","score":null,"package":"libz-sys","version":"1.1.15","ecosystem":"crates.io","purl":"pkg:cargo/libz-sys@1.1.15","fixed":["1.1.31"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0418","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0186","aliases":[],"summary":"Unchecked pointer offset in crate `memmap2`","severity":"unknown","score":null,"package":"memmap2","version":"0.7.1","ecosystem":"crates.io","purl":"pkg:cargo/memmap2@0.7.1","fixed":["0.9.11"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0186","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0119","aliases":[],"summary":"number_prefix crate is unmaintained","severity":"unknown","score":null,"package":"number_prefix","version":"0.4.0","ecosystem":"crates.io","purl":"pkg:cargo/number_prefix@0.4.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0119","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0441","aliases":[],"summary":"`pin-utils` is unmaintained","severity":"unknown","score":null,"package":"pin-utils","version":"0.1.0","ecosystem":"crates.io","purl":"pkg:cargo/pin-utils@0.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0441","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.8.5","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.8.5","fixed":["0.8.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0010","aliases":[],"summary":"Versions of *ring* prior to 0.17 are unmaintained.","severity":"unknown","score":null,"package":"ring","version":"0.16.20","ecosystem":"crates.io","purl":"pkg:cargo/ring@0.16.20","fixed":["0.17.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0010","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"1.0.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@1.0.4","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0249","aliases":[],"summary":"smartstring is unmaintained","severity":"unknown","score":null,"package":"smartstring","version":"1.0.1","ecosystem":"crates.io","purl":"pkg:cargo/smartstring@1.0.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0249","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.35.1","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.35.1","fixed":["1.51.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-roots","version":"0.25.4","ecosystem":"crates.io","purl":"pkg:cargo/webpki-roots@0.25.4","fixed":["0.26.11"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.0.0","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.0.0","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]},{"id":"RUSTSEC-2026-0410","aliases":[],"summary":"WebAssembly allocator shim corrupts memory on allocation failure","severity":"unknown","score":null,"package":"zstd-sys","version":"2.0.9+zstd.1.5.5","ecosystem":"crates.io","purl":"pkg:cargo/zstd-sys@2.0.9%2Bzstd.1.5.5","fixed":["2.1.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0410","wheels":["genomeshader-0.3.1-cp37-abi3-macosx_10_12_x86_64.whl","genomeshader-0.3.1-cp37-abi3-macosx_11_0_arm64.whl","genomeshader-0.3.1-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"]}],"vulnerability_scan":{"scanned_sboms":3,"total_sboms":3,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":10,"medium":16,"low":11,"unknown":32}}}