{"url":"https://pypi.sbomify.com/package/keeper-pam-webrtc-rs/2.1.7","markdown_url":"https://pypi.sbomify.com/package/keeper-pam-webrtc-rs/2.1.7.md","name":"keeper-pam-webrtc-rs","version":"2.1.7","purl":"pkg:pypi/keeper-pam-webrtc-rs@2.1.7","summary":"Keeper PAM WebRTC for Python - A secure, stable, and high-performance Tube API for Python, providing WebRTC-based secure tunneling with enterprise-grade security and reliability optimizations.","author":null,"project_urls":{},"requires_python":">=3.7","license":"MIT","classifiers":["Development Status :: 5 - Production/Stable","Intended Audience :: Developers","Programming Language :: Python :: 3","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.7","Programming Language :: Python :: 3.8","Programming Language :: Python :: 3.9","Programming Language :: Rust","Topic :: Communications","Topic :: Security"],"wheels":[{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","url":"https://files.pythonhosted.org/packages/55/b2/5cd9832bfd6b7db3b5ae6c1a03ebbbcffcdd4a97990de50b3070a6c3f0d7/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","sboms":[{"artifact_uuid":"630d1a64-e988-5db6-b7ba-9f134ddb718f","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/630d1a64-e988-5db6-b7ba-9f134ddb718f/download","vulnerability_count":82,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","url":"https://files.pythonhosted.org/packages/12/34/7bb05e499633b5f7726d51f9137b49f0a1255509931307cff98166f654d2/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","sboms":[{"artifact_uuid":"975c5e4c-c1ee-5955-b5ab-a4ea375f7cad","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/975c5e4c-c1ee-5955-b5ab-a4ea375f7cad/download","vulnerability_count":82,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","url":"https://files.pythonhosted.org/packages/35/a1/e53acdd07623de30f9dbf72852e05f5800f939dd53b5a8d744e3908e3d16/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","sboms":[{"artifact_uuid":"a94f3a5e-34c8-5da7-8fff-60f9ac259e36","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/a94f3a5e-34c8-5da7-8fff-60f9ac259e36/download","vulnerability_count":84,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","url":"https://files.pythonhosted.org/packages/3e/7d/abddb382b36ed98a571d952107af781ddf5f4cb87e64438e5ab1d79def34/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","sboms":[{"artifact_uuid":"34f3fc76-c1a0-5d52-bb47-11c4797e8c77","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/34f3fc76-c1a0-5d52-bb47-11c4797e8c77/download","vulnerability_count":84,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","url":"https://files.pythonhosted.org/packages/a4/fd/24c58646c98f7888ca600d5cec961f6cd2f6907a0c8a169ab71330d770f1/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","sboms":[{"artifact_uuid":"13cfadf4-459e-5ca8-9ad9-1b7230060531","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/auditwheel.cdx.json","format":"CycloneDX/1.4","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/13cfadf4-459e-5ca8-9ad9-1b7230060531/download","vulnerability_count":0,"scan_error":null},{"artifact_uuid":"80a0bcce-b196-5528-88a2-0c86cec2a0da","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/80a0bcce-b196-5528-88a2-0c86cec2a0da/download","vulnerability_count":84,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl","url":"https://files.pythonhosted.org/packages/09/04/43e04bd9088a660075c249a5301562438835cf101508a78aa48ee92eaca7/keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl","sboms":[{"artifact_uuid":"981634db-bd1d-59f6-aac5-f2173a6e56cb","path":"keeper_pam_webrtc_rs-2.1.7.dist-info/sboms/keeper-pam-webrtc-rs-py.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/981634db-bd1d-59f6-aac5-f2173a6e56cb/download","vulnerability_count":83,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":7,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-18140","aliases":["GHSA-8ffr-xgwf-xj56"],"summary":"aws-smithy-json: Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers","severity":"high","score":8.7,"package":"aws-smithy-json","version":"0.62.5","ecosystem":"crates.io","purl":"pkg:cargo/aws-smithy-json@0.62.5","fixed":["0.62.7"],"url":"https://insights.sbomify.com/CVE-2026-18140/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123607","aliases":["GHSA-3v94-mw7p-v465","RUSTSEC-2026-0118","RUSTSEC-2026-0120"],"summary":"NSEC3 closest-encloser proof validation enters unbounded loop on cross-zone responses","severity":"high","score":8.7,"package":"hickory-proto","version":"0.25.2","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto@0.25.2","fixed":["0.26.0-beta.1"],"url":"https://insights.sbomify.com/CVE-2026-123607/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-116794","aliases":["GHSA-vp5q-ff62-jwqv"],"summary":"russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation","severity":"high","score":8.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.65"],"url":"https://insights.sbomify.com/CVE-2026-116794/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93657","aliases":["GHSA-5j98-2g5x-46v6"],"summary":"hickory-resolver: Resolver::lookup() and Resolver::lookup_ip() APIs obscure DNSSEC validation failures","severity":"high","score":7.5,"package":"hickory-resolver","version":"0.25.2","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver@0.25.2","fixed":["0.26.2"],"url":"https://insights.sbomify.com/CVE-2026-93657/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-25800","aliases":["GHSA-4w2j-m93h-cj5j","RUSTSEC-2026-0185"],"summary":" Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.15"],"url":"https://insights.sbomify.com/CVE-2026-25800/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0340","aliases":["GHSA-3g6h-r5qx-f6hq"],"summary":"Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled","severity":"high","score":7.5,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0340","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102823","aliases":["GHSA-47hw-gvq5-r2gm"],"summary":"russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened","severity":"high","score":7.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.63.1"],"url":"https://insights.sbomify.com/CVE-2026-102823/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-42189","aliases":["GHSA-f5v4-2wr6-hqmg"],"summary":"russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler","severity":"high","score":7.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.60.1"],"url":"https://insights.sbomify.com/CVE-2026-42189/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-46673","aliases":["GHSA-g9f8-wqj9-fjw5","RUSTSEC-2026-0153","RUSTSEC-2026-0154"],"summary":"Unbounded 32-bit allocation","severity":"high","score":7.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.60.3"],"url":"https://insights.sbomify.com/CVE-2026-46673/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-46702","aliases":["GHSA-wwx6-x28x-8259"],"summary":"russh: Post-decompression SSH packet size was not bounded, allowing remote oversized compressed packets","severity":"high","score":7.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.61.1"],"url":"https://insights.sbomify.com/CVE-2026-46702/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-48110","aliases":["GHSA-4r3c-5hpg-58qr"],"summary":"Russh SSH message fields were decoded through allocation-first parsers before field-specific bounds","severity":"high","score":7.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.61.0"],"url":"https://insights.sbomify.com/CVE-2026-48110/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-46673","aliases":["GHSA-g9f8-wqj9-fjw5","RUSTSEC-2026-0153","RUSTSEC-2026-0154"],"summary":"Unchecked `CryptoVec` allocation and growth handling","severity":"high","score":7.5,"package":"russh-cryptovec","version":"0.7.3","ecosystem":"crates.io","purl":"pkg:cargo/russh-cryptovec@0.7.3","fixed":["0.60.3"],"url":"https://insights.sbomify.com/CVE-2026-46673/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93599","aliases":["GHSA-82j2-j2ch-gfr8","RUSTSEC-2026-0104"],"summary":"Reachable panic in certificate revocation list parsing","severity":"high","score":7.5,"package":"rustls-webpki","version":"0.103.9","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.9","fixed":["0.103.13"],"url":"https://insights.sbomify.com/CVE-2026-93599/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123608","aliases":["GHSA-q2qq-hmj6-3wpp","RUSTSEC-2026-0119"],"summary":"CPU exhaustion during message encoding due to O(n²) name compression","severity":"medium","score":6.9,"package":"hickory-proto","version":"0.25.2","ecosystem":"crates.io","purl":"pkg:cargo/hickory-proto@0.25.2","fixed":["0.26.1"],"url":"https://insights.sbomify.com/CVE-2026-123608/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123585","aliases":["GHSA-6f2x-v7q7-m7m5"],"summary":"hickory-resolver follows irrelevant CNAME records","severity":"medium","score":6.9,"package":"hickory-resolver","version":"0.25.2","ecosystem":"crates.io","purl":"pkg:cargo/hickory-resolver@0.25.2","fixed":["0.26.2"],"url":"https://insights.sbomify.com/CVE-2026-123585/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-119375","aliases":["GHSA-72w2-rjgg-q729","RUSTSEC-2026-0459"],"summary":"`libsqlite3-sys` via C SQLite CVE-2026-119375","severity":"medium","score":6.8,"package":"libsqlite3-sys","version":"0.30.1","ecosystem":"crates.io","purl":"pkg:cargo/libsqlite3-sys@0.30.1","fixed":["0.39.0"],"url":"https://insights.sbomify.com/CVE-2026-119375/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2025-54804","aliases":["GHSA-h5rc-j5f5-3gcm"],"summary":"russh is missing overflow checks during channel windows adjust","severity":"medium","score":6.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.54.1"],"url":"https://insights.sbomify.com/CVE-2025-54804/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102821","aliases":["GHSA-35g8-35p8-c8fw"],"summary":"Russh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey","severity":"medium","score":6.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.63.2"],"url":"https://insights.sbomify.com/CVE-2026-102821/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-48107","aliases":["GHSA-g9g7-5cgw-6v28"],"summary":"Russh: Unchecked keyboard-interactive prompt count in client auth path","severity":"medium","score":6.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.61.0"],"url":"https://insights.sbomify.com/CVE-2026-48107/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-68930","aliases":["GHSA-m65r-rprj-r5rg"],"summary":"Russh: Channel-scoped server callbacks can be reached without an open channel","severity":"medium","score":6.5,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.62.5"],"url":"https://insights.sbomify.com/CVE-2026-68930/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102820","aliases":["GHSA-g4mp-vgx3-xrvm"],"summary":"pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)","severity":"medium","score":6.2,"package":"pageant","version":"0.0.1","ecosystem":"crates.io","purl":"pkg:cargo/pageant@0.0.1","fixed":["0.2.3"],"url":"https://insights.sbomify.com/CVE-2026-102820/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2023-49092","aliases":["GHSA-4grx-2x9w-596c","GHSA-c38w-74pg-36hr","RUSTSEC-2023-0071"],"summary":"Marvin Attack: potential key recovery through timing sidechannels","severity":"medium","score":5.9,"package":"rsa","version":"0.10.0-rc.9","ecosystem":"crates.io","purl":"pkg:cargo/rsa@0.10.0-rc.9","fixed":["0.10.0"],"url":"https://insights.sbomify.com/CVE-2023-49092/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2023-49092","aliases":["GHSA-4grx-2x9w-596c","GHSA-c38w-74pg-36hr","RUSTSEC-2023-0071"],"summary":"Marvin Attack: potential key recovery through timing sidechannels","severity":"medium","score":5.9,"package":"rsa","version":"0.9.10","ecosystem":"crates.io","purl":"pkg:cargo/rsa@0.9.10","fixed":["0.10.0"],"url":"https://insights.sbomify.com/CVE-2023-49092/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-46705","aliases":["GHSA-hpv4-5h6f-wqr3"],"summary":"russh server userauth state is not reset when authentication principal changes","severity":"medium","score":5.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.61.0"],"url":"https://insights.sbomify.com/CVE-2026-46705/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-48108","aliases":["GHSA-76r6-x97p-67vr"],"summary":"Russh: SSH identification parsing accepted non-canonical client banners and did not bound pre-banner input","severity":"medium","score":5.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.61.0"],"url":"https://insights.sbomify.com/CVE-2026-48108/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-73429","aliases":["GHSA-g9hv-x236-4qp3"],"summary":"Russh: client wrong-length X25519 `clone_from_slice` panic (pre-auth DoS)","severity":"medium","score":5.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.62.4"],"url":"https://insights.sbomify.com/CVE-2026-73429/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-73430","aliases":["GHSA-5xvq-cp9x-6p6r"],"summary":"Russh: Pre-auth remote panic via all-zero Curve25519 peer public value (encode_mpint OOB)","severity":"medium","score":5.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.62.4"],"url":"https://insights.sbomify.com/CVE-2026-73430/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123613","aliases":["GHSA-2mjx-qc3c-rqvc","RUSTSEC-2026-0285"],"summary":"TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries","severity":"medium","score":5.3,"package":"rustls","version":"0.23.37","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.37","fixed":["0.23.45"],"url":"https://insights.sbomify.com/CVE-2026-123613/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"GHSA-7gcf-g7xr-8hxj","aliases":[],"summary":"serde_with: KeyValueMap serialization panics on empty sequence or map entries","severity":"medium","score":5.1,"package":"serde_with","version":"3.18.0","ecosystem":"crates.io","purl":"pkg:cargo/serde_with@3.18.0","fixed":["3.21.0"],"url":"https://osv.dev/vulnerability/GHSA-7gcf-g7xr-8hxj","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93602","aliases":["GHSA-pwjx-qhcg-rvj4","RUSTSEC-2026-0049"],"summary":"CRLs not considered authoritative by Distribution Point due to faulty matching logic","severity":"medium","score":4.4,"package":"rustls-webpki","version":"0.103.9","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.9","fixed":["0.103.10"],"url":"https://insights.sbomify.com/CVE-2026-93602/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102824","aliases":["GHSA-w3jg-pjxf-73p4"],"summary":"Russh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange","severity":"medium","score":4.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.63.0"],"url":"https://insights.sbomify.com/CVE-2026-102824/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-111061","aliases":["GHSA-4wc5-f2rc-q74m"],"summary":"russh: Unbounded memory allocation in agent protocol server via crafted constraint records","severity":"medium","score":4.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.64.1"],"url":"https://insights.sbomify.com/CVE-2026-111061/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-116773","aliases":["GHSA-4p9f-7p9m-5vfg"],"summary":"russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets","severity":"medium","score":4.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.65"],"url":"https://insights.sbomify.com/CVE-2026-116773/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-73489","aliases":["GHSA-cqjc-rmpq-xprq"],"summary":"Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records","severity":"medium","score":4.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.62.4"],"url":"https://insights.sbomify.com/CVE-2026-73489/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123609","aliases":["GHSA-c8m5-c952-6cm4","RUSTSEC-2026-0346"],"summary":"`Debug` impls for client session values expose TLS secrets","severity":"medium","score":4.0,"package":"rustls","version":"0.23.37","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.37","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123609/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102822","aliases":["GHSA-p8qx-h547-fjw9"],"summary":"russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic","severity":"low","score":3.7,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.63.1"],"url":"https://insights.sbomify.com/CVE-2026-102822/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-102825","aliases":["GHSA-g6xm-f9xp-qq35"],"summary":"Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path","severity":"low","score":3.7,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.62.6"],"url":"https://insights.sbomify.com/CVE-2026-102825/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123610","aliases":["GHSA-h2v8-394m-p7vv","RUSTSEC-2026-0348"],"summary":"Brotli certificate decompression can allocate up to 1 GiB before authentication","severity":"low","score":3.7,"package":"rustls","version":"0.23.37","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.37","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123610/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.21.12","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.21.12","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-123611","aliases":["GHSA-w44r-93j7-qv28","RUSTSEC-2026-0349"],"summary":"Unauthenticated ServerHello can downgrade later connections to classical key exchange","severity":"low","score":3.7,"package":"rustls","version":"0.23.37","ecosystem":"crates.io","purl":"pkg:cargo/rustls@0.23.37","fixed":["0.23.46"],"url":"https://insights.sbomify.com/CVE-2026-123611/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-116696","aliases":["GHSA-9wfm-jcj8-jfv9"],"summary":"russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages","severity":"low","score":3.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.65.0"],"url":"https://insights.sbomify.com/CVE-2026-116696/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0002","aliases":["GHSA-rhfx-m35p-ff5j"],"summary":"`IterMut` violates Stacked Borrows by invalidating internal pointer","severity":"low","score":2.7,"package":"lru","version":"0.12.5","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.12.5","fixed":["0.16.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0002","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0002","aliases":["GHSA-rhfx-m35p-ff5j"],"summary":"`IterMut` violates Stacked Borrows by invalidating internal pointer","severity":"low","score":2.7,"package":"lru","version":"0.14.0","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.14.0","fixed":["0.16.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0002","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-111062","aliases":["GHSA-j7h2-66j4-ghjf"],"summary":"A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request","severity":"low","score":2.3,"package":"russh","version":"0.46.0","ecosystem":"crates.io","purl":"pkg:cargo/russh@0.46.0","fixed":["0.64.0"],"url":"https://insights.sbomify.com/CVE-2026-111062/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93600","aliases":["GHSA-965h-392x-2mh5","RUSTSEC-2026-0098"],"summary":"Name constraints for URI names were incorrectly accepted","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.103.9","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.9","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93600/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-93601","aliases":["GHSA-xgp8-3hg3-c2mh","RUSTSEC-2026-0099"],"summary":"Name constraints were accepted for certificates asserting a wildcard name","severity":"low","score":2.2,"package":"rustls-webpki","version":"0.103.9","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.9","fixed":["0.103.12"],"url":"https://insights.sbomify.com/CVE-2026-93601/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0190","aliases":[],"summary":"Unsoundness in `Error::downcast_mut()`","severity":"unknown","score":null,"package":"anyhow","version":"1.0.102","ecosystem":"crates.io","purl":"pkg:cargo/anyhow@1.0.102","fixed":["1.0.103"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0190","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0052","aliases":[],"summary":"async-std has been discontinued","severity":"unknown","score":null,"package":"async-std","version":"1.13.2","ecosystem":"crates.io","purl":"pkg:cargo/async-std@1.13.2","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0052","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2023-0089","aliases":[],"summary":"atomic-polyfill is unmaintained","severity":"unknown","score":null,"package":"atomic-polyfill","version":"1.0.3","ecosystem":"crates.io","purl":"pkg:cargo/atomic-polyfill@1.0.3","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2023-0089","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl"]},{"id":"RUSTSEC-2025-0141","aliases":[],"summary":"Bincode is unmaintained","severity":"unknown","score":null,"package":"bincode","version":"1.3.3","ecosystem":"crates.io","purl":"pkg:cargo/bincode@1.3.3","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0141","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0105","aliases":[],"summary":"core2 is unmaintained, all versions yanked","severity":"unknown","score":null,"package":"core2","version":"0.4.0","ecosystem":"crates.io","purl":"pkg:cargo/core2@0.4.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0105","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0387","aliases":[],"summary":"Multiple timing variability issues in operations intended to be constant-time","severity":"unknown","score":null,"package":"crypto-bigint","version":"0.4.9","ecosystem":"crates.io","purl":"pkg:cargo/crypto-bigint@0.4.9","fixed":["0.7.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0387","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0387","aliases":[],"summary":"Multiple timing variability issues in operations intended to be constant-time","severity":"unknown","score":null,"package":"crypto-bigint","version":"0.5.5","ecosystem":"crates.io","purl":"pkg:cargo/crypto-bigint@0.5.5","fixed":["0.7.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0387","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0387","aliases":[],"summary":"Multiple timing variability issues in operations intended to be constant-time","severity":"unknown","score":null,"package":"crypto-bigint","version":"0.7.0-rc.8","ecosystem":"crates.io","purl":"pkg:cargo/crypto-bigint@0.7.0-rc.8","fixed":["0.7.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0387","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0286","aliases":["GHSA-r6vc-97x9-63vv"],"summary":"Out-of-bounds read when decoding CKA_ALLOWED_MECHANISMS","severity":"unknown","score":null,"package":"cryptoki","version":"0.10.0","ecosystem":"crates.io","purl":"pkg:cargo/cryptoki@0.10.0","fixed":["0.10.1"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0286","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0221","aliases":[],"summary":"`event-listener` allows `!Send` tags to cross thread boundaries via `StackSlot`","severity":"unknown","score":null,"package":"event-listener","version":"5.4.1","ecosystem":"crates.io","purl":"pkg:cargo/event-listener@5.4.1","fixed":["5.4.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0221","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.3.27","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.3.27","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"summary":"h2 unbounded empty DATA frames","severity":"unknown","score":null,"package":"h2","version":"0.4.13","ecosystem":"crates.io","purl":"pkg:cargo/h2@0.4.13","fixed":["0.4.16"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0418","aliases":["GHSA-8p3x-q3q3-q3v5"],"summary":"libz-sys build script leaks environment variables in the build directory","severity":"unknown","score":null,"package":"libz-sys","version":"1.1.25","ecosystem":"crates.io","purl":"pkg:cargo/libz-sys@1.1.25","fixed":["1.1.31"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0418","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0253","aliases":[],"summary":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","severity":"unknown","score":null,"package":"lru","version":"0.12.5","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.12.5","fixed":["0.18.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0253","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0253","aliases":[],"summary":"Potential use-after-free due to lack of panic safety in `LruCache::pop()`","severity":"unknown","score":null,"package":"lru","version":"0.14.0","ecosystem":"crates.io","purl":"pkg:cargo/lru@0.14.0","fixed":["0.18.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0253","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0441","aliases":[],"summary":"`pin-utils` is unmaintained","severity":"unknown","score":null,"package":"pin-utils","version":"0.1.0","ecosystem":"crates.io","purl":"pkg:cargo/pin-utils@0.1.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0441","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0173","aliases":[],"summary":"proc-macro-error2 is unmaintained","severity":"unknown","score":null,"package":"proc-macro-error2","version":"2.0.1","ecosystem":"crates.io","purl":"pkg:cargo/proc-macro-error2@2.0.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0173","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0338","aliases":["GHSA-465w-v9q3-7j98"],"summary":"Remote peer can panic quinn-proto with zero-length STREAM frames during unordered reads","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.18"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0338","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0339","aliases":["GHSA-hmxj-32vh-65vr"],"summary":"Unbounded growth of pending connection ID retirements in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0339","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0342","aliases":["GHSA-2hv7-gw8g-gpq5"],"summary":"Zero-length DATAGRAM frames bypass the receive buffer limit in quinn-proto","severity":"unknown","score":null,"package":"quinn-proto","version":"0.11.14","ecosystem":"crates.io","purl":"pkg:cargo/quinn-proto@0.11.14","fixed":["0.11.17"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0342","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.8.5","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.8.5","fixed":["0.8.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0097","aliases":["GHSA-cq8v-f236-94qc"],"summary":"Rand is unsound with a custom logger using `rand::rng()`","severity":"unknown","score":null,"package":"rand","version":"0.9.2","ecosystem":"crates.io","purl":"pkg:cargo/rand@0.9.2","fixed":["0.9.3"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0097","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"1.0.4","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@1.0.4","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2025-0134","aliases":[],"summary":"rustls-pemfile is unmaintained","severity":"unknown","score":null,"package":"rustls-pemfile","version":"2.2.0","ecosystem":"crates.io","purl":"pkg:cargo/rustls-pemfile@2.2.0","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2025-0134","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.101.7","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.101.7","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Certificate verification may accept distrusted intermediates","severity":"unknown","score":null,"package":"rustls-webpki","version":"0.103.9","ecosystem":"crates.io","purl":"pkg:cargo/rustls-webpki@0.103.9","fixed":["0.103.16"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0386","aliases":[],"summary":"`AsyncFd::new` and related constructors violate I/O safety","severity":"unknown","score":null,"package":"tokio","version":"1.50.0","ecosystem":"crates.io","purl":"pkg:cargo/tokio@1.50.0","fixed":["1.51.6"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0386","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"RUSTSEC-2026-0192","aliases":[],"summary":"`ttf-parser` is unmaintained","severity":"unknown","score":null,"package":"ttf-parser","version":"0.21.1","ecosystem":"crates.io","purl":"pkg:cargo/ttf-parser@0.21.1","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0192","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]},{"id":"CVE-2026-111943","aliases":["BIT-golang-2026-111943","GO-2026-6809","RUSTSEC-2026-0381","RUSTSEC-2026-0382","RUSTSEC-2026-0383"],"summary":"Bundled root certificates allow trust in distrusted emSign intermediates","severity":"unknown","score":null,"package":"webpki-roots","version":"1.0.6","ecosystem":"crates.io","purl":"pkg:cargo/webpki-roots@1.0.6","fixed":["1.0.10"],"url":"https://insights.sbomify.com/CVE-2026-111943/","wheels":["keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_10_12_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-macosx_11_0_arm64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_aarch64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-manylinux_2_28_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-musllinux_1_2_x86_64.whl","keeper_pam_webrtc_rs-2.1.7-cp37-abi3-win_amd64.whl"]}],"vulnerability_scan":{"scanned_sboms":7,"total_sboms":7,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"high":15,"medium":24,"low":14,"unknown":31}}}