# SBOM for pyegui 0.5.0
> Immediate mode GUI library
The Python package pyegui 0.5.0 ships 14 SBOM files (CycloneDX) inside its wheels, under `.dist-info/sboms/` ([PEP 770](https://peps.python.org/pep-0770/)). Its wheels carry a verified PEP 740 attestation.
- Package URL (PURL): `pkg:pypi/pyegui@0.5.0`
- PyPI: https://pypi.org/project/pyegui/0.5.0/
- Author: GachiLord
- Requires Python: \>=3.11
- Documentation:
- Homepage:
- Issues:
- Repository:
## SBOMs
### pyegui-0.5.0-cp311-abi3-macosx\_10\_12\_x86\_64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/5766412b-4f4c-55ef-a317-75b5732da90e/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 18 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-macosx\_11\_0\_arm64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/fa8ad960-3d06-5c76-81f9-ce5eb3102188/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 18 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_aarch64.manylinux2014\_aarch64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/beaa62b9-2491-5209-a8f5-a39b1f5a6d32/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_armv7l.manylinux2014\_armv7l.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/3ce6986b-256a-5356-9a2b-3b13385b5aae/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_i686.manylinux2014\_i686.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/ef59f033-6746-5825-b954-5aac16f4f918/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_ppc64le.manylinux2014\_ppc64le.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/cafcfdf3-f6e4-50ae-b750-bdf3ae4ab3bb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_s390x.manylinux2014\_s390x.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/b19e9c10-17b6-5ce0-b60f-2d5ac2431adc/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-manylinux\_2\_17\_x86\_64.manylinux2014\_x86\_64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/bcc98ca5-76e3-5f93-a5db-aaf327d9f1b9/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-musllinux\_1\_2\_aarch64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/a56a7c42-2bc3-52c4-b0de-64edf79f2382/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-musllinux\_1\_2\_armv7l.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/982b1ff3-4981-5ca7-8516-818c3bcb4b23/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-musllinux\_1\_2\_i686.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/cbf8ff73-3d8c-5c78-8205-41c61228e8eb/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-musllinux\_1\_2\_x86\_64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/548ce4df-7cb1-56b7-86c9-ca119e65711b/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 28 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-win32.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/b4bdf182-4333-560c-abe4-d88fa1e4c455/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 18 known vulnerabilities
### pyegui-0.5.0-cp311-abi3-win\_amd64.whl
PEP 740 attestation verified (GitHub, GachiLord/pyegui, workflow CI.yml).
- [pyegui-0.5.0.dist-info/sboms/pyegui.cyclonedx.json](https://pypi.sbomify.com/artifact/1af645a0-9bb2-563b-b98f-642fe5c92d3d/download): CycloneDX/1.5, `application/vnd.cyclonedx+json`, valid, 18 known vulnerabilities
## Known vulnerabilities
Components listed in these SBOMs, matched against the [OSV database](https://osv.dev/) as of 2026-11-10.
| Vulnerability | Severity | Component | Fixed in | Summary |
|---|---|---|---|---|
| [RUSTSEC-2026-0176](https://osv.dev/vulnerability/RUSTSEC-2026-0176) | high (8.7) | pyo3 0.24.1 (crates.io) | 0.29.0 | Out-of-bounds read in \`nth\` / \`nth\_back\` for \`PyList\` and \`PyTuple\` iterators |
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.30.0 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0194](https://osv.dev/vulnerability/RUSTSEC-2026-0194) | high (7.5) | quick-xml 0.37.4 (crates.io) | 0.41.0 | Quadratic run time when checking a start tag for duplicate attribute names |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.30.0 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [RUSTSEC-2026-0195](https://osv.dev/vulnerability/RUSTSEC-2026-0195) | high (7.5) | quick-xml 0.37.4 (crates.io) | 0.41.0 | Unbounded namespace-declaration allocation in \`NsReader\` enables memory-exhaustion denial of service |
| [CVE-2026-93599](https://insights.sbomify.com/CVE-2026-93599/) | high (7.5) | rustls-webpki 0.103.1 (crates.io) | 0.103.13 | Reachable panic in certificate revocation list parsing |
| [RUSTSEC-2026-0177](https://osv.dev/vulnerability/RUSTSEC-2026-0177) | medium (6.3) | pyo3 0.24.1 (crates.io) | 0.29.0 | Missing \`Sync\` bound on \`PyCFunction::new\_closure\` closures |
| [CVE-2026-123613](https://insights.sbomify.com/CVE-2026-123613/) | medium (5.3) | rustls 0.23.25 (crates.io) | 0.23.45 | TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
| [CVE-2026-93602](https://insights.sbomify.com/CVE-2026-93602/) | medium (4.4) | rustls-webpki 0.103.1 (crates.io) | 0.103.10 | CRLs not considered authoritative by Distribution Point due to faulty matching logic |
| [CVE-2026-123609](https://insights.sbomify.com/CVE-2026-123609/) | medium (4.0) | rustls 0.23.25 (crates.io) | 0.23.46 | \`Debug\` impls for client session values expose TLS secrets |
| [CVE-2026-123610](https://insights.sbomify.com/CVE-2026-123610/) | low (3.7) | rustls 0.23.25 (crates.io) | 0.23.46 | Brotli certificate decompression can allocate up to 1 GiB before authentication |
| [CVE-2026-123611](https://insights.sbomify.com/CVE-2026-123611/) | low (3.7) | rustls 0.23.25 (crates.io) | 0.23.46 | Unauthenticated ServerHello can downgrade later connections to classical key exchange |
| [CVE-2026-93600](https://insights.sbomify.com/CVE-2026-93600/) | low (2.2) | rustls-webpki 0.103.1 (crates.io) | 0.103.12 | Name constraints for URI names were incorrectly accepted |
| [CVE-2026-93601](https://insights.sbomify.com/CVE-2026-93601/) | low (2.2) | rustls-webpki 0.103.1 (crates.io) | 0.103.12 | Name constraints were accepted for certificates asserting a wildcard name |
| [RUSTSEC-2026-0190](https://osv.dev/vulnerability/RUSTSEC-2026-0190) | unknown | anyhow 1.0.97 (crates.io) | 1.0.103 | Unsoundness in \`Error::downcast\_mut()\` |
| [RUSTSEC-2026-0204](https://osv.dev/vulnerability/RUSTSEC-2026-0204) | unknown | crossbeam-epoch 0.9.18 (crates.io) | 0.9.20 | Invalid pointer dereference in \`fmt::Pointer\` impl for \`Atomic\` and \`Shared\` when the underlying pointer is invalid |
| [RUSTSEC-2026-0221](https://osv.dev/vulnerability/RUSTSEC-2026-0221) | unknown | event-listener 5.4.0 (crates.io) | 5.4.2 | \`event-listener\` allows \`!Send\` tags to cross thread boundaries via \`StackSlot\` |
| [RUSTSEC-2026-0186](https://osv.dev/vulnerability/RUSTSEC-2026-0186) | unknown | memmap2 0.9.5 (crates.io) | 0.9.11 | Unchecked pointer offset in crate \`memmap2\` |
| [RUSTSEC-2024-0436](https://osv.dev/vulnerability/RUSTSEC-2024-0436) | unknown | paste 1.0.15 (crates.io) | none listed | paste - no longer maintained |
| [RUSTSEC-2026-0441](https://osv.dev/vulnerability/RUSTSEC-2026-0441) | unknown | pin-utils 0.1.0 (crates.io) | none listed | \`pin-utils\` is unmaintained |
| [RUSTSEC-2026-0097](https://osv.dev/vulnerability/RUSTSEC-2026-0097) | unknown | rand 0.8.5 (crates.io) | 0.8.6 | Rand is unsound with a custom logger using \`rand::rng()\` |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | rustls-webpki 0.103.1 (crates.io) | 0.103.16 | Certificate verification may accept distrusted intermediates |
| [RUSTSEC-2026-0192](https://osv.dev/vulnerability/RUSTSEC-2026-0192) | unknown | ttf-parser 0.25.1 (crates.io) | none listed | \`ttf-parser\` is unmaintained |
| [RUSTSEC-2026-0257](https://osv.dev/vulnerability/RUSTSEC-2026-0257) | unknown | webbrowser 1.0.4 (crates.io) | 1.2.2 | Unix \`BROWSER\` handling allows browser argument injection |
| [CVE-2026-111943](https://insights.sbomify.com/CVE-2026-111943/) | unknown | webpki-roots 0.26.8 (crates.io) | 0.26.11 | Bundled root certificates allow trust in distrusted emSign intermediates |
| [RUSTSEC-2026-0371](https://osv.dev/vulnerability/RUSTSEC-2026-0371) | unknown | zbus\_names 3.0.0 (crates.io) | none listed | \`zbus\_names\` is unmaintained |
| [RUSTSEC-2026-0370](https://osv.dev/vulnerability/RUSTSEC-2026-0370) | unknown | zvariant 4.2.0 (crates.io) | none listed | \`zvariant\` is unmaintained |
| [RUSTSEC-2026-0372](https://osv.dev/vulnerability/RUSTSEC-2026-0372) | unknown | zvariant\_derive 4.2.0 (crates.io) | none listed | \`zvariant\_derive\` is unmaintained |
## Fetch it over TEA
This SBOM is served over the [Transparency Exchange API](https://github.com/CycloneDX/transparency-exchange-api) (TEA). With the `libtea` client:
```
pip install libtea
python -m libtea https://pypi.sbomify.com pkg:pypi/pyegui@0.5.0
```
Machine-readable copy of this page: https://pypi.sbomify.com/package/pyegui/0.5.0.json
---
From pypi-tea by sbomify: https://pypi.sbomify.com/package/pyegui/0.5.0