{"url":"https://pypi.sbomify.com/package/qumat-qdp/0.2.0","markdown_url":"https://pypi.sbomify.com/package/qumat-qdp/0.2.0.md","name":"qumat-qdp","version":"0.2.0","purl":"pkg:pypi/qumat-qdp@0.2.0","summary":null,"author":null,"project_urls":{},"requires_python":"<3.13,>=3.10","license":null,"classifiers":["Development Status :: 4 - Beta","Intended Audience :: Developers","Intended Audience :: Science/Research","License :: OSI Approved :: Apache Software License","Operating System :: OS Independent","Programming Language :: Python :: 3","Programming Language :: Python :: 3 :: Only","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: Implementation :: CPython","Programming Language :: Python :: Implementation :: PyPy","Programming Language :: Rust","Topic :: Scientific/Engineering","Topic :: Scientific/Engineering :: Artificial Intelligence","Topic :: Scientific/Engineering :: Physics","Topic :: Software Development :: Libraries :: Python Modules"],"wheels":[{"filename":"qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","url":"https://files.pythonhosted.org/packages/f6/b2/09511081a9c18eb846d9a53fef88f7514b37cc9307606137e8be29e00993/qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","sboms":[{"artifact_uuid":"47676ecc-7396-5cea-addd-4d7b217312a7","path":"qumat_qdp-0.2.0.dist-info/sboms/qdp-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/47676ecc-7396-5cea-addd-4d7b217312a7/download","vulnerability_count":27,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","url":"https://files.pythonhosted.org/packages/1e/0d/44d72b171f70e4b96c91e8c0fb64d1114d610192796fd10aaa04b205c148/qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","sboms":[{"artifact_uuid":"ee66c7aa-6164-5e97-bbb0-82e8f1f5003c","path":"qumat_qdp-0.2.0.dist-info/sboms/qdp-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/ee66c7aa-6164-5e97-bbb0-82e8f1f5003c/download","vulnerability_count":27,"scan_error":null}],"attestation":{"status":"not_available"}},{"filename":"qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl","url":"https://files.pythonhosted.org/packages/0f/91/06dbd19114bbbc06c41f382b8682710de2249be34fd404e27c3ca2104a64/qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl","sboms":[{"artifact_uuid":"ff6ec132-062b-5db3-9401-87b9765139c5","path":"qumat_qdp-0.2.0.dist-info/sboms/qdp-python.cyclonedx.json","format":"CycloneDX/1.5","format_family":"CycloneDX","valid":true,"media_type":"application/vnd.cyclonedx+json","download_url":"https://pypi.sbomify.com/artifact/ff6ec132-062b-5db3-9401-87b9765139c5/download","vulnerability_count":27,"scan_error":null}],"attestation":{"status":"not_available"}}],"formats":["CycloneDX"],"sbom_count":3,"has_attestation":false,"vulnerabilities":[{"id":"CVE-2026-115905","aliases":["GHSA-m665-v7pm-7grj"],"summary":"zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE","severity":"critical","score":10.0,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.5"],"url":"https://insights.sbomify.com/CVE-2026-115905/","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0369","aliases":["GHSA-4684-h2q9-2vcp"],"summary":"ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the target","severity":"critical","score":9.1,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0369","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0176","aliases":["GHSA-36hh-v3qg-5jq4"],"summary":"Out-of-bounds read in `nth` / `nth_back` for `PyList` and `PyTuple` iterators","severity":"high","score":8.7,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0176","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"CVE-2026-43868","aliases":["BIT-thrift-2026-43868","GHSA-2f9f-gq7v-9h6m","RUSTSEC-2026-0435"],"summary":"Unbounded memory allocation in `thrift` binary protocol `read_bytes`","severity":"high","score":7.5,"package":"thrift","version":"0.17.0","ecosystem":"crates.io","purl":"pkg:cargo/thrift@0.17.0","fixed":["0.23.0"],"url":"https://insights.sbomify.com/CVE-2026-43868/","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"CVE-2026-115909","aliases":["GHSA-q7v9-x93c-xqv3","RUSTSEC-2026-0429"],"summary":"zip: `ZipArchive::extract` aborts the process on a symlink entry with a large declared size","severity":"high","score":7.5,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.0"],"url":"https://insights.sbomify.com/CVE-2026-115909/","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0367","aliases":["GHSA-vv5m-jxxh-4627"],"summary":" Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation","severity":"high","score":7.3,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0367","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"CVE-2026-115906","aliases":["GHSA-8hxf-qr8p-62x4"],"summary":"zip: AES Entry HMAC Authentication Bypass on Premature EOF","severity":"medium","score":6.5,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.0"],"url":"https://insights.sbomify.com/CVE-2026-115906/","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0177","aliases":["GHSA-chgr-c6px-7xpp"],"summary":"Missing `Sync` bound on `PyCFunction::new_closure` closures","severity":"medium","score":6.3,"package":"pyo3","version":"0.27.2","ecosystem":"crates.io","purl":"pkg:cargo/pyo3@0.27.2","fixed":["0.29.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0177","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0190","aliases":[],"summary":"Unsoundness in `Error::downcast_mut()`","severity":"unknown","score":null,"package":"anyhow","version":"1.0.100","ecosystem":"crates.io","purl":"pkg:cargo/anyhow@1.0.100","fixed":["1.0.103"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0190","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"CVE-2026-111959","aliases":["GHSA-gqmm-qrjq-4c7h","RUSTSEC-2026-0442"],"summary":"Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads","severity":"unknown","score":null,"package":"arrow-data","version":"54.3.1","ecosystem":"crates.io","purl":"pkg:cargo/arrow-data@54.3.1","fixed":["57.3.2"],"url":"https://insights.sbomify.com/CVE-2026-111959/","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0204","aliases":[],"summary":"Invalid pointer dereference in `fmt::Pointer` impl for `Atomic` and `Shared` when the underlying pointer is invalid","severity":"unknown","score":null,"package":"crossbeam-epoch","version":"0.9.18","ecosystem":"crates.io","purl":"pkg:cargo/crossbeam-epoch@0.9.18","fixed":["0.9.20"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0204","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2024-0436","aliases":[],"summary":"paste - no longer maintained","severity":"unknown","score":null,"package":"paste","version":"1.0.15","ecosystem":"crates.io","purl":"pkg:cargo/paste@1.0.15","fixed":[],"url":"https://osv.dev/vulnerability/RUSTSEC-2024-0436","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0368","aliases":["GHSA-4v9h-p7m9-rh26"],"summary":"zip: `ZipArchive::extract` creates symbolic links whose attacker-controlled targets are outside the destination directory","severity":"unknown","score":null,"package":"zip","version":"2.4.2","ecosystem":"crates.io","purl":"pkg:cargo/zip@2.4.2","fixed":["9.0.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0368","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0391","aliases":[],"summary":"Data from an abandoned stream leaks into the next stream on a reused context","severity":"unknown","score":null,"package":"zstd","version":"0.13.3","ecosystem":"crates.io","purl":"pkg:cargo/zstd@0.13.3","fixed":["0.13.4"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0391","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0395","aliases":[],"summary":"Use-after-free with `CParameter::StableInBuffer`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0395","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0396","aliases":[],"summary":"`Seekable` reads a NULL or out-of-bounds seek table","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0396","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0397","aliases":[],"summary":"`OutBuffer::around_pos` exposes uninitialized memory","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0397","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0398","aliases":[],"summary":"`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0398","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0399","aliases":[],"summary":"Use-after-free through `init_using_cdict` and `init_using_ddict`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0399","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0400","aliases":[],"summary":"Use-after-free of a dictionary after a one-shot call on a context with an open stream","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0400","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0401","aliases":[],"summary":"Out-of-bounds read in `train_from_buffer` when sample sizes overflow","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0401","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0402","aliases":[],"summary":"Heap buffer overflow in `CCtx::try_clone` on a multithreaded context","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0402","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0403","aliases":[],"summary":"Uninitialized memory exposed when streaming decompression of a legacy frame fails","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0403","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0404","aliases":[],"summary":"Double free in `DCtx::try_clone`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0404","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0405","aliases":[],"summary":"Out-of-bounds read with an out-of-range `InBuffer::pos`","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0405","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0406","aliases":[],"summary":"Use-after-free when changing a multithreaded context with an unfinished frame","severity":"unknown","score":null,"package":"zstd-safe","version":"7.2.4","ecosystem":"crates.io","purl":"pkg:cargo/zstd-safe@7.2.4","fixed":["7.4.0"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0406","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]},{"id":"RUSTSEC-2026-0410","aliases":[],"summary":"WebAssembly allocator shim corrupts memory on allocation failure","severity":"unknown","score":null,"package":"zstd-sys","version":"2.0.16+zstd.1.5.7","ecosystem":"crates.io","purl":"pkg:cargo/zstd-sys@2.0.16%2Bzstd.1.5.7","fixed":["2.1.2"],"url":"https://osv.dev/vulnerability/RUSTSEC-2026-0410","wheels":["qumat_qdp-0.2.0-cp310-cp310-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp311-cp311-manylinux_2_34_x86_64.whl","qumat_qdp-0.2.0-cp312-cp312-manylinux_2_34_x86_64.whl"]}],"vulnerability_scan":{"scanned_sboms":3,"total_sboms":3,"scanned_at":"2026-11-10","scanner":"osv-scanner 2.7.0","severity_counts":{"critical":2,"high":4,"medium":2,"unknown":19}}}