Your dependencies cross-checked against the OSV vulnerability database.
-
Worth fixing PYSEC-2026-2078 NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. Prior to 3.10.0-rc1, nltk.data.lo
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-54293). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-3581 Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-12072). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-3582 Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-12061). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-3583 Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-12075). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-3584 Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-12074). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-597 NLTK version 3.9.4 is vulnerable to a path traversal attack due to an incomplete fix for GitHub Issue #3504. The `_UNSAFE_NO_PROTOCOL_RE` regex in `nltk/data.py` checks for literal `../` sequences but
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-12243). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2018-28 The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to dis
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2018-18074). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2023-74 Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `re
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2023-32681). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1872 Requests vulnerable to .netrc credentials leak via malicious URLs
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2024-47081). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1873 Requests `Session` object does not verify requests after making first request with verify=False
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2024-35195). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-2275 Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system te
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-25645). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2017-74 The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2016-10075). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2020-148 urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: thi
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2020-26137). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2023-192 urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of t
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2023-43804). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2023-212 urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had i
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2023-45803). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-141 urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=Fal
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-44431). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1994 urllib3 streaming API improperly handles highly compressed data
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2025-66471). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1995 urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2024-37891). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1996 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2026-21441). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1998 urllib3 allows an unbounded number of links in the decompression chain
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2025-66418). Fix: Update that package to its patched version.
-
Worth fixing PYSEC-2026-1999 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2025-50181). Fix: Update that package to its patched version.
-
Minor PYSEC-2026-1976 tqdm CLI arguments injection attack
/workdirs/scan-81dcf004-9e58-458a-bab5-0e29bcdde480/examples/pytorch/bert/bert-quantization-sparsity/requirements.txt
A package you depend on has a known security hole (CVE-2024-34062). Fix: Update that package to its patched version.