botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2026-47265 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2026-47265 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2026-47265 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

PYSEC-2026-2105

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the cookies parameter on requests are sent after following a cross-origin redirect. If a developer uses the cookies parameter on a per-request basis then sensitive data might ...

interest (0.0.1) potentially affected by CVE-2026-47265 via aiohttp (0.14.0)

aiohttp PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - interest 0.0.1 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2026-47265 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2026-47265 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

muffin (>=0.0.107, <=0.1.0) potentially affected by CVE-2026-47265 via aiohttp (0.17.1)

aiohttp PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.107, =0.1.0 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2026-47265 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-47265 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-47265 Source advisory: OSV:PYSEC-2026-2105...

PYSEC-2026-2104

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using CookieJar.load with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect man...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2026-34993 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2026-34993 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2026-34993 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2026-34993 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

iamine (>=0.1.5, <=0.1.6) potentially affected by CVE-2026-34993 via aiohttp (0.13.1)

aiohttp PYPI version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - iamine =0.1.5, =0.1.6 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

geoffrey (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-34993 via aiohttp (0.6.4)

aiohttp PYPI version 0.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - geoffrey =0.1.0, =0.1.2 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

okami (0.1.5) potentially affected by CVE-2026-34993 via aiohttp (2.0.3)

aiohttp PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - okami 0.1.5 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

appdaemon (>=3.0.0b2, <=3.0.0b3), balebot (>=1.2.3, <=1.8.15) +4 more potentially affected by CVE-2026-34993 via aiohttp (2.3.7)

aiohttp PYPI version 2.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - appdaemon =3.0.0b2, =1.2.3, =0.61.1, =0.0.1, =0.2.1 - tictax 0.1.3 Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...

0x20bf (0.0.1), 2keys (0.5.1) +3450 more potentially affected by CVE-2026-34993 via aiohttp (>=3.0.0b0, <=3.13.5)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.0.15, =0.1.0, =0.5.0a0, =3.0.1, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.9 and more Source cves: CVE-2026-34993 Source advisory: OSV:PYSEC-2026-2104...