muffin (>=0.0.105, <=0.0.106) potentially affected by CVE-2025-69227 via aiohttp (0.17.0)

aiohttp PYPI version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.105, =0.0.106 Source cves: CVE-2025-69227 Source advisory: OSV:GHSA-JJ3X-WXRX-4X23...

aio-tinder (>=0.1.7, <=0.1.8) potentially affected by CVE-2025-69226 via aiohttp (1.0.1)

aiohttp PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.7, =0.1.8 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

scriptworker (0.2.1) potentially affected by CVE-2025-69226 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

devtools-proxy (>=0.0.2, <=0.0.3) potentially affected by CVE-2025-69226 via aiohttp (1.1.4)

aiohttp PYPI version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - devtools-proxy =0.0.2, =0.0.3 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

botstory (0.0.63) potentially affected by CVE-2025-69226 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

muffin (>=0.1.5, <=0.1.6) potentially affected by CVE-2025-69226 via aiohttp (0.17.3)

aiohttp PYPI version 0.17.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.1.5, =0.1.6 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aiourlshortener (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-69226 via aiohttp (2.0.2)

aiohttp PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiourlshortener =0.0.1, =0.0.2 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2025-69226 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

muffin (>=0.0.98, <=0.0.104) potentially affected by CVE-2025-69226 via aiohttp (0.16.6)

aiohttp PYPI version 0.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.98, =0.0.104 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

EUVD-2026-1046

AIOHTTP vulnerable to brute-force leak of internal static file path components...

muffin (>=0.3.3, <=0.3.7) potentially affected by CVE-2025-69226 via aiohttp (0.18.4)

aiohttp PYPI version 0.18.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.3.3, =0.3.7 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

AIOHTTP vulnerable to brute-force leak of internal static file path components

Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertai...

homeassistant (>=0.36.0, <=0.37.1), hypr (0.8.2) +3 more potentially affected by CVE-2025-69226 via aiohttp (1.2.0)

aiohttp PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.36.0, =0.1.0, =0.1.0, =1.5.9, =1.5.12 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aiohttp-cors (0.3.0), aslack (0.11.0) +1 more potentially affected by CVE-2025-69226 via aiohttp (0.20.2)

aiohttp PYPI version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiohttp-cors 0.3.0 - aslack 0.11.0 - muffin =0.5.2, =0.5.12 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

0x20bf (0.0.1), 2keys (0.5.1) +3141 more potentially affected by CVE-2025-69226 via aiohttp (>=3.0.0b0, <=3.13.2)

aiohttp PYPI version =3.0.0b0, =0.0.1a0, =0.1.0, =0.5.0a0, =1.0.0, =1.0.0, =0.0.1, =1.0.2, =0.2.1, =0.1.2, =0.1.0, =0.1.0b0, =1.0.99 and more Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2025-69226 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2025-69226 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

pyatv (>=0.1.2, <=0.1.3) potentially affected by CVE-2025-69226 via aiohttp (1.3.0)

aiohttp PYPI version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - pyatv =0.1.2, =0.1.3 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2025-69226 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...

muffin (>=0.0.23, <=0.0.45) potentially affected by CVE-2025-69226 via aiohttp (0.14.4)

aiohttp PYPI version 0.14.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.23, =0.0.45 Source cves: CVE-2025-69226 Source advisory: OSV:GHSA-54JQ-C3M8-4M76...