echod (0.1.0), muffin (>=0.0.94, <=0.0.97) potentially affected by CVE-2025-69225 via aiohttp (0.16.5)

aiohttp PYPI version 0.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - echod 0.1.0 - muffin =0.0.94, =0.0.97 Source cves: CVE-2025-69225 Source advisory: OSV:PYSEC-2026-1109...

muffin (>=0.0.107, <=0.1.0) potentially affected by CVE-2025-69227 via aiohttp (0.17.1)

aiohttp PYPI version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.107, =0.1.0 Source cves: CVE-2025-69227 Source advisory: OSV:PYSEC-2026-1107...

aioboto3 (2.2.0), aiobotocore (>=0.5.0, <=0.5.3) +56 more potentially affected by CVE-2025-69225 via aiohttp (2.3.10)

aiohttp PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 2.2.0 - aiobotocore =0.5.0, =0.8.4, =0.1.0a1, =1.0.0, =3.0.0b4, =2.0.0, =1.1.1, =1.2.1, =2.1.0, =0.8.22, =2.0.0, =2.0.13 and more Source...

homeassistant (>=0.38.0, <=0.38.4), okami (>=0.1.2, <=0.1.3) +1 more potentially affected by CVE-2025-69224 via aiohttp (1.3.1)

aiohttp PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.38.0, =0.1.2, =0.1.3 - pyatv 0.1.4 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

aio-tinder (>=0.1.1, <=0.1.3), muffin (0.9.0) +3 more potentially affected by CVE-2025-69224 via aiohttp (0.22.5)

aiohttp PYPI version 0.22.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aio-tinder =0.1.1, =0.0.3, =0.1.0, =0.4.0 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

PYSEC-2026-1097 AIOHTTP vulnerable to brute-force leak of internal static file path components

Summary Path normalization for static files prevents path traversal, but opens up the ability for an attacker to ascertain the existence of absolute path components. Impact If an application uses web.static not recommended for production deployments, it may be possible for an attacker to ascertai...

muffin (>=0.0.46, <=0.0.52) potentially affected by CVE-2025-69227 via aiohttp (0.15.0)

aiohttp PYPI version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.46, =0.0.52 Source cves: CVE-2025-69227 Source advisory: OSV:PYSEC-2026-1107...

botstory (>=0.0.33, <=0.0.37) potentially affected by CVE-2025-69227 via aiohttp (1.1.1)

aiohttp PYPI version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.33, =0.0.37 Source cves: CVE-2025-69227 Source advisory: OSV:PYSEC-2026-1107...

botstory (0.0.63) potentially affected by CVE-2025-69224 via aiohttp (2.0.1)

aiohttp PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory 0.0.63 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

aiogremlin (>=3.2.4b1, <=3.2.5), goblin (2.0.0b1) +3 more potentially affected by CVE-2025-69226 via aiohttp (1.3.3)

aiohttp PYPI version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin =3.2.4b1, =0.39.0, =1.0.0b1, =1.0.0b2 - okami 0.1.4 Source cves: CVE-2025-69226 Source advisory: OSV:PYSEC-2026-1097...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2025-69225 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2025-69225 Source advisory: OSV:PYSEC-2026-1109...

aioboto3 (>=1.1.0, <=2.1.0), aiobotocore (>=0.4.2, <=0.4.5) +2 more potentially affected by CVE-2025-69227 via aiohttp (2.3.0)

aiohttp PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioboto3 =1.1.0, =0.4.2, =0.4.1b31, =0.6.0b19, =0.6.0b23 Source cves: CVE-2025-69227 Source advisory: OSV:PYSEC-2026-1107...

muffin (>=0.2.0, <=0.2.1) potentially affected by CVE-2025-69225 via aiohttp (0.17.4)

aiohttp PYPI version 0.17.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.2.0, =0.2.1 Source cves: CVE-2025-69225 Source advisory: OSV:PYSEC-2026-1109...

homeassistant (>=0.42.0, <=0.42.3) potentially affected by CVE-2025-69224 via aiohttp (2.0.5)

aiohttp PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.42.0, =0.42.3 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

botstory (>=0.0.38, <=0.0.62), cr8 (0.9.1) +2 more potentially affected by CVE-2025-69227 via aiohttp (1.1.6)

aiohttp PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - botstory =0.0.38, =0.0.5, =0.34.0, =0.35.3 Source cves: CVE-2025-69227 Source advisory: OSV:PYSEC-2026-1107...

hdx-data-freshness (>=1.0.5, <=1.1.2), pyplanet (>=0.6.0rc1, <=0.10.5) potentially affected by CVE-2025-69224 via aiohttp (2.3.9)

aiohttp PYPI version 2.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - hdx-data-freshness =1.0.5, =0.6.0rc1, =0.10.5 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

s2aio (>=1.12.0, <=1.14.0) potentially affected by CVE-2025-69226 via aiohttp (0.22.4)

aiohttp PYPI version 0.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - s2aio =1.12.0, =1.14.0 Source cves: CVE-2025-69226 Source advisory: OSV:PYSEC-2026-1097...

muffin (>=0.0.2, <=0.0.22) potentially affected by CVE-2025-69225 via aiohttp (0.14.1)

aiohttp PYPI version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - muffin =0.0.2, =0.0.22 Source cves: CVE-2025-69225 Source advisory: OSV:PYSEC-2026-1109...

scriptworker (0.2.1) potentially affected by CVE-2025-69224 via aiohttp (0.22.0a0)

aiohttp PYPI version 0.22.0a0 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - scriptworker 0.2.1 Source cves: CVE-2025-69224 Source advisory: OSV:PYSEC-2026-1099...

aioservice (0.0.1), devtools-proxy (0.0.4) +4 more potentially affected by CVE-2025-69224 via aiohttp (1.1.5)

aiohttp PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aioservice 0.0.1 - devtools-proxy 0.0.4 - fastcli 0.1.0 - goblin 1.0.0b2 - metadoc =0.9.1, =0.10.5 - python-functionsclient 0.0.1 Source cves:...