fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2024-6345 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-19...

skia-python vendors vulnerable libfreetype because of pinned cibuildwheel version

Impact The Linux wheels for skia-python vendor a vulnerable version of libfreetype that is affected by CVE-2025-27363 1. The root cause is a chain of unfortunate events: 1. skia-python builds wheels using pinned pypa/[email protected] 2 2. cibuildwheel 2.21.3 in turn pins manylinux container...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory:...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2025-47273 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-4...

GHSA-3VPC-4P9P-47HC curl_cffi bundles a version of libcurl affected by High Severity vulnerability

Summary curlcffi is potentially affected by High Severity vulnerability CVE-2023-38545 in libcurl=8.5, which is not affected by this issue...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2022-40897 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2022-40897 Source advisory:...